optional int64 observedGeneration = 1;

  // replicas is the number of Pods created by the StatefulSet controller.
  optional int32 replicas = 2;

  // readyReplicas is the number of pods created by this StatefulSet controller with a Ready Condition.
  optional int32 readyReplicas = 3;

  // currentReplicas is the number of Pods created by the StatefulSet controller from the StatefulSet version
  // indicated by currentRevision.

  replicaCount:

  kind: Deployment

  rbac:
    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
    # when using http://gateway-api.org/.
    enabled: true

  serviceAccount:
    # If set, a service account will be created. Otherwise, the default is used
    create: true
    # Annotations to add to the service account
    annotations: {}

  // skips updates for the Job.
  // +optional
  optional string completionMode = 9;

  // suspend specifies whether the Job controller should create Pods or not. If
  // a Job is created with suspend set to true, no Pods are created by the Job
  // controller. If a Job is suspended after creation (i.e. the flag goes from
  // false to true), the Job controller will delete all active Pods associated

    - `istio-cni-config` configmap with CNI plugin config to add to CNI plugin chained config
    - creates service-account `istio-cni` with `ClusterRoleBinding` to allow gets on pods' info and delete/modifications for recovery.

- `install-cni` container
    - copies `istio-cni` and `istio-iptables` to `/opt/cni/bin`
    - creates kubeconfig for the service account the pod runs under

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastSuccessfulTime = 5;
}

// JobTemplateSpec describes the data a Job should have when created from a template
message JobTemplateSpec {
  // Standard object's metadata of the jobs created from this template.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
  // +optional

	// this can happen if the pod was dynamically added to the mesh after it was created.
	// in that case, try finding the netns using procfs.
	if err := s.rescanPod(pod); err != nil {
		log.Errorf("error scanning proc: error was %s", err)
		return nil, err
	}
	// try again. we can still get here if the pod is in the process of being created.
	// in this case the CNI will be invoked soon and provide us with the netns.

To install with Helm, you must first create the namespace that you wish to install in if the namespace does not exist already. The default namespace used is `istio-system` and can be created as follows:

```console
kubectl create namespace istio-system
```

Istio's helm charts come with a common `openshift` profile that can be used during installation.

# Adapted from istio-discovery/templates/mutatingwebhook.yaml
# Removed paths for legacy and default selectors since a revision tag
# is inherently created from a specific revision
{{- $whv := dict
 "revision" .Values.revision
  "injectionPath" .Values.istiodRemote.injectionPath
  "injectionURL" .Values.istiodRemote.injectionURL
  "reinvocationPolicy" .Values.sidecarInjectorWebhook.reinvocationPolicy
  "namespace" .Release.Namespace }}
{{- define "core" }}

		// TestMode is required to not wait in the go client for resources that will never be created in the test server.
		helmreconciler.TestMode = true
		// Add install and controller to the list of commands to run tests against.
		testedManifestCmds = append(testedManifestCmds, cmdApply, cmdController)
	}
}

// recreateTestEnv (re)creates a kubebuilder fake API server environment. This is required for testing of the

}

// ResourceClaimSpec defines how a resource is to be allocated.
message ResourceClaimSpec {
  // ResourceClassName references the driver and additional parameters
  // via the name of a ResourceClass that was created as part of the
  // driver deployment.
  optional string resourceClassName = 1;

  // ParametersRef references a separate object with arbitrary parameters