// +optional
  optional Overhead overhead = 3;

  // scheduling holds the scheduling constraints to ensure that pods running
  // with this RuntimeClass are scheduled to nodes that support it.
  // If scheduling is nil, this RuntimeClass is assumed to be supported by all
  // nodes.
  // +optional
  optional Scheduling scheduling = 4;
}

// RuntimeClassList is a list of RuntimeClass objects.
message RuntimeClassList {

    * https://istio.io/latest/docs/tasks/security/
    * https://istio.io/latest/docs/tasks/policy-enforcement/
{{- end }}
  * Review the list of actively supported releases, CVE publications and our hardening guide:
    * https://istio.io/latest/docs/releases/supported-releases/
    * https://istio.io/latest/news/security/
    * https://istio.io/latest/docs/ops/best-practices/security/

  // +optional
  optional Overhead overhead = 3;

  // scheduling holds the scheduling constraints to ensure that pods running
  // with this RuntimeClass are scheduled to nodes that support it.
  // If scheduling is nil, this RuntimeClass is assumed to be supported by all
  // nodes.
  // +optional
  optional Scheduling scheduling = 4;
}

// RuntimeClassList is a list of RuntimeClass objects.
message RuntimeClassList {

  // with this RuntimeClass are scheduled to nodes that support it.
  // If scheduling is nil, this RuntimeClass is assumed to be supported by all
  // nodes.
  // +optional
  optional Scheduling scheduling = 3;
}

// Scheduling specifies the scheduling constraints for nodes supporting a
// RuntimeClass.
message Scheduling {
  // nodeSelector lists labels that must be present on nodes that support this

# Security Policy

## Supported Versions

Information about supported Istio versions can be found on the
[Support Announcements] page on Istio's website.

## Reporting a Vulnerability

Instructions for reporting a vulnerability can be found on the
[Istio Security Vulnerabilities] page. The Istio Product Security Working Group receives
vulnerability and security issue reports, and the company affiliation of the members of

  //
  // "csi.storage.k8s.io/ephemeral" is a new feature in Kubernetes 1.16. It is only
  // required for drivers which support both the "Persistent" and "Ephemeral" VolumeLifecycleMode.
  // Other drivers can leave pod info disabled and/or ignore this field.
  // As Kubernetes 1.15 doesn't support this field, drivers can only support one mode when
  // deployed on such a cluster and the deployment determines which mode that is, for example

        - "sidecar.istio.io/inject" is not false
        - "sidecar.istio.io/status" exists

### Redirect API

The annotation based control is currently only supported in 'sidecar' mode. See plugin/redirect.go for details.

- redirectMode allows TPROXY may to be set, required envoy has extra permissions. Default is redirect.
- includeIPCidr, excludeIPCidr

  // tls represents the TLS configuration. Currently the Ingress only supports a
  // single TLS port, 443. If multiple members of this list specify different hosts,
  // they will be multiplexed on the same port according to the hostname specified
  // through the SNI TLS extension, if the ingress controller fulfilling the
  // ingress supports SNI.
  // +optional
  repeated IngressTLS tls = 2;

  // tls represents the TLS configuration. Currently the Ingress only supports a
  // single TLS port, 443. If multiple members of this list specify different hosts,
  // they will be multiplexed on the same port according to the hostname specified
  // through the SNI TLS extension, if the ingress controller fulfilling the
  // ingress supports SNI.
  // +listType=atomic
  // +optional
  repeated IngressTLS tls = 2;

  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // versions are the versions supported in this group. They are sorted in descending order of preference,
  // with the preferred version being the first entry.
  // +listType=map
  // +listMapKey=version
  repeated APIVersionDiscovery versions = 2;
}