// RoleRef can only reference a ClusterRole in the global namespace.
  // If the RoleRef cannot be resolved, the Authorizer must return an error.
  optional RoleRef roleRef = 3;
}

// ClusterRoleBindingList is a collection of ClusterRoleBindings.
// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBindingList, and will no longer be served in v1.22.
message ClusterRoleBindingList {
  // Standard object's metadata.

  optional ClusterTrustBundleSpec spec = 2;
}

// ClusterTrustBundleList is a collection of ClusterTrustBundle objects
message ClusterTrustBundleList {
  // metadata contains the list metadata.
  //
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // items is a collection of ClusterTrustBundle objects
  repeated ClusterTrustBundle items = 2;
}

  # process should be kept alive after an occasional reload.
  drainDuration: 2s
  #
  # The mode used to redirect inbound connections to Envoy. This setting
  # has no effect on outbound traffic: iptables REDIRECT is always used for
  # outbound connections.
  # If "REDIRECT", use iptables REDIRECT to NAT and redirect to Envoy.
  # The "REDIRECT" mode loses source addresses during redirection.

To view support configuration options and documentation, run:

```console
helm show values istio/istiod
```

### Profiles

Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
These can be set with `--set profile=<profile>`.

  // One of Never, PreemptLowerPriority.
  // Defaults to PreemptLowerPriority if unset.
  // +optional
  optional string preemptionPolicy = 5;
}

// PriorityClassList is a collection of priority classes.
message PriorityClassList {
  // Standard list metadata
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
  // +optional

To view support configuration options and documentation, run:

```console
helm show values istio/istio-cni
```

### Profiles

Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
These can be set with `--set profile=<profile>`.

import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";

// Package-wide variables from generator "generated".
option go_package = "k8s.io/apimachinery/pkg/apis/testapigroup/v1";

// Carp is a collection of containers, used as either input (create, update) or as output (list, get).
message Carp {
  // Standard object's metadata.

```console
kubectl create namespace istio-system
helm install istio-base istio/base -n istio-system
```

### Profiles

Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.
These can be set with `--set profile=<profile>`.

	ValidFrom      string `json:"validFrom"`
	ExpirationTime string `json:"expirationTime"`
}

type WorkloadState struct {
	State       string              `json:"state,omitempty"`
	Connections WorkloadConnections `json:"connections,omitempty"`
	Info        WorkloadInfo        `json:"info"`
}

type WorkloadConnections struct {
	Inbound  []InboundConnection  `json:"inbound"`
	Outbound []OutboundConnection `json:"outbound"`

      proxyMetadata: {}

  # This value defines:
  # 1. how many seconds kube waits for ztunnel pod to gracefully exit before forcibly terminating it (this value)
  # 2. how many seconds ztunnel waits to drain its own connections (this value - 1 sec)
  # Default K8S value is 30 seconds
  terminationGracePeriodSeconds: 30

  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
  revision: ""