// Package-wide variables from generator "generated".
option go_package = "k8s.io/api/node/v1beta1";

// Overhead structure represents the resource overhead associated with running a pod.
message Overhead {
  // podFixed represents the fixed resource overhead associated with running a pod.
  // +optional
  map<string, k8s.io.apimachinery.pkg.api.resource.Quantity> podFixed = 1;
}

  // The total number of nodes that should be running the daemon
  // pod (including nodes correctly running the daemon pod).
  // More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/
  optional int32 desiredNumberScheduled = 3;

  // Total number of nodes that should be running the daemon pod and have one
  // or more of the daemon pod running with a Ready Condition by passing the readinessProbe.

// Package-wide variables from generator "generated".
option go_package = "k8s.io/api/node/v1";

// Overhead structure represents the resource overhead associated with running a pod.
message Overhead {
  // podFixed represents the fixed resource overhead associated with running a pod.
  // +optional
  map<string, k8s.io.apimachinery.pkg.api.resource.Quantity> podFixed = 1;
}

// Package-wide variables from generator "generated".
option go_package = "k8s.io/api/node/v1alpha1";

// Overhead structure represents the resource overhead associated with running a pod.
message Overhead {
  // podFixed represents the fixed resource overhead associated with running a pod.
  // +optional
  map<string, k8s.io.apimachinery.pkg.api.resource.Quantity> podFixed = 1;
}

  //
  // IfHealthyBudget policy means that running pods (status.phase="Running"),
  // but not yet healthy can be evicted only if the guarded application is not
  // disrupted (status.currentHealthy is at least equal to status.desiredHealthy).
  // Healthy pods will be subject to the PDB for eviction.
  //
  // AlwaysAllow policy means that all running pods (status.phase="Running"),

of the conventional `istio-injected: true`. The name of the environment is defined as the namespace
where the corresponding control plane components (config, discovery, auto-injection) are running.
In the examples below, by default this is the `istio-control` namespace. Pod annotations can also
be used to select a different 'environment'.

## Installing

1. By installing a separate, very basic "CNI plugin" binary onto the node to forward low-level pod lifecycle events (CmdAdd/CmdDel/etc) from whatever node-level CNI subsystem is in use to this node agent for processing via socket.
1. By running as a node-level daemonset that:

- listens for these UDS events from the CNI plugin (which fire when new pods are spawned in an ambient-enabled namespace), and adds those pods to the ambient mesh.

	log.Infof("Repairing pod...")

	// Fetch the pod's network namespace. This must run in the host process due to how the procfs /ns/net works.
	// This will get a network namespace ID. This ID is scoped to the network namespace we running in.
	// As such, we need to be in the host namespace: the CNI pod namespace has no relation to the users pod namespace.
	netns, err := runInHost(func() (string, error) { return getPodNetNs(pod) })
	if err != nil {

  // Valid values are:
  //
  // - "Allow" (default): allows CronJobs to run concurrently;
  // - "Forbid": forbids concurrent runs, skipping next run if previous run hasn't finished yet;
  // - "Replace": cancels currently running job and replaces it with a new one
  // +optional
  optional string concurrencyPolicy = 3;

  // This flag tells the controller to suspend subsequent executions, it does

```

This installs the controller into the cluster in the istio-operator namespace. The controller in turns installs
the Istio control plane into the istio-system namespace by default.

### Controller (running locally)

1. Set env $WATCH_NAMESPACE (default value is "istio-system") and $LEADER_ELECTION_NAMESPACE (default value is "istio-operator")