// Object is the object from the incoming request.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension object = 9;

  // OldObject is the existing object. Only populated for DELETE and UPDATE requests.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension oldObject = 10;

  // DryRun indicates that modifications will definitely not be persisted for this request.

  // `Delete` policy causes those PVCs to be deleted.
  optional string whenDeleted = 1;

  // WhenScaled specifies what happens to PVCs created from StatefulSet
  // VolumeClaimTemplates when the StatefulSet is scaled down. The default
  // policy of `Retain` causes PVCs to not be affected by a scaledown. The
  // `Delete` policy causes the associated PVCs for any excess pods above

  // persistentVolumeReclaimPolicy defines what happens to a persistent volume when released from its claim.
  // Valid options are Retain (default for manually created PersistentVolumes), Delete (default
  // for dynamically provisioned PersistentVolumes), and Recycle (deprecated).
  // Recycle must be supported by the volume plugin underlying this PersistentVolume.

This is rooted in the Multicluster Secret controller, which reads `kubeconfig` files (stored as `Secrets`), and creating Kubernetes clients for each. The controller allows registering handlers which can process Add/Update/Delete of clusters.

This has two implementations:
* The Credentials controller is responsible for reading TLS certificates, stored as Secrets.

// limitations under the License.

package repair

import (
	"istio.io/istio/pkg/monitoring"
)

var (
	typeLabel  = monitoring.CreateLabel("type")
	deleteType = "delete"
	repairType = "repair"
	labelType  = "label"

	resultLabel   = monitoring.CreateLabel("result")
	resultSuccess = "success"
	resultSkip    = "skip"
	resultFail    = "fail"

	podsRepaired = monitoring.NewSum(

            "type": "prometheus",
            "uid": "${datasource}"
          },
          "expr": "max(pilot_k8s_cfg_events{type=\"VirtualService\", event=\"add\"}) - (max(pilot_k8s_cfg_events{type=\"VirtualService\", event=\"delete\"}) or max(up * 0))",
          "format": "time_series",
          "intervalFactor": 1,
          "refId": "A"
        }
      ],
      "title": "Virtual Services",
      "type": "stat"
    },
    {

To install the chart with the release name `istio-ingressgateway`:

```console
helm install istio-ingressgateway istio/gateway
```

## Uninstalling the Chart

To uninstall/delete the `istio-ingressgateway` deployment:

```console
helm delete istio-ingressgateway
```

## Configuration

To view support configuration options and documentation, run:

```console
helm show values istio/gateway
```

    verbs: ["watch", "get", "list"]
{{- if .Values.cni.repair.repairPods }}
{{- /*  No privileges needed*/}}
{{- else if .Values.cni.repair.deletePods }}
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["delete"]
{{- else if .Values.cni.repair.labelPods }}
  - apiGroups: [""]
    {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
    resources: ["pods/status"]

  // `Delete` policy causes those PVCs to be deleted.
  optional string whenDeleted = 1;

  // whenScaled specifies what happens to PVCs created from StatefulSet
  // VolumeClaimTemplates when the StatefulSet is scaled down. The default
  // policy of `Retain` causes PVCs to not be affected by a scaledown. The
  // `Delete` policy causes the associated PVCs for any excess pods above

  // CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:
  //
  // 'object' - The object from the incoming request. The value is null for DELETE requests.
  // 'oldObject' - The existing object. The value is null for CREATE requests.
  // 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).