// FlowDistinguisherMethod specifies the method of a flow distinguisher.
message FlowDistinguisherMethod {
  // `type` is the type of flow distinguisher method
  // The supported types are "ByUser" and "ByNamespace".
  // Required.
  optional string type = 1;
}

// FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with

// FlowDistinguisherMethod specifies the method of a flow distinguisher.
message FlowDistinguisherMethod {
  // `type` is the type of flow distinguisher method
  // The supported types are "ByUser" and "ByNamespace".
  // Required.
  optional string type = 1;
}

// FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with

		return c.labelBrokenPod(pod)
	}
	return nil
}

// repairPod actually dynamically repairs a pod. This is done by entering the pods network namespace and setting up rules.
// This differs from the general CNI plugin flow, which triggers before the pod fully starts.
// Additionally, we need to jump through hoops to find the network namespace.
func (c *Controller) repairPod(pod *corev1.Pod) error {
	m := podsRepaired.With(typeLabel.Value(repairType))

// FlowDistinguisherMethod specifies the method of a flow distinguisher.
message FlowDistinguisherMethod {
  // `type` is the type of flow distinguisher method
  // The supported types are "ByUser" and "ByNamespace".
  // Required.
  optional string type = 1;
}

// FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with

// FlowDistinguisherMethod specifies the method of a flow distinguisher.
message FlowDistinguisherMethod {
  // `type` is the type of flow distinguisher method
  // The supported types are "ByUser" and "ByNamespace".
  // Required.
  optional string type = 1;
}

// FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with

Additionally, using the redirection mechanism reduces the need for clients to know the destination's ztunnel address.

Below shows an example outbound request. The "target" path is what the client sends, while the "actual" path is the real network flow after redirection.

```mermaid
graph LR
    subgraph Client Node
        Client
        CZ["Ztunnel"]
    end
    subgraph Server Node
        Server
        SZ["Ztunnel"]
    end

#### Conclusion

Overall, the high level config ingestion flow:

```mermaid
graph TD
    sd(Service Discovery)
    cs(ConfigStore)
    ep(Endpoints)
    pc(PushContext)
    sd-->pc
    cs-->pc
    sd-->ep
```

### Config Translation

      - name: error-naming
      - name: increment-decrement
      - name: var-naming
      - name: package-comments
      - name: range
      - name: receiver-naming
      - name: indent-error-flow
      - name: superfluous-else
      - name: modifies-parameter
      - name: unreachable-code
      - name: struct-tag
      - name: constant-logical-expr
      - name: bool-literal-in-expr

parent feature is disabled.

## K8s controller

TODO(rcernich).

## Manifest creation

Manifest rendering is a multi-step process, shown in the figure below. ![rendering
process](images/operator_render_flow.svg) The example in the figure shows the rendering being triggered by a CLI `mesh`
command with a `IstioOperatorSpec` CR passed to it from a file; however, the same rendering steps would occur when an