// +optional
  optional int32 expirationSeconds = 8;

  // allowedUsages specifies a set of usage contexts the key will be
  // valid for.
  // See:
  // 	https://tools.ietf.org/html/rfc5280#section-4.2.1.3
  // 	https://tools.ietf.org/html/rfc5280#section-4.2.1.12
  //
  // Valid values are:
  //  "signing",
  //  "digital signature",
  //  "content commitment",
  //  "key encipherment",
  //  "key agreement",

          spec:
            description: 'Extend the functionality provided by the Istio proxy through
              WebAssembly filters. See more details at: https://istio.io/docs/reference/config/proxy_extensions/wasm-plugin.html'
            properties:
              failStrategy:
                description: |-
                  Specifies the failure behavior for the plugin due to fatal errors.

          spec:
            description: 'Extend the functionality provided by the Istio proxy through
              WebAssembly filters. See more details at: https://istio.io/docs/reference/config/proxy_extensions/wasm-plugin.html'
            properties:
              failStrategy:
                description: |-
                  Specifies the failure behavior for the plugin due to fatal errors.

// <suffix>          ::= <binarySI> | <decimalExponent> | <decimalSI>
// <binarySI>        ::= Ki | Mi | Gi | Ti | Pi | Ei
//
// 	(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)
//
// <decimalSI>       ::= m | "" | k | M | G | T | P | E
//
// 	(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)
//
// <decimalExponent> ::= "e" <signedNumber> | "E" <signedNumber>
// ```

      excludeInboundPorts: ""
      includeInboundPorts: "*"

      # istio egress capture allowlist
      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
      # be allowed by the sidecar

          "showLineNumbers": false,
          "showMiniMap": false
        },
        "content": "<div class=\"dashboard-header text-center\">\n<span>SERVICE: $service</span>\n</div>",
        "mode": "html"
      },
      "pluginVersion": "10.1.5",
      "transparent": true,
      "type": "text"
    },
    {
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },

  //
  // For more information about implementing this mode, see
  // https://kubernetes-csi.github.io/docs/ephemeral-local-volumes.html
  // A driver can support one or more of these modes and
  // more modes may be added in the future.
  //
  // This field is immutable.
  //
  // +optional
  repeated string volumeLifecycleModes = 3;

  //
  // For more information about implementing this mode, see
  // https://kubernetes-csi.github.io/docs/ephemeral-local-volumes.html
  // A driver can support one or more of these modes and more modes may be added in the future.
  //
  // This field is beta.
  // This field is immutable.
  //
  // +optional
  // +listType=set

  // machine-id: http://man7.org/linux/man-pages/man5/machine-id.5.html
  optional string machineID = 1;

  // SystemUUID reported by the node. For unique machine identification
  // MachineID is preferred. This field is specific to Red Hat hosts
  // https://access.redhat.com/documentation/en-us/red_hat_subscription_management/1/html/rhsm/uuid
  optional string systemUUID = 2;

  // Boot ID reported by the node.

      excludeInboundPorts: ""
      includeInboundPorts: "*"
      # istio egress capture allowlist
      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
      # be allowed by the sidecar