# The following virtual service should cause the error IST0149 because it uses JWT claim based routing but there is
# no request authentication applied on the gateway.
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: foo
spec:
  hosts:
    - "foo.com"
  gateways:
    - foo-gateway
  http:
    - match:
        - uri:
            prefix: /
          headers:
            "@request.auth.claims.foo":

	// metadata server code against a fake metadata server. We do not control the client, and cannot
	// configure it to exit early, retry faster, etc - its all fixed. As a result, we don't have a good
	// way to shut it down if it is still retrying in the background.

See the License for the specific language governing permissions and
limitations under the License.
*/


// This file was autogenerated by go-to-protobuf. Do not edit it manually!

syntax = "proto2";

package k8s.io.api.autoscaling.v2;

import "k8s.io/api/core/v1/generated.proto";
import "k8s.io/apimachinery/pkg/api/resource/generated.proto";

as it stands is a singleton per cluster. If multiple suites attempt to deploy/configure Istio,
they can corrupt each other and/or simply fail.  To avoid this issue, you have a couple of options:

1. Run one suite per command (e.g. `go test ./tests/integration/mysuite/...`)
1. Disable parallelism with `-p 1` (e.g. `go test -p 1 ./...`). A major disadvantage to doing this is that it will also disable

		grpc.MaxConcurrentStreams(uint32(maxStreams)),
		grpc.MaxRecvMsgSize(maxRecvMsgSize),
		// Ensure we allow clients sufficient ability to send keep alives. If this is higher than client
		// keep alive setting, it will prematurely get a GOAWAY sent.
		grpc.KeepaliveEnforcementPolicy(keepalive.EnforcementPolicy{
			MinTime: options.Time / 2,
		}),
		grpc.KeepaliveParams(keepalive.ServerParameters{
			Time:                  options.Time,

ambient mode no longer use the original service account or namespace attachment semantics. If you were using a namespace-scope waypoint previously migration should be fairly straight forward. Annotate your namespace with the appropriate waypoint and it should function in a similar way.

      If you were using service account attachment there will be more to understand. Under the old waypoint logic all types of traffic, both addressed to a service as well as addressed to a workload, were treated...

		},
		{
			// client side traffic could not be identified by the outbound listener, sent over one-way
			// TLS (HTTPS for example) by the downstream application.
			// or it could be that the client has no sidecar, and it is directly making a HTTPS connection to
			// this sidecar. In this case, this filter chain is receiving plaintext one-way TLS traffic. The TLS

// Schemas contains metadata about configuration resources.
type Schemas struct {
	byCollection map[config.GroupVersionKind]resource.Schema
	byAddOrder   []resource.Schema
}

// SchemasFor is a shortcut for creating Schemas. It uses MustAdd for each element.
func SchemasFor(schemas ...resource.Schema) Schemas {
	b := NewSchemasBuilder()
	for _, s := range schemas {
		b.MustAdd(s)
	}
	return b.Build()
}

		// Log sync will send logs to install-cni container via UDS.
		// We don't need a timeout here because underlying the log pkg already handles it.
		// this may fail, but it should be safe to ignore according
		// to https://github.com/uber-go/zap/issues/328
		_ = log.Sync()
	}()

	// TODO: implement plugin version
	funcs := skel.CNIFuncs{
		Add:   plugin.CmdAdd,
		Del:   plugin.CmdDelete,
		Check: plugin.CmdCheck,
	}

		// This is disable when perRevision is used, as this enables the Lease. Lease doesn't have a holderKey field to place our key
		// as holderKey is an Istio specific fork.
		// While its possible to make it work with Lease as well (via an annotation to store it), we don't ever need prioritized
		// for these per-revision ones anyways, since the prioritization is about preferring one revision over others.
		config.KeyComparison = func(leaderKey string) bool {