optional bool readOnly = 10;
}

// A scope selector represents the AND of the selectors represented
// by the scoped-resource selector requirements.
// +structType=atomic
message ScopeSelector {
  // A list of scope selector requirements by scope of the resources.
  // +optional
  repeated ScopedResourceSelectorRequirement matchExpressions = 1;
}

      values:
      - "false"
  reinvocationPolicy: Never
  rules:
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    resources:
    - pods
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
- admissionReviewVersions:
  - v1beta1
  - v1
  clientConfig:
    service:
      name: istiod-test-dev2
      namespace: istio-system
      path: /inject

follows: # 0 - Never scheduled # 1 - Least preferred # 2 - No preference # 3 - Most preferred arch: {} # Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level> # The control plane has different scopes depending on component, but can configure default log level across all components # If empty, default scope and level will be used as configured in code logging: level: "default:info" # Kubernetes >=v1.11.0 will create two PriorityClass, including...

0::/system.slice/docker-8445c3ca20fac1d8e74854d84a7e6a57297ffb22809098b2816b31a428f2b777.scope/kubelet.slice/kubelet-kubepods.slice/kubelet-kubepods-besteffort.slice/kubelet-kubepods-besteffort-pod863b91d4_4b68_4efa_917f_4b560e3e86aa.slice/cri-containerd-75c7fe7ad0df679971e755bd97b84dd68a32e1eba8e8f99b01ab3c07196a3e4a.scope...

  repeated string resources = 3;

  // scope specifies the scope of this rule.
  // Valid values are "Cluster", "Namespaced", and "*"
  // "Cluster" means that only cluster-scoped resources will match this rule.
  // Namespace API objects are cluster-scoped.
  // "Namespaced" means that only namespaced resources will match this rule.
  // "*" means that there are no scope restrictions.

  repeated string items = 1;
}

// LocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace.
// Having a namespace scoped resource makes it much easier to grant namespace scoped policy that includes permissions
// checking.
message LocalSubjectAccessReview {
  // Standard list metadata.

```yaml
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: strict-and-permissive-mtls
spec:

  optional string name = 3;

  // scope represents if this refers to a cluster or namespace scoped resource.
  // This may be set to "Cluster" (default) or "Namespace".
  // +optional
  optional string scope = 4;

  // namespace is the namespace of the resource being referenced. This field is
  // required when scope is set to "Namespace" and must be unset when scope is set to
  // "Cluster".
  // +optional

to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR