// Group is the API Group of the Resource.  "*" means all.
  // +optional
  optional string group = 3;

  // Version is the API Version of the Resource.  "*" means all.
  // +optional
  optional string version = 4;

  // Resource is one of the existing resource types.  "*" means all.
  // +optional
  optional string resource = 5;

  // Subresource is one of the existing resource types.  "" means none.
  // +optional

  // APIVersions is the API versions the resources belong to. '*' is all versions.
  // If '*' is present, the length of the slice must be one.
  // Required.
  // +listType=atomic
  repeated string apiVersions = 2;

  // Resources is a list of resources this rule applies to.
  //
  // For example:
  // 'pods' means pods.
  // 'pods/log' means the log subresource of pods.
  // '*' means all resources, but not subresources.

  // +optional
  optional string apiGroup = 1;

  // Kind is the type of resource being referenced. This is the same
  // value as in the parameter object's metadata.
  optional string kind = 2;

  // Name is the name of resource being referenced.
  optional string name = 3;

  // Namespace that contains the referenced resource. Must be empty

  // with `resource: {group:"apps", version:"v1", resource:"deployments"}` (matching the resource the webhook registered for),
  // and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request).
  //
  // See documentation for the "matchPolicy" field in the webhook configuration type.
  // +optional

  // Group is the API Group of the Resource.  "*" means all.
  // +optional
  optional string group = 3;

  // Version is the API Version of the Resource.  "*" means all.
  // +optional
  optional string version = 4;

  // Resource is one of the existing resource types.  "*" means all.
  // +optional
  optional string resource = 5;

  // Subresource is one of the existing resource types.  "" means none.
  // +optional

  // the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
  // +optional
  repeated string apiGroups = 2;

  // Resources is a list of resources this rule applies to. '*' represents all resources.
  // +optional
  repeated string resources = 3;

        name: hello
        ports:
        - containerPort: 80
          name: http
        resources: {}
      - image: docker.io/istio/proxy_debug:unittest
        name: istio-proxy
        resources: {}
      initContainers:
      - image: docker.io/istio/proxy_init:unittest-test
        name: istio-init
        resources: {}
status: {}

way as galley settings. Supported K8s settings currently include:

- [resources](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container)
- [readiness probes](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/)

# Updating charts and values.yaml

## Acceptable Pull Requests

Helm charts `values.yaml` represent a complex user facing API that tends to grow uncontrollably over time
due to design choices in Helm.
The underlying Kubernetes resources we configure have 1000s of fields; given enough users and bespoke use cases,
eventually someone will want to customize every one of those fields.

    "global.tracer.datadog.address" "meshConfig.defaultConfig.tracing.datadog.address"
    "global.meshExpansion.enabled" "Gateway and other Istio networking resources, such as in samples/multicluster/"
    "istiocoredns.enabled" "the in-proxy DNS capturing (ISTIO_META_DNS_CAPTURE)"
}}
{{- range $dep, $replace := $deps }}