// which run an apiserver which might need to make calls to this
  // webhook. Such installs are likely to be non-portable, i.e., not easy
  // to turn up in a new cluster.
  //
  // The scheme must be "https"; the URL must begin with "https://".
  //
  // A path is optional, and if present may be any string permissible in
  // a URL. You may use the path to pass an arbitrary string to the
  // webhook, for example, a cluster identifier.
  //

    }
  },
  "certificates": [
    {
      "identity": "spiffe://cluster.local/ns/istio-system/sa/istiod",
      "state": "Available",
      "certChain": [
        {

  // topologyKeys is the list of keys supported by the driver.
  // When a driver is initialized on a cluster, it provides a set of topology
  // keys that it understands (e.g. "company.com/zone", "company.com/region").
  // When a driver is initialized on a node, it provides the same topology keys
  // along with values. Kubelet will expose these topology keys as labels
  // on its own node object.

  // +optional
  optional bool readOnly = 6;
}

// Represents a cinder volume resource in Openstack.
// A Cinder volume must exist before mounting to a container.
// The volume must also be in the same region as the kubelet.
// Cinder volumes support ownership management and SELinux relabeling.
message CinderPersistentVolumeSource {
  // volumeID used to identify the volume in cinder.

		return nil
	}

	for _, excludeNs := range conf.Kubernetes.ExcludeNamespaces {
		if podNamespace == excludeNs {
			log.Infof("pod namespace excluded")
			return nil
		}
	}

	// Begin ambient plugin logic
	// For ambient pods, this is all the logic we need to run
	if conf.AmbientEnabled {
		log.Debugf("istio-cni ambient cmdAdd podName: %s - checking if ambient enabled", podName)

  //
  // The certificate is encoded in PEM format.
  //
  // When serialized as JSON or YAML, the data is additionally base64-encoded, so it consists of:
  //
  //     base64(
  //     -----BEGIN CERTIFICATE-----
  //     ...
  //     -----END CERTIFICATE-----
  //     )
  //
  // +listType=atomic
  // +optional
  optional bytes certificate = 2;
}

message HTTPIngressPath {
  // Path is matched against the path of an incoming request. Currently it can
  // contain characters disallowed from the conventional "path" part of a URL
  // as defined by RFC 3986. Paths must begin with a '/'. When unspecified,
  // all paths from incoming requests are matched.
  // +optional
  optional string path = 1;

  // PathType determines the interpretation of the Path matching. PathType can

  // resourceVersion value returned by the server and not miss any modifications.
  optional string continue = 8;

  // `sendInitialEvents=true` may be set together with `watch=true`.
  // In that case, the watch stream will begin with synthetic events to
  // produce the current state of objects in the collection. Once all such
  // events have been sent, a synthetic "Bookmark" event  will be sent.

// See the License for the specific language governing permissions and
// limitations under the License.

package configdump

type Locality struct {
	Region  string `json:"region,omitempty"`
	Zone    string `json:"zone,omitempty"`
	Subzone string `json:"subzone,omitempty"`
}

type ZtunnelWorkload struct {
	WorkloadIPs       []string          `json:"workloadIps"`