// +optional
  map<string, string> attachmentMetadata = 2;

  // attachError represents the last error encountered during attach operation, if any.
  // This field must only be set by the entity completing the attach
  // operation, i.e. the external-attacher.
  // +optional
  optional VolumeError attachError = 3;

  // detachError represents the last error encountered during detach operation, if any.

  // `$(job-name)-$(index)-$(random-string)`,
  // the Pod hostname takes the form `$(job-name)-$(index)`.
  //
  // More completion modes can be added in the future.
  // If the Job controller observes a mode that it doesn't recognize, which
  // is possible during upgrades due to version skew, the controller
  // skips updates for the Job.
  // +optional
  optional string completionMode = 9;

func getProfileNSAndEnabledComponents(iop *v1alpha12.IstioOperator) (string, string, []string, error) {
	var enabledComponents []string
	if iop.Spec.Components != nil {
		for _, c := range name.AllCoreComponentNames {
			enabled, err := translate.IsComponentEnabledInSpec(c, iop.Spec)
			if err != nil {
				return "", "", nil, fmt.Errorf("failed to check if component: %s is enabled or not: %v", string(c), err)
			}
			if enabled {

  // +optional
  optional string apiGroup = 1;

  // Resource is the type of resource being referenced, for example "pods".
  optional string resource = 3;

  // Name is the name of resource being referenced.
  optional string name = 4;

  // UID identifies exactly one incarnation of the resource.
  optional string uid = 5;
}

// ResourceClaimList is a collection of claims.

	// in that case, try finding the netns using procfs.
	filter := map[types.UID]*corev1.Pod{
		pod.UID: pod,
	}
	return s.scanProcForPodsAndCache(filter)
}

func (s *NetServer) getOrOpenNetns(pod *corev1.Pod, netNs string) (Netns, error) {
	if netNs == "" {
		return s.getNetns(pod)
	}
	return s.openNetns(pod, netNs)
}

func (s *NetServer) openNetns(pod *corev1.Pod, netNs string) (Netns, error) {

	tests := []struct {
		name string
		arg  []string
		want map[string]string
	}{
		{name: "empty", arg: []string{""}, want: map[string]string{"": ""}},
		{name: "one-valid", arg: []string{"key=value"}, want: map[string]string{"key": "value"}},
		{name: "one-valid-double-equals", arg: []string{"key==value"}, want: map[string]string{"key": "=value"}},
		{name: "one-key-only", arg: []string{"key"}, want: map[string]string{"key": ""}},

type Redirect struct {
	targetPort           string
	redirectMode         string
	noRedirectUID        string
	noRedirectGID        string
	includeIPCidrs       string
	excludeIPCidrs       string
	excludeInboundPorts  string
	excludeOutboundPorts string
	includeInboundPorts  string
	includeOutboundPorts string
	kubevirtInterfaces   string
	excludeInterfaces    string
	dnsRedirect          bool
	dualStack            bool

}

type filterchain struct {
	match       string
	destination string
}

var (
	plaintextHTTPALPNs = []string{"http/1.0", "http/1.1", "h2c"}
	istioHTTPPlaintext = []string{"istio", "istio-http/1.0", "istio-http/1.1", "istio-h2"}
	httpTLS            = []string{"http/1.0", "http/1.1", "h2c", "istio-http/1.0", "istio-http/1.1", "istio-h2"}
	tcpTLS             = []string{"istio-peer-exchange", "istio"}

// flags is passed to the command verbatim. If you set both flags and path, make sure to not use -f in flags.
func runManifestCommand(command string, filenames []string, flags string, chartSource chartSourceType, fileSelect []string) (string, error) {
	var args string
	if command == "install" {
		args = "install"
	} else {
		args = "manifest " + command
	}
	for _, f := range filenames {
		args += " -f " + f

	ns string, serviceAccount string, kubeClient kube.CLIClient, options Options,
) (map[string]*discovery.DiscoveryResponse, error) {
	return MultiRequestAndProcessXds(false, dr, centralOpts, istioNamespace, ns, serviceAccount, kubeClient, options)
}

type xdsAddr struct {
	gcpProject, host, istiod string
}