k := kube.EnableCrdWatcher(c.client)
					sa.AddRunningKubeSourceWithRevision(k, revisionSpecified, c.remote)
				}
			}

			// If we explicitly specify mesh config, use it.
			// This takes precedence over default mesh config or mesh config from a running Kube instance.
			if meshCfgFile != "" {
				_ = sa.AddFileKubeMeshConfig(meshCfgFile)
			}

message GroupVersionResource {
  optional string group = 1;

  optional string version = 2;

  optional string resource = 3;
}

// A label selector is a label query over a set of resources. The result of matchLabels and
// matchExpressions are ANDed. An empty label selector matches all objects. A null
// label selector matches no objects.
// +structType=atomic
message LabelSelector {

and aggregate telemetry data. Istio's control plane provides an abstraction
layer over the underlying cluster management platform, such as Kubernetes.

Istio is composed of these components:

- **Envoy** - Sidecar proxies per microservice to handle ingress/egress traffic

  // currentValue is the current value of the metric (as a quantity)
  optional k8s.io.apimachinery.pkg.api.resource.Quantity currentValue = 3;

  // currentAverageValue is the current value of metric averaged over autoscaled pods.
  // +optional
  optional k8s.io.apimachinery.pkg.api.resource.Quantity currentAverageValue = 4;
}

// configuration of a horizontal pod autoscaler.
message HorizontalPodAutoscaler {

message ScaleStatus {
  // replias is the actual number of observed instances of the scaled object.
  optional int32 replicas = 1;

  // selector is a label query over pods that should match the replicas count. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
  // +optional
  map<string, string> selector = 2;

Istio has a variety of [controllers](https://kubernetes.io/docs/concepts/architecture/controller/), which basically watch some inputs and do something.
This can be reading from Kubernetes and writing other objects back, writing to proxies over XDS, etc.

Unfortunately, writing controllers is very error prone, even for seemingly simple cases.
To work around this, Istio has a variety of abstractions meant to make writing controllers easier.

## Clients

following the guidance below.
If you are able to, a clean installation is simpler. However, this often requires an external IP migration which can be challenging.

WARNING: when installing over an existing deployment, the two deployments will be merged together by Helm, which may lead to unexpected results.

#### Legacy Gateway Helm charts

  optional string expression = 2;
}

// MatchResources decides whether to run the admission control policy on an object based
// on whether it meets the match criteria.
// The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
// +structType=atomic
message MatchResources {
  // NamespaceSelector decides whether to run the admission control policy on an object based

  // evictions by specifying "100%".
  // +optional
  optional k8s.io.apimachinery.pkg.util.intstr.IntOrString minAvailable = 1;

  // Label query over pods whose evictions are managed by the disruption
  // budget.
  // A null selector selects no pods.
  // An empty selector ({}) also selects no pods, which differs from standard behavior of selecting all pods.

                "uid": "${datasource}"
              },
              "expr": "pilot_conflict_outbound_listener_tcp_over_current_tcp{app=\"istiod\"}",
              "format": "time_series",
              "hide": false,
              "intervalFactor": 1,
              "legendFormat": "Outbound Listeners (tcp over current tcp)",
              "refId": "C"
            }
          ],
          "title": "Conflicts",