// +optional
  optional string initiatorName = 12;
}

// Maps a string key to a path within a volume.
message KeyToPath {
  // key is the key to project.
  optional string key = 1;

  // path is the relative path of the file to map the key to.
  // May not be an absolute path.
  // May not contain the path element '..'.
  // May not start with the string '..'.
  optional string path = 2;

  optional string kind = 1;

  // name is the name of the referent; More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
  optional string name = 2;

  // apiVersion is the API version of the referent
  // +optional
  optional string apiVersion = 3;
}

# Architecture of Istiod

This document describes the high level architecture of the Istio control plane, Istiod.
Istiod is structured as a modular monolith, housing a wide range of functionality from certificate signing, proxy configuration (XDS), traditional Kubernetes controllers, and more.

## Proxy Configuration

  // +optional
  repeated string hosts = 1;

  // SecretName is the name of the secret used to terminate SSL traffic on 443.
  // Field is left optional to allow SSL routing based on SNI hostname alone.
  // If the SNI host in a listener conflicts with the "Host" header field used
  // by an IngressRule, the SNI host is used for termination and value of the
  // Host header is used for routing.
  // +optional

  // the network identity of the set. Pods get DNS/hostnames that follow the
  // pattern: pod-specific-string.serviceName.default.svc.cluster.local
  // where "pod-specific-string" is managed by the StatefulSet controller.
  optional string serviceName = 5;

  // podManagementPolicy controls how pods are created during initial scale up,
  // when replacing pods on nodes, or when scaling down. The default policy is

    - port: 80
      targetPort: 8080
      name: http2
    - port: 443
      targetPort: 8443
      name: https
    - port: 31400
      targetPort: 31400
      name: tcp
      # This is the port where sni routing happens
    - port: 15443
      targetPort: 15443
      name: tls
    resources:
      requests:
        cpu: 10m

    - port: 80
      targetPort: 8080
      name: http2
    - port: 443
      targetPort: 8443
      name: https
    - port: 31400
      targetPort: 31400
      name: tcp
      # This is the port where sni routing happens
    - port: 15443
      targetPort: 15443
      name: tls
    resources:
      requests:
        cpu: 10m

// 		MyPlugin runtime.Object `json:"myPlugin"`
// 	}
//
// 	type PluginA struct {
// 		AOption string `json:"aOption"`
// 	}
//
// // External package:
//
// 	type MyAPIObject struct {
// 		runtime.TypeMeta `json:",inline"`
// 		MyPlugin runtime.RawExtension `json:"myPlugin"`
// 	}
//
// 	type PluginA struct {
// 		AOption string `json:"aOption"`
// 	}
//
// // On the wire, the JSON will look something like this:
//

    resources:
      requests:
        cpu: 100m
        memory: 100Mi

    resourceQuotas:
      enabled: false
      pods: 5000

    # The number of pods that can be unavailable during rolling update (see
    # `updateStrategy.rollingUpdate.maxUnavailable` here:
    # https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).

  // Defaults to unset
  // +optional
  optional string resourceVersion = 1;
}

// GroupKind specifies a Group and a Kind, but does not force a version.  This is useful for identifying
// concepts during lookup stages without having partially valid types
//
// +protobuf.options.(gogoproto.goproto_stringer)=false
message GroupKind {
  optional string group = 1;

  optional string kind = 2;
}