a negated version, prefixed with \"Not\". All the match criteria
                    within a rule must be satisfied for a packet to match. A single
                    rule can contain the positive and negative version of a match
                    and both must be satisfied for the rule to match."
                  properties:
                    action:
                      type: string

  - update
- apiGroups:
  - policy
  resources:
  - poddisruptionbudgets
  verbs:
  - '*'
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - clusterrolebindings
  - clusterroles
  - roles
  - rolebindings
  verbs:
  - '*'
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - get
  - create
  - update
- apiGroups:
  - ""
  resources:
  - configmaps

terminationGracePeri: {{ $.Values.terminationGracePeri }} {{- with .Values.priorityClassName }} priorityClassName: {{ . }} {{- end }} manifests/charts/gateway/templates/role.yaml {{/*Set up roles for Istio Gateway. Not required for gateway-api*/}} {{- if .Values.rbac.enabled }} apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: {{ include "gateway.serviceAccountName" . }} namespace: {{ .Release.Namespace }} labels: {{- include "gateway.labels" . | nindent 4}} annotations: {{- .Values.annotations...

message SELinuxOptions {
  // User is a SELinux user label that applies to the container.
  // +optional
  optional string user = 1;

  // Role is a SELinux role label that applies to the container.
  // +optional
  optional string role = 2;

  // Type is a SELinux type label that applies to the container.
  // +optional
  optional string type = 3;

name: envoy.filters.http.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    policies:
      ns[foo]-policy[httpbin-1]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - header:
                    name: :authority
                    stringMatch:
                      exact: exact.com

  k8s.io.api.core.v1.Affinity affinity = 20;

  // Additional annotations to apply to the istio-cni Pods.
  google.protobuf.Struct podAnnotations = 10 [deprecated = true];

  // PodSecurityPolicy cluster role. No longer used anywhere.
  string psp_cluster_role = 11;

  // Configuration log level of istio-cni binary. By default, istio-cni sends all logs to the UDS server.
  // To see the logs, change global.logging.level to cni:debug.

deterclosed <******@****.***> 1711183043 +0800

  - update
- apiGroups:
  - policy
  resources:
  - poddisruptionbudgets
  verbs:
  - '*'
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - clusterrolebindings
  - clusterroles
  - roles
  - rolebindings
  verbs:
  - '*'
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - get
  - create
  - update
- apiGroups:
  - ""
  resources:

							if err := filter.GetTypedConfig().UnmarshalTo(tcpConfig); err != nil {
								t.Fatal(err)
							}
							if tcpConfig.GetCluster() == util.BlackHoleCluster {
								// Ignore the tcp_proxy filter with black hole cluster that just doesn't have access log.
								continue
							}
							if len(tcpConfig.AccessLog) < 1 {
								t.Fatalf("tcp_proxy want at least 1 access log, got 0")
							}

name: envoy.filters.http.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    action: LOG
    policies:
      ns[foo]-policy[audit-all]-rule[0]:
        permissions:
        - andRules:
            rules:
            - any: true
        principals:
        - andIds:
            ids:
            - any: true