// +optional
  repeated string resourceNames = 4;
}

// SelfSubjectAccessReview checks whether or the current user can perform an action.  Not filling in a
// spec.namespace means "in all namespaces".  Self is a special case, because users should always be able
// to check whether they can perform an action
message SelfSubjectAccessReview {
  // Standard list metadata.

                                rule: '((has(self.operation) ? self.operation : '''')
                                  == ''UPSERT'') ? self.value != '''' : true'
                              - message: value must not be set when operation is REMOVE
                                rule: '((has(self.operation) ? self.operation : '''')
                                  == ''REMOVE'') ? !has(self.value) : true'

Istio's AuthorizationPolicy has label selectors.
However, we intentionally do not send those as part of the Workload API, in order to keep the size low.

The obvious solution to this is to put the list of selected workloads into the policy itself.
However, this means anytime a workload changes (often), we need to update the policy.

Instead, the opposite was chosen: each workload will list the policies that select it.

  // prefixed with a single wildcard label (e.g. "*.foo.com").
  // The wildcard character '*' must appear by itself as the first DNS label and
  // matches only a single label. You cannot have a wildcard label by itself (e.g. Host == "*").
  // Requests will be matched against the Host field in the following way:

  // +optional
  optional string matchPolicy = 9;

  // NamespaceSelector decides whether to run the webhook on an object based
  // on whether the namespace for that object matches the selector. If the
  // object itself is a namespace, the matching is performed on
  // object.metadata.labels. If the object is another cluster scoped resource,
  // it never skips the webhook.
  //

operation is `UPSERT`. type: string type: object x-kubernetes-validations: - message: value must be set when operation is UPSERT rule: '((has(self.operation) ? self.operation : '''') == ''UPSERT'') ? self.value != '''' : true' - message: value must not be set when operation is REMOVE rule: '((has(self.operation) ? self.operation : '''') == ''REMOVE'') ? !has(self.value) : true' description: Optional. type: object type: object type: array providers: description: Optional. items: properties: name: description:...

          },
          "expr": "irate(process_cpu_seconds_total{app=\"istiod\"}[1m])",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "pilot (self-reported)",
          "refId": "C",
          "step": 2
        }
      ],
      "title": "vCPU",
      "type": "timeseries"
    },
    {
      "datasource": {

	ExitIncorrectUsage = 64
	ExitDataError      = 65 // some format error with input data

	// below here are non-zero exit codes that don't indicate an error with istioctl itself
	ExitAnalyzerFoundIssues = 79 // istioctl analyze found issues, for CI/CD
)

func GetExitCode(e error) int {
	if strings.Contains(e.Error(), "unknown command") {
		e = util.CommandParseError{Err: e}
	}

	checkTempFilesCleaned(tempCNIConfDir, t)
}

// RunInstallCNITest sets up temporary directories and runs the test.
//
// Doing a go test install_cni.go by itself will not execute the test as the
// file doesn't have a _test.go suffix, and this func doesn't start with a Test
// prefix. This func is only meant to be invoked programmatically. A separate

  // More info: https://examples.k8s.io/mysql-cinder-pd/README.md
  optional string volumeID = 1;

  // fsType Filesystem type to mount.
  // Must be a filesystem type supported by the host operating system.
  // Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
  // More info: https://examples.k8s.io/mysql-cinder-pd/README.md
  // +optional
  optional string fsType = 2;