// future, although it may be shortened or the resource may be deleted prior to this time.
  // For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react
  // by sending a graceful termination signal to the containers in the pod. After that 30 seconds,
  // the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup,

  //   by the 'containerName' field) is not in the set of specified values.
  // Additional values are considered to be added in the future. Clients should
  // react to an unknown operator by assuming the requirement is not satisfied.
  optional string operator = 2;

  // Specifies the set of values. Each returned container exit code (might be

  // Except values will be rejected if they are outside the CIDR range
  // +optional
  repeated string except = 2;
}

// Ingress is a collection of rules that allow inbound connections to reach the
// endpoints defined by a backend. An Ingress can be configured to give services
// externally-reachable urls, load balance traffic, terminate SSL, offer name
// based virtual hosting etc.

## Interaction with controller

The controller shares the same API as the operator CLI, so it's possible to install any of the above examples as a CR
in the cluster in the istio-system namespace and the controller will react to it with the same outcome as running
`istioctl install -f <path-to-custom-resource-file>`.

## Architecture

  //   - Expression accessing a property named "x-prop": {"Expression": "object.x__dash__prop > 0"}
  //   - Expression accessing a property named "redact__d": {"Expression": "object.redact__underscores__d > 0"}
  //
  // Equality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].

// or '#'.
message HTTPIngressRuleValue {
  // paths is a collection of paths that map requests to backends.
  repeated HTTPIngressPath paths = 1;
}

// Ingress is a collection of rules that allow inbound connections to reach the
// endpoints defined by a backend. An Ingress can be configured to give services
// externally-reachable urls, load balance traffic, terminate SSL, offer name
// based virtual hosting etc.
message Ingress {

If it is allowed, we will forward to the target destination.

#### Hairpin

In the case that the destination has a waypoint, that waypoint must have been bypassed to reach the inbound passthrough codepath.
How we handle this is [under discussion](https://docs.google.com/document/d/1uM1c3zzoehiijh1ZpZuJ1-SzuVVupenv8r5yuCaFshs/edit#heading=h.dwbqvwmg6ud3).

### Inbound

  // Except values will be rejected if they are outside the cidr range
  // +optional
  repeated string except = 2;
}

// Ingress is a collection of rules that allow inbound connections to reach the
// endpoints defined by a backend. An Ingress can be configured to give services
// externally-reachable urls, load balance traffic, terminate SSL, offer name
// based virtual hosting etc.
message Ingress {