- CAP_SYS_ADMIN
- CAP_NET_ADMIN
- CAP_NET_RAW

## Ambient mode details

Fundamentally, this component is responsible for the following:

## PeerAuthentication and the Waypoint Proxy

  // and appends those labels to the pod template.  When true,
  // the user is responsible for picking unique labels and specifying
  // the selector.  Failure to pick a unique label may cause this
  // and other jobs to not function correctly.  However, You may see
  // `manualSelector=true` in jobs that were created with the old `extensions/v1beta1`
  // API.

    cs-->pc
    sd-->ep
```

### Config Translation

Config Translation turns the above inputs into the actual types consumed by the connected XDS clients (typically Envoy). This is done by `Generators`, which register a function to build a given type. For example, there is a `RouteGenerator` responsible for building `Routes`. Along with the core Envoy XDS types, there are a few custom Istio types, such as our `NameTable` type used for DNS, as well as debug interfaces.

Because Ztunnel can have Istio semantics baked in, we do not need to encode all this information on the wire.
Instead, an Istio specific field like `ExpectedTLSIdentity: spiffe://foo.bar` can encode the same information, at a fraction of the cost.

In our testing, even the most generous representations give custom types a 10x edge (in size, allocations, and CPU time) over Envoy types.

  // `limitResponse` indicates what to do with requests that can not be executed right now
  optional LimitResponse limitResponse = 2;

  // `lendablePercent` prescribes the fraction of the level's NominalCL that
  // can be borrowed by other priority levels. The value of this
  // field must be between 0 and 100, inclusive, and it defaults to 0.

  // `limitResponse` indicates what to do with requests that can not be executed right now
  optional LimitResponse limitResponse = 2;

  // `lendablePercent` prescribes the fraction of the level's NominalCL that
  // can be borrowed by other priority levels. The value of this
  // field must be between 0 and 100, inclusive, and it defaults to 0.

### Features and components

The operator has a very similar structure to istio/installer: components are grouped into features.
`IstioOperatorSpec` defines functional settings at the feature level. Functional settings are those that performs some
function in the Istio control plane without necessarily being tied to any one component that runs in a Deployment.

  // - '/' escapes to '__slash__'
  // - Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:
  // 	  "true", "false", "null", "in", "as", "break", "const", "continue", "else", "for", "function", "if",
  // 	  "import", "let", "loop", "package", "namespace", "return".
  // Examples:
  //   - Expression accessing a property named "namespace": {"Expression": "object.__namespace__ > 0"}

   between services in the cluster and from a service to external
   services. The proxies form a _secure microservice mesh_ providing a rich
   set of functions like discovery, rich layer-7 routing, circuit breakers,
   policy enforcement and telemetry recording/reporting
   functions.

  > Note: The service mesh is not an overlay network. It
  > simplifies and enhances how microservices in an application talk to each