}},
			},
		}

		// only label if the user has provided their own value, otherwise we let istiod choose a default at runtime (service)
		// this will allow for gateway class to provide a default for that class rather than always forcing service or requiring users to configure correctly
		if trafficType != "" {
			if !validTrafficTypes.Contains(trafficType) {

  # Make a copy named just "ztunnel" in the same directory (overwrite if necessary).
  echo "Copying $2 to $(dirname "$2")/${3}"
  cp -f "$2" "$(dirname "$2")/${3}"
  popd

  # Also copy it to out/$os_arch/ztunnel as that's whats used in the build
  echo "Copying '${2}' to ${TARGET_OUT_LINUX}/ztunnel"
  cp -f "${2}" "${TARGET_OUT_LINUX}/ztunnel"
}

function maybe_build_ztunnel() {

  // flag to the Kubernetes controller manager.
  //
  // Certificate signers may not honor this field for various reasons:
  //
  //   1. Old signer that is unaware of the field (such as the in-tree
  //      implementations prior to v1.22)
  //   2. Signer whose configured maximum is shorter than the requested duration

When fetching certificates, ztunnel will authenticate to the CA with its own identity, but request the identity of another workload.
Critically, the CA must enforce that the ztunnel has permission to request that identity.
Requests for identities not running on the node are rejected.
This is critical to ensure that a compromised node does not compromise the entire mesh.

  // scope specifies the scope of this rule.
  // Valid values are "Cluster", "Namespaced", and "*"
  // "Cluster" means that only cluster-scoped resources will match this rule.
  // Namespace API objects are cluster-scoped.
  // "Namespaced" means that only namespaced resources will match this rule.
  // "*" means that there are no scope restrictions.
  // Subresources match the scope of their parent resource.
  // Default is "*".
  //

  // DriverName defines the name of the dynamic resource driver that is
  // used for allocation of a ResourceClaim that uses this class.
  //
  // Resource drivers have a unique name in forward domain order
  // (acme.example.com).
  optional string driverName = 2;

  // ParametersRef references an arbitrary separate object that may hold
  // parameters that will be used by the driver when allocating a

  // "Queue" means that requests that can not be executed upon arrival
  // are held in a queue until they can be executed or a queuing limit
  // is reached.
  // "Reject" means that requests that can not be executed upon arrival
  // are rejected.
  // Required.
  // +unionDiscriminator
  optional string type = 1;

  // `queuing` holds the configuration parameters for queuing.

  // "Queue" means that requests that can not be executed upon arrival
  // are held in a queue until they can be executed or a queuing limit
  // is reached.
  // "Reject" means that requests that can not be executed upon arrival
  // are rejected.
  // Required.
  // +unionDiscriminator
  optional string type = 1;

  // `queuing` holds the configuration parameters for queuing.

  // Required.
  optional string name = 1;

  // ClientConfig defines how to communicate with the hook.
  // Required
  optional WebhookClientConfig clientConfig = 2;

  // Rules describes what operations on what resources/subresources the webhook cares about.
  // The webhook cares about an operation if it matches _any_ Rule.
  // However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks

  // +optional
  optional string verb = 2;
}

// NonResourceRule holds information that describes a rule for the non-resource
message NonResourceRule {
  // Verb is a list of kubernetes non-resource API verbs, like: get, post, put, delete, patch, head, options.  "*" means all.
  repeated string verbs = 1;

  // NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full,