The details for the deployment & installation of this plugin were pretty much lifted directly from the
[Calico CNI plugin](https://github.com/projectcalico/cni-plugin).

Specifically:

- The CNI installation script is containerized and deployed as a daemonset in k8s.  The relevant calico k8s manifests were used as the model for the istio-cni plugin's manifest:

  // +optional
  optional NonResourceAttributes nonResourceAttributes = 2;

  // User is the user you're testing for.
  // If you specify "User" but not "Group", then is it interpreted as "What if User were not a member of any groups
  // +optional
  optional string user = 3;

  // Groups is the groups you're testing for.
  // +optional
  repeated string group = 4;

    # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
    # is processed as if it were declared in the leaf namespace.
    rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}

  {{ $prom := include "default-prometheus" . | eq "true" }}

	// We want the pause container, as the istio-validation one may exit before we are done.
	// We do this by detecting the longest running process. We could look at `cmdline`, but is likely more reliable to weird platforms.
	for _, p := range procs {
		ns := getPidNamespace(p.PID)
		fd, err := unix.Open(ns, unix.O_RDONLY, 0)
		if err != nil {
			// Not uncommon, many processes are transient and we have a TOCTOU here.

  // `lastTransitionTime` is the last time the condition transitioned from one status to another.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 3;

  // `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
  optional string reason = 4;

  // `message` is a human-readable message indicating details about last transition.
  optional string message = 5;
}

  // `lastTransitionTime` is the last time the condition transitioned from one status to another.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 3;

  // `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
  optional string reason = 4;

  // `message` is a human-readable message indicating details about last transition.
  optional string message = 5;
}

	switch event.Event {
	case controllers.EventAdd:
		// pod was added to our cache
		// we get here in 2 cases:
		// 1. new pod was created on our node
		// 2. we were restarted and current existing pods are added to our cache

		// We have no good way to distinguish between these two cases from here. But we don't need to!

  // +optional
  optional NonResourceAttributes nonResourceAttributes = 2;

  // User is the user you're testing for.
  // If you specify "User" but not "Groups", then is it interpreted as "What if User were not a member of any groups
  // +optional
  optional string user = 3;

  // Groups is the groups you're testing for.
  // +optional
  repeated string groups = 4;

In the end, [after evaluation](https://docs.google.com/document/d/1c2123cKuYsBDpIon9FFdctWTUIMFweSjgwG7r8l3818/edit), the decision was to move forward with a Rust implementation.
This offered performance benefits that were too large to leave on the table, as well as opportunities to tune to our specific needs.

## Configuration protocol

  // the selector.  Failure to pick a unique label may cause this
  // and other jobs to not function correctly.  However, You may see
  // `manualSelector=true` in jobs that were created with the old `extensions/v1beta1`
  // API.
  // More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/#specifying-your-own-pod-selector
  // +optional