// refer to a given node as "node1", but the storage system may refer to
  // the same node as "nodeA". When Kubernetes issues a command to the storage
  // system to attach a volume to a specific node, it can use this field to
  // refer to the node name using the ID that the storage system will
  // understand, e.g. "nodeA" instead of "node1". This field is required.
  optional string nodeID = 2;

// ClusterCIDR represents a single configuration for per-Node Pod CIDR
// allocations when the MultiCIDRRangeAllocator is enabled (see the config for
// kube-controller-manager).  A cluster may have any number of ClusterCIDR
// resources, all of which will be considered when allocating a CIDR for a
// Node.  A ClusterCIDR is eligible to be used for a given Node when the node
// selector matches the node in question and has free CIDRs to allocate.  In

                format: int32
                type: integer
              nodeSelectors:
                description: NodeSelectors allows to limit the nodes to announce as
                  next hops for the LoadBalancer IP. When empty, all the nodes having  are
                  announced as next hops.
                items:
                  description: A label selector is a label query over a set of resources.

  // NodePhase is the recently observed lifecycle phase of the node.
  // More info: https://kubernetes.io/docs/concepts/nodes/node/#phase
  // The field is never populated, and now is deprecated.
  // +optional
  optional string phase = 3;

  // Conditions is an array of current observed node conditions.
  // More info: https://kubernetes.io/docs/concepts/nodes/node/#condition
  // +optional
  // +patchMergeKey=type

  - apiGroups: ["apiextensions.k8s.io"]
    resources: ["customresourcedefinitions"]
    verbs: ["get", "list", "watch"]

  # discovery and routing
  - apiGroups: [""]
    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["discovery.k8s.io"]
    resources: ["endpointslices"]
    verbs: ["get", "list", "watch"]

  # ingress controller

// NOTE that this expects to be run from within the HOST network namespace!
//
// We need to do this specifically to be able to distinguish between traffic coming from different node-level processes
// via the nodeIP
// - kubelet (node-local healthchecks, which we do not capture)
// - kube-proxy (fowarded/proxied traffic from LoadBalancer-backed services, potentially with public IPs, which we must capture)

      nodeSelector: {}
      tolerations: []

      # Specify the pod anti-affinity that allows you to constrain which nodes
      # your pod is eligible to be scheduled based on labels on pods that are
      # already running on the node rather than based on labels on nodes.
      # There are currently two types of anti-affinity:
      #    "requiredDuringSchedulingIgnoredDuringExecution"

      env: {}
      nodeSelector: {}
      tolerations: []

      # Specify the pod anti-affinity that allows you to constrain which nodes
      # your pod is eligible to be scheduled based on labels on pods that are
      # already running on the node rather than based on labels on nodes.
      # There are currently two types of anti-affinity:
      #    "requiredDuringSchedulingIgnoredDuringExecution"

    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "Cni"
rules:
- apiGroups: [""]
  resources: ["pods","nodes","namespaces"]
  verbs: ["get", "list", "watch"]
---
{{- if .Values.cni.repair.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: istio-cni-repair-role
  labels:

        kubernetes.io/os: linux
      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
      {{- with .Values.cni.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      tolerations:
        # Make sure istio-cni-node gets scheduled on all nodes.
        - effect: NoSchedule
          operator: Exists
        # Mark the pod as a critical add-on for rescheduling.