the schema must be added here, otherwise istioctl users will see errors.
Once the schema file is updated, run:

```bash
$ make operator-proto
```

This will regenerate the Go structs used for schema validation.

## Step 4. Update the generated manifests

Tests of istioctl use the auto-generated manifests to ensure that the istioctl binary has the correct version of the charts.
To regenerate the manifests, run:

```bash

  // Multiple endpoints which use the same hostname should be considered
  // fungible (e.g. multiple A values in DNS). Must be lowercase and pass DNS
  // Label (RFC 1123) validation.
  // +optional
  optional string hostname = 3;

  // targetRef is a reference to a Kubernetes object that represents this
  // endpoint.
  // +optional
  optional k8s.io.api.core.v1.ObjectReference targetRef = 4;

  // Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and
  // must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or
  // '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an
  // optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')
  //
  // Required.
  optional string name = 1;

  // ---
  // The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
  // +optional
  // +kubebuilder:validation:Required
  // +kubebuilder:validation:Pattern=`^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$`
  // +kubebuilder:validation:MaxLength=316
  optional string error = 3;
}

  // Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and
  // must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or
  // '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an
  // optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')
  //
  // Required.
  optional string name = 1;

  // ---
  // The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
  // +optional
  // +kubebuilder:validation:Required
  // +kubebuilder:validation:Pattern=`^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$`
  // +kubebuilder:validation:MaxLength=316
  optional string error = 3;
}

  // Multiple endpoints which use the same hostname should be considered
  // fungible (e.g. multiple A values in DNS). Must be lowercase and pass DNS
  // Label (RFC 1123) validation.
  // +optional
  optional string hostname = 3;

  // targetRef is a reference to a Kubernetes object that represents this
  // endpoint.
  // +optional
  optional k8s.io.api.core.v1.ObjectReference targetRef = 4;

  // +kubebuilder:validation:MaxLength=1024
  // +kubebuilder:validation:MinLength=1
  // +kubebuilder:validation:Pattern=`^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$`
  optional string reason = 5;

  // message is a human readable message indicating details about the transition.
  // This may be an empty string.
  // +required
  // +kubebuilder:validation:Required
  // +kubebuilder:validation:MaxLength=32768

  // The set of valid time zone names and the time zone offset is loaded from the system-wide time zone
  // database by the API server during CronJob validation and the controller manager during execution.
  // If no system-wide time zone database can be found a bundled version of the database is used instead.

# disable_pgv: disables protoc-gen-validation. This is not used buts adds many MB to Envoy protos
# not set vtprotobuf: this adds some performance improvement, but at a binary cost increase that is not worth it for the agent
AGENT_TAGS=agent,disable_pgv
# disable_pgv: disables protoc-gen-validation. This is not used buts adds many MB to Envoy protos