// Populated by the Kubernetes system.
  optional VolumeAttachmentSpec spec = 2;

  // status represents status of the VolumeAttachment request.
  // Populated by the entity completing the attach or detach
  // operation, i.e. the external-attacher.
  // +optional
  optional VolumeAttachmentStatus status = 3;
}

// VolumeAttachmentList is a collection of VolumeAttachment objects.
message VolumeAttachmentList {

  // Spec describes where resources for the Pod are needed.
  optional PodSchedulingContextSpec spec = 2;

  // Status describes where resources for the Pod can be allocated.
  // +optional
  optional PodSchedulingContextStatus status = 3;
}

// PodSchedulingContextList is a collection of Pod scheduling objects.
message PodSchedulingContextList {
  // Standard list metadata
  // +optional

       {
        "name": "backend",
        "domains": [
         "*"
        ],
        "routes": [
         {
          "match": {
           "prefix": "/stats/prometheus"
          },
          "route": {
           "cluster": "prometheus_stats"
          }
         }
        ]
       }
      ]
     },
     "last_updated": "2023-11-29T09:58:27.285Z"
    }
   ],
   "dynamic_route_configs": [

  // +optional
  optional IngressSpec spec = 2;

  // status is the current state of the Ingress.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
  // +optional
  optional IngressStatus status = 3;
}

// IngressBackend describes all endpoints for a given service and port.

    # on this list. Setting this to the health check port will ensure that health
    # checks always work. https://github.com/istio/istio/issues/12503
    - port: 15021
      targetPort: 15021
      name: status-port
    - port: 80
      targetPort: 8080
      name: http2
    - port: 443
      targetPort: 8443
      name: https
    - port: 31400
      targetPort: 31400
      name: tcp

    verbs: ["update"]
    # TODO: should be on just */status but wildcard is not supported
    resources: ["*"]

  # Needed because status reporter sets the config map owner reference to the istiod pod
  - apiGroups: [""]
    verbs: ["update"]
    resources: ["pods/finalizers"]
{{- end }}

        - name: INSTANCE_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: SERVICE_ACCOUNT
          valueFrom:
            fieldRef:
              fieldPath: spec.serviceAccountName
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: ISTIO_CPU_LIMIT
          valueFrom:
            resourceFieldRef:

Istio base successfully installed!

To learn more about the release, try:
  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}

      "workloadType": "deployment",
      "canonicalName": "ratings",
      "canonicalRevision": "v1",
      "network": "network1",
      "node": "ambient-worker2",
      "nativeTunnel": true,
      "status": "Healthy",
      "clusterId": "Kubernetes"
    },
    "/10.244.2.58": {
      "workloadIps": [
        "10.244.2.58"
      ],
      "protocol": "HBONE",

  // spec.audiences field should validate that a compatible audience identifier
  // is returned in the status.audiences field to ensure that the TokenReview
  // server is audience aware. If a TokenReview returns an empty
  // status.audience field where status.authenticated is "true", the token is
  // valid against the audience of the Kubernetes API server.
  // +optional
  repeated string audiences = 4;