o.SetDefaultOutputLevel("all", log.WarnLevel)
	// These scopes are too noisy even at warning level
	o.SetDefaultOutputLevel("validation", log.ErrorLevel)
	o.SetDefaultOutputLevel("processing", log.ErrorLevel)
	o.SetDefaultOutputLevel("kube", log.ErrorLevel)
	return o

// limitations under the License.

package configdump

import (
	"encoding/json"
	"fmt"
	"io"
	"text/tabwriter"

	"sigs.k8s.io/yaml"
)

// ConfigWriter is a writer for processing responses from the Ztunnel Admin config_dump endpoint
type ConfigWriter struct {
	Stdout      io.Writer
	ztunnelDump *ZtunnelDump
	FullDump    []byte
}

    trustDomain: "cluster.local"

    # The namespace to treat as the administrative root namespace for Istio configuration.
    # When processing a leaf namespace Istio will search for declarations in that namespace first
    # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace

  // for cluster-scoped resources and non-empty for namespaced
  // resources.
  // +optional
  optional string namespace = 4;
}

// ResourceHandle holds opaque resource data for processing by a specific kubelet plugin.
message ResourceHandle {
  // DriverName specifies the name of the resource driver whose kubelet
  // plugin should be invoked to process this ResourceHandle's data once it

    trustDomain: "cluster.local"

    # The namespace to treat as the administrative root namespace for Istio configuration.
    # When processing a leaf namespace Istio will search for declarations in that namespace first
    # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace

	"sigs.k8s.io/yaml"

	"istio.io/istio/istioctl/pkg/util/configdump"
	sdscompare "istio.io/istio/istioctl/pkg/writer/compare/sds"
	"istio.io/istio/pkg/util/protomarshal"
)

// ConfigWriter is a writer for processing responses from the Envoy Admin config_dump endpoint
type ConfigWriter struct {
	Stdout     io.Writer
	configDump *configdump.Wrapper
}

1. By installing a separate, very basic "CNI plugin" binary onto the node to forward low-level pod lifecycle events (CmdAdd/CmdDel/etc) from whatever node-level CNI subsystem is in use to this node agent for processing via socket.
1. By running as a node-level daemonset that:

- listens for these UDS events from the CNI plugin (which fire when new pods are spawned in an ambient-enabled namespace), and adds those pods to the ambient mesh.

  // +optional
  // +patchMergeKey=type
  // +patchStrategy=merge
  // +listType=atomic
  repeated JobCondition conditions = 1;

  // Represents time when the job controller started processing a job. When a
  // Job is created in the suspended state, this field is not set until the
  // first time it is resumed. This field is reset every time a Job is resumed

            properties:
              egress:
                description: Egress specifies the configuration of the sidecar for
                  processing outbound traffic from the attached workload instance
                  to other services in the mesh.
                items:
                  properties:
                    bind:

#### Mesh Config

Mesh Config controller is a pretty simple controller, reading from `ConfigMap`(s) (multiple if `SHARED_MESH_CONFIG` is used), processing and merging these into a the typed `MeshConfig`. It then exposes this over a simple `mesh.Watcher`, which just exposes a way to access the current `MeshConfig` and get notified when it changes.

#### Ingress