* Ensure traffic between mesh workloads is securely encrypted with an Istio identity.
* Be lightweight enough to not limit adoption.
  * This puts a much tighter budget on CPU, memory, latency, and throughput requirements than traditional Istio sidecars.

Ztunnel was not designed to be a feature-rich data plane.

  optional string verb = 2;
}

// NonResourceRule holds information that describes a rule for the non-resource
message NonResourceRule {
  // Verb is a list of kubernetes non-resource API verbs, like: get, post, put, delete, patch, head, options.  "*" means all.
  repeated string verbs = 1;

  // NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full,

# disable_pgv: disables protoc-gen-validation. This is not used buts adds many MB to Envoy protos
# not set vtprotobuf: this adds some performance improvement, but at a binary cost increase that is not worth it for the agent
AGENT_TAGS=agent,disable_pgv
# disable_pgv: disables protoc-gen-validation. This is not used buts adds many MB to Envoy protos
# vtprotobuf: enables optimized protobuf marshalling.

		// and the initial enqueueNamespace, and new pods will be handled by the CNI.

	case controllers.EventUpdate:
		// For update, we just need to handle opt outs
		newPod := event.New.(*corev1.Pod)
		oldPod := event.Old.(*corev1.Pod)
		ns := s.namespaces.Get(newPod.Namespace, "")
		if ns == nil {
			return fmt.Errorf("failed to find namespace %v", ns)
		}

  // at this priority level the request's flow identifier (a string
  // pair) is hashed and the hash value is used to shuffle the list
  // of queues and deal a hand of the size specified here.  The
  // request is put into one of the shortest queues in that hand.
  // `handSize` must be no larger than `queues`, and should be
  // significantly smaller (so that a few heavy flows do not
  // saturate most of the queues).  See the user-facing

  // at this priority level the request's flow identifier (a string
  // pair) is hashed and the hash value is used to shuffle the list
  // of queues and deal a hand of the size specified here.  The
  // request is put into one of the shortest queues in that hand.
  // `handSize` must be no larger than `queues`, and should be
  // significantly smaller (so that a few heavy flows do not
  // saturate most of the queues).  See the user-facing

//
// When a Quantity is parsed from a string, it will remember the type of suffix
// it had, and will use the same type again when it is serialized.
//
// Before serializing, Quantity will be put in "canonical form".
// This means that Exponent/suffix will be adjusted up or down (with a
// corresponding increase or decrease in Mantissa) such that:
//
// - No precision is lost
// - No fractional digits will be emitted

  // TopologyKey is the key of node labels. Nodes that have a label with this key
  // and identical values are considered to be in the same topology.
  // We consider each <key, value> as a "bucket", and try to put balanced number
  // of pods into each bucket.
  // We define a domain as a particular instance of a topology.
  // Also, we define an eligible domain as a domain whose nodes meet the requirements of

  // as defined by https://golang.org/pkg/unicode/#IsPrint.
  // +optional
  optional string fieldManager = 3;

  // fieldValidation instructs the server on how to handle
  // objects in the request (POST/PUT/PATCH) containing unknown
  // or duplicate fields. Valid values are:
  // - Ignore: This will ignore any unknown fields that are silently
  // dropped from the object, and will ignore all but the last duplicate