// at least one member of verbs matches the request, (b) at least one
// member of apiGroups matches the request, (c) at least one member of
// resources matches the request, and (d) either (d1) the request does
// not specify a namespace (i.e., `Namespace==""`) and clusterScope is
// true or (d2) the request specifies a namespace and least one member
// of namespaces matches the request's namespace.
message ResourcePolicyRule {

	"istio.io/istio/pkg/config/validation"
	"istio.io/istio/pkg/kube/labels"
	"istio.io/istio/pkg/log"
	"istio.io/istio/pkg/slices"
	"istio.io/istio/pkg/url"
)

var (
	errMissingFilename = errors.New(`error: you must specify resources by --filename.
Example resource specifications include:
   '-f rsrc.yaml'
   '--filename=rsrc.json'`)

	validFields = map[string]struct{}{
		"apiVersion": {},
		"kind":       {},
		"metadata":   {},

  // SideEffects states whether this webhook has side effects.
  // Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown).
  // Webhooks with side effects MUST implement a reconciliation system, since a request may be
  // rejected by a future step in the admission chain and the side effects therefore need to be undone.

  // is optional to allow the loadbalancer controller or defaulting logic to
  // specify a global default.
  // +optional
  optional IngressBackend backend = 1;

  // tls represents the TLS configuration. Currently the Ingress only supports a
  // single TLS port, 443. If multiple members of this list specify different hosts,
  // they will be multiplexed on the same port according to the hostname specified

--set flag. For example, to select the minimal profile:

```yaml
# minimal.yaml

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: minimal
```

If you don't specify a configuration profile, Istio is installed using the `default` configuration profile. All
profiles listed in istio.io are available by default, or `profile:` can point to a local file path to reference a custom

                              properties:
                                h2UpgradePolicy:
                                  description: |-
                                    Specify if http1.1 connection should be upgraded to http2 for the associated destination.

                                    Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
                                  enum:

  // are specific to the node & CRI configuration.  It is assumed that all
  // handlers are available on every node, and handlers of the same name are
  // equivalent on every node.
  // For example, a handler called "runc" might specify that the runc OCI
  // runtime (using native Linux containers) will be used to run the containers
  // in a pod.
  // The Handler must be lowercase, conform to the DNS Label (RFC 1123) requirements,
  // and is immutable.

io/defaultProfileName: runtime/default # # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify: # injectedAnnotations: # container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default # container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default injectedAnnotations: {} # This enables...

  // all handlers are available on every node, and handlers of the same name are
  // equivalent on every node.
  // For example, a handler called "runc" might specify that the runc OCI
  // runtime (using native Linux containers) will be used to run the containers
  // in a pod.
  // The runtimeHandler must be lowercase, conform to the DNS Label (RFC 1123)
  // requirements, and is immutable.

	}
	return string(prettyJSON), nil
}

func profileDump(args []string, pdArgs *profileDumpArgs, l clog.Logger) error {
	if len(args) == 1 && pdArgs.inFilenames != nil {
		return fmt.Errorf("cannot specify both profile name and filename flag")
	}

	if err := validateProfileOutputFormatFlag(pdArgs.outputFormat); err != nil {
		return err
	}