apps may target different 'environments' which contain different instances and variants of Istio.

- Better security: separate Istio components reside in different namespaces, allowing different teams or
roles to manage different parts of Istio. For example, a security team would maintain the
root CA and policy, a telemetry team may only have access to Prometheus,

```

**`kube.Client`** is a fairly light wrapper around Kubernetes clients, but offers quite a few benefits.
Istio consumes _many_ different types of clients (at the time of writing, 7), as well as informers for each of these.
Additionally, we often need to convert to various different client forms for different libraries we integrate with.

// returns false if one of the following check fails
// - erasure algorithm is different
// - data blocks are different
// - parity blocks are different
// - block size is different
// - distribution array size is different
// - distribution indexes are different
func (ei ErasureInfo) Equal(nei ErasureInfo) bool {
	if ei.Algorithm != nei.Algorithm {
		return false
	}

        map sigbuild-r2.12-python3.10 2.12-python3.10
        map sigbuild-r2.12-python3.11 2.12-python3.11
        # TF 2.12 + Clang (containers are the same, but env vars in configs.bzl are different)
        map sigbuild-r2.12-clang 2.12-python3.9
        map sigbuild-r2.12-clang-python3.8 2.12-python3.8
        map sigbuild-r2.12-clang-python3.9 2.12-python3.9
        map sigbuild-r2.12-clang-python3.10 2.12-python3.10

		{cred, Credentials{}, false},
		// Empty credentials.
		{Credentials{}, cred, false},
		// Two different credentialss
		{cred, cred2, false},
		// Access key is different in credentials to compare.
		{cred, Credentials{AccessKey: "myuser", SecretKey: cred.SecretKey}, false},
		// Secret key is different in credentials to compare.
		{cred, Credentials{AccessKey: cred.AccessKey, SecretKey: "mypassword"}, false},
	}

message IngressClassSpec {
  // controller refers to the name of the controller that should handle this
  // class. This allows for different "flavors" that are controlled by the
  // same controller. For example, you may have different parameters for the
  // same implementing controller. This should be specified as a
  // domain-prefixed path no more than 250 characters in length, e.g.

 * com.google.common.collect.testing.FeatureSpecificTestSuiteBuilder#withFeatures(Feature...)}),
 * this annotation specifies each of the different sizes for which a test suite should be built. (In
 * a typical case, the features should include {@link CollectionSize#ANY}.) These semantics are thus
 * a little different from those of other Collection-related features such as {@link
 * CollectionFeature} or {@link SetFeature}.
 *

 * com.google.common.collect.testing.FeatureSpecificTestSuiteBuilder#withFeatures(Feature...)}),
 * this annotation specifies each of the different sizes for which a test suite should be built. (In
 * a typical case, the features should include {@link CollectionSize#ANY}.) These semantics are thus
 * a little different from those of other Collection-related features such as {@link
 * CollectionFeature} or {@link SetFeature}.
 *

        return null
      }

      HTTP_MISDIRECTED_REQUEST -> {
        // OkHttp can coalesce HTTP/2 connections even if the domain names are different. See
        // RealConnection.isEligible(). If we attempted this and the server returned HTTP 421, then
        // we can retry on a different connection.
        val requestBody = userResponse.request.body
        if (requestBody != null && requestBody.isOneShot()) {
          return null

That means that any value read in Python from an environment variable will be a `str`, and any conversion to a different type or validation has to be done in code.

## Pydantic `Settings`