repeated string apiGroups = 2;

  // Resources is a list of resources this rule applies to.  "*" means all in the specified apiGroups.
  //  "*/foo" represents the subresource 'foo' for all resources in the specified apiGroups.
  // +optional
  repeated string resources = 3;

  // ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.  "*" means all.
  // +optional

  experimental:
    stableValidationPolicy: false

  global:
    # Used to locate istiod.
    istioNamespace: istio-system
    # List of cert-signers to allow "approve" action in the istio cluster role
    #
    # certSigners:
    #   - clusterissuers.cert-manager.io/istio-ca
    certSigners: []
    # enable pod disruption budget for the control plane, which is used to

  repeated string apiGroups = 2;

  // Resources is a list of resources this rule applies to.  "*" means all in the specified apiGroups.
  //  "*/foo" represents the subresource 'foo' for all resources in the specified apiGroups.
  // +optional
  repeated string resources = 3;

  // ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.  "*" means all.
  // +optional

	sed -e '1 i {{- if .Values.global.configCluster }}' -e '$$ a {{- end }}' manifests/charts/istio-control/istio-discovery/templates/role.yaml > manifests/charts/istiod-remote/templates/role.yaml
	sed -e '1 i {{- if .Values.global.configCluster }}' -e '$$ a {{- end }}' manifests/charts/istio-control/istio-discovery/templates/rolebinding.yaml > manifests/charts/istiod-remote/templates/rolebinding.yaml

  // 1. If Host is precise, the request matches this rule if the http host header is equal to Host.
  // 2. If Host is a wildcard, then the request matches this rule if the http host header
  // is to equal to the suffix (removing the first label) of the wildcard rule.
  // +optional
  optional string host = 1;

  // IngressRuleValue represents a rule to route requests for this IngressRule.

  // 1. If host is precise, the request matches this rule if the http host header is equal to Host.
  // 2. If host is a wildcard, then the request matches this rule if the http host header
  // is to equal to the suffix (removing the first label) of the wildcard rule.
  // +optional
  optional string host = 1;

  // IngressRuleValue represents a rule to route requests for this IngressRule.

  // If '*' is present, the length of the slice must be one.
  // Required.
  // +listType=atomic
  repeated string operations = 1;

  // Rule is embedded, it describes other criteria of the rule, like
  // APIGroups, APIVersions, Resources, etc.
  optional Rule rule = 2;
}

// ServiceReference holds a reference to Service.legacy.k8s.io
message ServiceReference {
  // `namespace` is the namespace of the service.

// PodFailurePolicy describes how failed pods influence the backoffLimit.
message PodFailurePolicy {
  // A list of pod failure policy rules. The rules are evaluated in order.
  // Once a rule matches a Pod failure, the remaining of the rules are ignored.
  // When no rule matches the Pod failure, the default handling applies - the
  // counter of pod failures is incremented and it is checked against
  // the backoffLimit. At most 20 elements are allowed.

  // Required
  optional WebhookClientConfig clientConfig = 2;

  // Rules describes what operations on what resources/subresources the webhook cares about.
  // The webhook cares about an operation if it matches _any_ Rule.
  // However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
  // from putting the cluster in a state which cannot be recovered from without completely

      },
      "pluginVersion": "10.1.5",
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "expr": "sum(rate(container_cpu_usage_seconds_total{pod=~\"istio-ingressgateway-.*\",container=\"istio-proxy\"}[1m]))",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "istio-ingressgateway",