message DaemonSetUpdateStrategy {
  // Type of daemon set update. Can be "RollingUpdate" or "OnDelete". Default is RollingUpdate.
  // +optional
  optional string type = 1;

  // Rolling update config params. Present only if type = "RollingUpdate".
  // ---
  // TODO: Update this to follow our convention for oneOf, whatever we decide it
  // to be. Same as Deployment `strategy.rollingUpdate`.

  echo wget is not installed.

  echo Error: curl is not installed or does not support https, wget is not installed. \
       Cannot download envoy. Please install wget or add support of https to curl.
  exit 1
}

# Params:
#   $1: The URL of the ztunnel binary to be downloaded.
#   $2: The full path of the output binary.
#   $3: Non-versioned name to use
function download_ztunnel_if_necessary () {
  if [[ -f "$2" ]]; then
    return

        - it connects to K8S using the kubeconfig and JWT token copied from install-cni to get Pod and Namespace. Since this is a short-running command, each invocation creates a new connection.
        - If so, calls `istio-iptables` with params to setup pod netns
        - If ambient, sets up the ambient logic.

- `istio-iptables`
    - sets up iptables to redirect a list of ports to the port envoy will listen
    - shared code with istio-init container

                    "typed_config": {
                      "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext",
                      "common_tls_context": {
                        "tls_params": {
                          "tls_minimum_protocol_version": "TLSv1_3",
                          "tls_maximum_protocol_version": "TLSv1_3"
                        },
                        "alpn_protocols": [

       Cannot download envoy. Please install wget or add support of https to curl.
  exit 1
}

# Downloads and extract an Envoy binary if the artifact doesn't already exist.
# Params:
#   $1: The URL of the Envoy tar.gz to be downloaded.
#   $2: The full path of the output binary.
#   $3: Non-versioned name to use
function download_envoy_if_necessary () {
  if [[ ! -f "$2" ]] ; then

#################   COMMON SECTION   ###############################
####################################################################

# DEFAULT_KIND_IMAGE is used to set the Kubernetes version for KinD unless overridden in params to setup_kind_cluster(s)
DEFAULT_KIND_IMAGE="gcr.io/istio-testing/kind-node:v1.28.4"

# COMMON_SCRIPTS contains the directory this file is in.
COMMON_SCRIPTS=$(dirname "${BASH_SOURCE:-$0}")

function log() {

  // If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions.
  // If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied.
  // If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.
  // +optional
  optional ParamKind paramKind = 1;

message DeploymentStrategy {
  // Type of deployment. Can be "Recreate" or "RollingUpdate". Default is RollingUpdate.
  // +optional
  optional string type = 1;

  // Rolling update config params. Present only if DeploymentStrategyType =
  // RollingUpdate.
  // ---
  // TODO: Update this to follow our convention for oneOf, whatever we decide it
  // to be.
  // +optional