// IngressBackend describes all endpoints for a given service and port.
message IngressBackend {
  // service references a service as a backend.
  // This is a mutually exclusive setting with "Resource".
  // +optional
  optional IngressServiceBackend service = 4;

  // resource is an ObjectRef to another Kubernetes resource in the namespace
  // of the Ingress object. If resource is specified, a service.Name and

This includes things like its IP address, identity, metadata (name, namespace, app, version, etc), and whether it has a waypoint proxy associated.

The `Service` aims to represent everything about a service (generally a `Service` or `ServiceEntry`).
This includes things like its IP addresses, ports and an associated waypoint proxy if it has one.

### Authorization Type

  // Un-prefixed names are reserved for IANA standard service names (as per
  // RFC-6335 and https://www.iana.org/assignments/service-names).
  // Non-standard protocols should use prefixed names such as
  // mycompany.com/my-custom-protocol.
  // +optional
  optional string appProtocol = 4;
}

// EndpointSlice represents a subset of the endpoints that implement a service.

  // allowed, either.
  //
  // +optional
  optional string url = 3;

  // `service` is a reference to the service for this webhook. Either
  // `service` or `url` must be specified.
  //
  // If the webhook is running within the cluster, then you should use `service`.
  //
  // +optional
  optional ServiceReference service = 1;

    - `istio-cni-config` configmap with CNI plugin config to add to CNI plugin chained config
    - creates service-account `istio-cni` with `ClusterRoleBinding` to allow gets on pods' info and delete/modifications for recovery.

- `install-cni` container
    - copies `istio-cni` and `istio-iptables` to `/opt/cni/bin`
    - creates kubeconfig for the service account the pod runs under

  // allowed, either.
  //
  // +optional
  optional string url = 3;

  // `service` is a reference to the service for this webhook. Either
  // `service` or `url` must be specified.
  //
  // If the webhook is running within the cluster, then you should use `service`.
  //
  // +optional
  optional ServiceReference service = 1;

// +structType=atomic
message EndpointPort {
  // name represents the name of this port. All ports in an EndpointSlice must have a unique name.
  // If the EndpointSlice is dervied from a Kubernetes service, this corresponds to the Service.ports[].name.
  // Name must either be an empty string or pass DNS_LABEL validation:
  // * must be no more than 63 characters long.
  // * must consist of lower case alphanumeric characters or '-'.

  // +optional
  optional IngressStatus status = 3;
}

// IngressBackend describes all endpoints for a given service and port.
message IngressBackend {
  // serviceName specifies the name of the referenced service.
  // +optional
  optional string serviceName = 1;

  // servicePort Specifies the port of the referenced service.
  // +optional
  optional k8s.io.apimachinery.pkg.util.intstr.IntOrString servicePort = 2;

  // +optional
  optional string clusterIP = 3;

  // ClusterIPs is a list of IP addresses assigned to this service, and are
  // usually assigned randomly.  If an address is specified manually, is
  // in-range (as per system configuration), and is not in use, it will be
  // allocated to the service; otherwise creation of the service will fail.

      the terms of any separate license agreement you may have executed
      with Licensor regarding such Contributions.

   6. Trademarks. This License does not grant permission to use the trade
      names, trademarks, service marks, or product names of the Licensor,
      except as required for reasonable and customary use in describing the
      origin of the Work and reproducing the content of the NOTICE file.