testGenerateOption(t, true, func(t *testing.T, actual, expected []admitv1.MutatingWebhook) {
		assert.Equal(t, actual, expected)
	})

	// Test generate option 'false', should modify webhooks
	testGenerateOption(t, false, func(t *testing.T, actual, expected []admitv1.MutatingWebhook) {
		if err := assert.Compare(actual, expected); err == nil {
			t.Errorf("expected diff between webhooks, got none")
		}

package util

const (
	// DefaultProxyAdminPort is the default port for the proxy admin server
	DefaultProxyAdminPort = 15000

	// DefaultMeshConfigMapName is the default name of the ConfigMap with the mesh config
	// The actual name can be different - use getMeshConfigMapName
	DefaultMeshConfigMapName = "istio"

	// ConfigMapKey should match the expected MeshConfig file name
	ConfigMapKey = "mesh"

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // value represents the integer value of this priority class. This is the actual priority that pods
  // receive when they have the name of this class in their pod spec.
  optional int32 value = 2;

  // globalDefault specifies whether this PriorityClass should be considered as

func (s *secretItemBuilder) State(state string) SecretItemBuilder {
	s.state = state
	return s
}

// Build takes the set fields from the builder and constructs the actual SecretItem
// including generating the SecretMeta from the supplied cert data, if present
func (s *secretItemBuilder) Build() (SecretItem, error) {
	result := SecretItem{
		Name:        s.name,
		Data:        s.data,

  // certificate. The certificate signer may issue a certificate with a different
  // validity duration so a client must check the delta between the notBefore and
  // and notAfter fields in the issued certificate to determine the actual duration.
  //
  // The v1.22+ in-tree implementations of the well-known Kubernetes signers will
  // honor this field as long as the requested duration is not greater than the

        - the file name can be explicitly set by `CNI_CONF_NAME` env var
        - the program inserts `CNI_NETWORK_CONFIG` into the `plugins` list in `/etc/cni/net.d/${CNI_CONF_NAME}`
    - the actual code is in pkg/install - including a readiness probe, monitoring.
    - it also sets up a UDS socket for istio-cni to send logs to this container.

  // desired number of instances for the scaled object.
  // +optional
  optional int32 replicas = 1;
}

// ScaleStatus represents the current status of a scale subresource.
message ScaleStatus {
  // actual number of observed instances of the scaled object.
  optional int32 replicas = 1;

                      properties:
                        allowCredentials:
                          description: Indicates whether the caller is allowed to
                            send the actual request (not the preflight) using credentials.
                          nullable: true
                          type: boolean
                        allowHeaders:

```mermaid
graph LR
    subgraph Client Node
        Client
        CZ["Ztunnel"]
    end
    subgraph Server Node
        Server
        SZ["Ztunnel"]
    end
    Client--Plain-->CZ
    CZ-."HBONE (target)".->Server
    CZ--"HBONE (actual)"-->SZ
    SZ--Plain-->Server
```

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // value represents the integer value of this priority class. This is the actual priority that pods
  // receive when they have the name of this class in their pod spec.
  optional int32 value = 2;

  // globalDefault specifies whether this PriorityClass should be considered as