ISTIO_INBOUND_PORTS='*'
ISTIO_LOCAL_EXCLUDE_PORTS='22,15090,15021,15020'
ISTIO_METAJSON_LABELS='{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'
ISTIO_META_CLUSTER_ID='Kubernetes'
ISTIO_META_DNS_CAPTURE='true'
ISTIO_META_MESH_ID=''
ISTIO_META_NETWORK=''
ISTIO_META_WORKLOAD_NAME='foo'
ISTIO_NAMESPACE='bar'
ISTIO_SERVICE='foo.bar'
ISTIO_SERVICE_CIDR='*'
ISTIO_SVC_IP='10.10.10.10'
POD_NAMESPACE='bar'

            drop:
            - ALL
          allowPrivilegeEscalation: false
          privileged: false
          readOnlyRootFilesystem: true
          runAsUser: {{ .ProxyUID | default "1337" }}
          runAsGroup: {{ .ProxyGID | default "1337" }}
          runAsNonRoot: true
        {{- else }}
          capabilities:
            drop:
            - ALL
            add:
            - NET_BIND_SERVICE

  "name": "k8s-pod-network",
  "plugins": [
    {
      "addIf": "true",
      "bridge": "mybridge",
      "ipMasq": true,
      "ipam": {
        "gateway": "10.1.0.1",
        "routes": [
          {
            "dst": "0.0.0.0/0"
          }
        ],
        "subnet": "10.1.0.0/16",
        "type": "host-local"
      },
      "isGateway": true,
      "mtu": 1460,
      "name": "rkt.kubernetes.io",

		return err
	}
	c.events.Write(pod, corev1.EventTypeWarning, ReasonLabelBrokenPod, "pod detected as broken, labeled")
	m.With(resultLabel.Value(resultSuccess)).Increment()
	return nil
}

// MatchesFilter returns true if the pod matches the repair filter criteria
func (c *Controller) matchesFilter(pod *corev1.Pod) bool {
	// Helper function; checks that a container's termination message matches filter

          },
          "name": "default.http.0"
         }
        ],
        "include_request_attempt_count": true
       }
      ],
      "validate_clusters": false,
      "max_direct_response_body_size_bytes": 1048576,
      "ignore_port_in_host_matching": true
     },
     "last_updated": "2023-11-29T09:58:27.570Z"
    }
   ]
  }
 ]

// Package-wide variables from generator "generated".
option go_package = "k8s.io/api/authentication/v1beta1";

// ExtraValue masks the value so protobuf can generate
// +protobuf.nullable=true
// +protobuf.options.(gogoproto.goproto_stringer)=false
message ExtraValue {
  // items, if empty, will result in an empty slice

  repeated string items = 1;
}

					if err == nil {
						// Check if gateway has Programmed condition set to true
						for _, cond := range gwc.Status.Conditions {
							if cond.Type == string(gateway.GatewayConditionProgrammed) && string(cond.Status) == "True" {
								programmed = true
								break
							}
						}
					}
					if programmed {
						break
					}

      name: Age
      type: date
    name: v1alpha1
    subresources:
      status: {}
    schema:
      openAPIV3Schema:
        type: object
        x-kubernetes-preserve-unknown-fields: true
    served: true
    storage: true

			// TODO this only makes sense in context of a chain... do we need a way to give it context
			return []string{"ANY"}, true
		}
	case *matcher.Matcher_OnMatch_Matcher:
		ms, f := recurse(name, v.Matcher)
		if !f {
			return []string{"NONE"}, true
		}
		return ms, true
	}
	// TODO support list
	n := match.GetMatcherTree().GetInput().GetName()

	var m map[string]*matcher.Matcher_OnMatch

message SubjectAccessReviewStatus {
  // Allowed is required. True if the action would be allowed, false otherwise.
  optional bool allowed = 1;

  // Denied is optional. True if the action would be denied, otherwise
  // false. If both allowed is false and denied is false, then the
  // authorizer has no opinion on whether to authorize the action. Denied
  // may not be true if Allowed is true.
  // +optional
  optional bool denied = 4;