// The number of successful finished jobs to retain.
  // This is a pointer to distinguish between explicit zero and not specified.
  // Defaults to 3.
  // +optional
  optional int32 successfulJobsHistoryLimit = 6;

  // The number of failed finished jobs to retain.
  // This is a pointer to distinguish between explicit zero and not specified.
  // Defaults to 1.
  // +optional
  optional int32 failedJobsHistoryLimit = 7;
}

		GetTrustedCa().
		GetInlineBytes()

	// seems as though the most straightforward way to tell whether this is a root ca or not
	// is to check whether the inline bytes of the cert chain or the trusted ca field is zero length
	if len(certChainSecret) > 0 {
		builder.Data(string(certChainSecret))
	} else if len(caDataSecret) > 0 {
		builder.Data(string(caDataSecret))
	}

	secret, err := builder.Build()
	if err != nil {

	"istio.io/istio/pkg/test/util/assert"
)

func TestDescribeRouteDomains(t *testing.T) {
	tests := []struct {
		desc     string
		domains  []string
		expected string
	}{
		{
			desc:     "test zero domain",
			domains:  []string{},
			expected: "",
		},
		{
			desc:     "test only one domain",
			domains:  []string{"example.com"},
			expected: "example.com",
		},
		{

  // is ready).
  // +optional
  optional int32 minReadySeconds = 4;

  // The number of old history to retain to allow rollback.
  // This is a pointer to distinguish between explicit zero and not specified.
  // Defaults to 10.
  // +optional
  optional int32 revisionHistoryLimit = 6;
}

// DaemonSetStatus represents the current status of a daemon set.
message DaemonSetStatus {

However, this has one glaring issue: how do we get the traffic to the remote proxies, while maintaining the zero-trust properties that Istio is built upon?

A secondary goal was to enable a smoother on-ramp from "Zero" to "Getting some value".
Historically, Istio had to really be consumed all-or-nothing for things to work as expected.

// a certain combination:
// - no object exists with suitable topology and storage class name
// - such an object exists, but the capacity is unset
// - such an object exists, but the capacity is zero
//
// The producer of these objects can decide which approach is more suitable.
//
// They are consumed by the kube-scheduler when a CSI driver opts into

const (
	ExitUnknownError   = 1 // for compatibility with existing exit code
	ExitIncorrectUsage = 64
	ExitDataError      = 65 // some format error with input data

	// below here are non-zero exit codes that don't indicate an error with istioctl itself
	ExitAnalyzerFoundIssues = 79 // istioctl analyze found issues, for CI/CD
)

func GetExitCode(e error) int {
	if strings.Contains(e.Error(), "unknown command") {

  optional string type = 1;

  // value contains the amount of change which is permitted by the policy.
  // It must be greater than zero
  optional int32 value = 2;

  // periodSeconds specifies the window of time for which the policy should hold true.
  // PeriodSeconds must be greater than zero and less than or equal to 1800 (30 min).
  optional int32 periodSeconds = 3;
}

      token:
        aud: istio-ca

    sts:
      # The service port used by Security Token Service (STS) server to handle token exchange requests.
      # Setting this port to a non-zero value enables STS server.
      servicePort: 0

    # The name of the CA for workload certificates.
    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates

			customGID:   &customGID,
			golden:      filepath.Join(env.IstioSrc, "cni/pkg/plugin/testdata/custom-uid.txt.golden"),
		},
		{
			name:        "custom-uid-zero",
			annotations: map[string]string{annotation.SidecarStatus.Name: "true"},
			customUID:   &zero,
			golden:      filepath.Join(env.IstioSrc, "cni/pkg/plugin/testdata/basic.txt.golden"),
		},
		{
			name: "custom-uid-tproxy",
			annotations: map[string]string{