documentation, if provided along with the Derivative Works; or,
          within a display generated by the Derivative Works, if and
          wherever such third-party notices normally appear. The contents
          of the NOTICE file are for informational purposes only and
          do not modify the License. You may add Your own attribution

Additionally, it does not require any network rules/routing/config in the host network namespace, which greatly increases ambient mode compatibility with 3rd-party CNIs. In virtually all cases, this "in-pod" ambient CNI is exactly as compatible with 3rd-party CNIs as sidecars are/were.

### Notable Env Vars

          documentation, if provided along with the Derivative Works; or,
          within a display generated by the Derivative Works, if and
          wherever such third-party notices normally appear. The contents
          of the NOTICE file are for informational purposes only and
          do not modify the License. You may add Your own attribution

      - default # Contains all imports that could not be matched to another section type.
      - prefix(istio.io/) # Groups all imports with the specified Prefix.
  goimports:
    # put imports beginning with prefix after 3rd-party packages;
    # it's a comma-separated list of prefixes
    local-prefixes: istio.io/
issues:
  # Which dirs to exclude: issues from them won't be reported.

          documentation, if provided along with the Derivative Works; or,
          within a display generated by the Derivative Works, if and
          wherever such third-party notices normally appear. The contents
          of the NOTICE file are for informational purposes only and
          do not modify the License. You may add Your own attribution

message IngressClassParametersReference {
  // apiGroup is the group for the resource being referenced. If APIGroup is
  // not specified, the specified Kind must be in the core API group. For any
  // other third-party types, APIGroup is required.
  // +optional
  optional string aPIGroup = 1;

  // kind is the type of resource being referenced.
  optional string kind = 2;

  // name is the name of resource being referenced.

message IngressClassParametersReference {
  // apiGroup is the group for the resource being referenced. If APIGroup is
  // not specified, the specified Kind must be in the core API group. For any
  // other third-party types, APIGroup is required.
  // +optional
  optional string aPIGroup = 1;

  // kind is the type of resource being referenced.
  optional string kind = 2;

  // name is the name of resource being referenced.

# I tried to make this dependent on what I thought was the appropriate
# lock file, but it caused the rule for that file to get run (which
# seems to be about obtaining a new version of the 3rd party libraries).
$(TARGET_OUT)/istio_is_init: bin/init.sh istio.deps | $(TARGET_OUT)
	@# Add a retry, as occasionally we see transient connection failures to GCS
	@# Like `curl: (56) OpenSSL SSL_read: SSL_ERROR_SYSCALL, errno 104`

Agent and ingress gateways can use this to specify the CA endpoint. caAddress: "" # Used to locate istiod. istioNamespace: istio-system # Configure the policy for validating JWT. # Currently, two options are supported: "third-party-jwt" and "first-party-jwt". jwtPolicy: "third-party-jwt" # Mesh ID means Mesh Identifier. It should be unique within the scope where # meshes will interact with each other, but it is not required to be # globally/universally unique. For example, if any of the following are...

message TypedLocalObjectReference {
  // APIGroup is the group for the resource being referenced.
  // If APIGroup is not specified, the specified Kind must be in the core API group.
  // For any other third-party types, APIGroup is required.
  // +optional
  optional string apiGroup = 1;

  // Kind is the type of resource being referenced
  optional string kind = 2;