#
  # TCP connection timeout between Envoy & the application, and between Envoys.
  connectTimeout: 1s
  #
  ### ADVANCED SETTINGS #############
  # Where should envoy's configuration be stored in the istio-proxy container
  configPath: "/etc/istio/proxy"
  binaryPath: "/usr/local/bin/envoy"
  # The pseudo service name used for Envoy.
  serviceCluster: istio-proxy

  // If all drivers in the list are uninstalled, this can become empty.
  // +patchMergeKey=name
  // +patchStrategy=merge
  repeated CSINodeDriver drivers = 1;
}

// CSIStorageCapacity stores the result of one CSI GetCapacity call.
// For a given StorageClass, this describes the available capacity in a
// particular topology segment.  This can be used when considering where to
// instantiate new PersistentVolumes.

  // If not provided, the empty value is passed to the associated CSI driver
  // which will determine the default filesystem to apply.
  // +optional
  optional string fsType = 3;

  // volumeAttributes stores driver-specific properties that are passed to the CSI
  // driver. Consult your driver's documentation for supported values.
  // +optional
  map<string, string> volumeAttributes = 4;

                  BGP Peer. the secret must be of type "kubernetes.io/basic-auth",
                  and created in the same namespace as the MetalLB deployment. The
                  password is stored in the secret as the key "password".
                properties:
                  name:
                    description: name is unique within a namespace to reference a
                      secret resource.

	}()

	return
}

func initRouter(router *http.ServeMux) (installReady *atomic.Value, watchReady *atomic.Value) {
	installReady = &atomic.Value{}
	watchReady = &atomic.Value{}
	installReady.Store(false)
	watchReady.Store(false)

	router.HandleFunc(constants.LivenessEndpoint, healthz)
	router.HandleFunc(constants.ReadinessEndpoint, readyz(installReady, watchReady))

	return
}

	return f.fd
}

func (f *fakeNs) Inode() uint64 {
	return f.inode
}

// Close simulates closing the file descriptor and returns nil for no error
func (f *fakeNs) Close() error {
	f.closed.Store(true)
	return nil
}

func fakeFs() fs.FS {
	subFs, err := fs.Sub(fakeProc, "testdata")
	if err != nil {
		panic(err)
	}
	subFs, err = fs.Sub(subFs, "cgroupns")
	if err != nil {
		panic(err)
	}

	if err := os.WriteFile(tokenPath, []byte(tokenReq.Status.Token), filePerms); err != nil {
		return err
	}
	fmt.Fprintf(out, "Warning: a security token for namespace %q and service account %q has been generated and "+
		"stored at %q\n", wg.Namespace, serviceAccount, tokenPath)
	return nil
}

func createMeshConfig(kubeClient kube.CLIClient, wg *clientv1alpha3.WorkloadGroup, istioNamespace, clusterID, dir,
	revision string,

)

// RemoteSecretOptions contains the options for creating a remote secret.
type RemoteSecretOptions struct {
	KubeOptions

	// Name of the local cluster whose credentials are stored in the secret. Must be
	// DNS1123 label as it will be used for the k8s secret name.
	ClusterName string

	// Create a secret with this service account's credentials.
	ServiceAccountName string

			ambientAgent.Start()
			defer ambientAgent.Stop()

			log.Info("Ambient node agent started, starting installer...")

		} else {
			// Ambient not enabled, so this readiness flag is no-op'd
			watchServerReady.Store(true)
		}

		installer := install.NewInstaller(&cfg.InstallConfig, installDaemonReady)

		repair.StartRepair(ctx, cfg.RepairConfig)

		log.Info("Installer created, watching node CNI dir")

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of Deployments.
  repeated Deployment items = 2;
}

// DEPRECATED.
// DeploymentRollback stores the information required to rollback a deployment.
message DeploymentRollback {
  // Required: This must match the Name of a deployment.
  optional string name = 1;

  // The annotations to be updated to a deployment