"shared_with_upstream": "ONCE"
                                },
                                {
                                  "object_key": "io.istio.peer_principal",
                                  "format_string": {
                                    "text_format_source": {
                                      "inline_string": "%DOWNSTREAM_PEER_URI_SAN%"

                                description: Optional.
                                items:
                                  type: string
                                type: array
                              principals:
                                description: Optional.
                                items:
                                  type: string
                                type: array

                  ],
                  "principals": [
                   {
                    "and_ids": {
                     "ids": [
                      {
                       "or_ids": {
                        "ids": [
                         {
                          "filter_state": {
                           "key": "io.istio.peer_principal",
                           "string_match": {

   not apply to You.

8. Litigation

   Any litigation relating to this License may be brought only in the courts
   of a jurisdiction where the defendant maintains its principal place of
   business and such litigation shall be governed by laws of that
   jurisdiction, without reference to its conflict-of-law provisions. Nothing
   in this Section shall prevent a party's ability to bring cross-claims or

  // 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).
  // 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
  //   See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
  // 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the

  // 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).
  // 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
  //   See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
  // 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the

                                description: Optional.
                                items:
                                  type: string
                                type: array
                              principals:
                                description: Optional.
                                items:
                                  type: string
                                type: array

type: string type: array notPrincipals: description: Optional. items: type: string type: array notRemoteIpBlocks: description: Optional. items: type: string type: array notRequestPrincipals: description: Optional. items: type: string type: array principals: description: Optional. items: type: string type: array remoteIpBlocks: description: Optional. items: type: string type: array requestPrincipals: description: Optional. items: type: string type: array type: object type: object type: array to: description:...

  // +optional
  optional ServiceStatus status = 3;
}

// ServiceAccount binds together:
// * a name, understood by users, and perhaps by peripheral systems, for an identity
// * a principal that can be authenticated and authorized
// * a set of secrets
message ServiceAccount {
  // Standard object's metadata.

                                  "shared_with_upstream": "ONCE"
                                },
                                {
                                  "object_key": "io.istio.peer_principal",
                                  "format_string": {
                                    "text_format_source": {
                                      "inline_string": "%DOWNSTREAM_PEER_URI_SAN%"