//
  // +optional
  optional bool podInfoOnMount = 2;

  // volumeLifecycleModes defines what kind of volumes this CSI volume driver supports.
  // The default if the list is empty is "Persistent", which is the usage defined by the
  // CSI specification and implemented in Kubernetes via the usual PV/PVC mechanism.
  //
  // The other mode is "Ephemeral". In this mode, volumes are defined inline inside the pod spec

      enabled: false
      # Set ambient config dir path: defaults to /etc/ambient-config
      configDir: ""
      # If enabled, and ambient is enabled, DNS redirection will be enabled
      dnsCapture: false
      # UNSTABLE: If enabled, and ambient is enabled, enables ipv6 support
      ipv6: false


    repair:
      enabled: true
      hub: ""
      tag: ""

    # mechanisms (e.g., environmental variable CA_PROVIDER).
    caName: ""
    # whether to use autoscaling/v2 template for HPA settings
    # for internal usage only, not to be configured by users.
    autoscalingv2API: true
  base:
    # For istioctl usage to disable istio config crds in base
    enableIstioConfigCRDs: true
  # `istio_cni` has been deprecated and will be removed in a future release. use `pilot.cni` instead

github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
github.com/howardjohn/unshare-go v0.4.0 h1:gqPNhMC5Ng4sJPv3XfIxKDjE7cyXRsRh+sPFPbesTgo=
github.com/howardjohn/unshare-go v0.4.0/go.mod h1:cJjyFAN6qTA70ovC2VR23iAZuJ8X3J/ibAbT693pJ8g=
github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=

  // allowedUnsafeSysctls is a list of explicitly allowed unsafe sysctls, defaults to none.
  // Each entry is either a plain sysctl name or ends in "*" in which case it is considered
  // as a prefix of allowed sysctls. Single * means all unsafe sysctls are allowed.
  // Kubelet has to allowlist all allowed unsafe sysctls explicitly to avoid rejection.
  //
  // Examples:

}

func registerStringParameter(name, value, usage string) {
	rootCmd.Flags().String(name, value, usage)
	registerEnvironment(name, value, usage)
}

func registerIntegerParameter(name string, value int, usage string) {
	rootCmd.Flags().Int(name, value, usage)
	registerEnvironment(name, value, usage)
}

func registerBooleanParameter(name string, value bool, usage string) {
	rootCmd.Flags().Bool(name, value, usage)

          "targets": [
            {
              "datasource": {
                "type": "prometheus",
                "uid": "${datasource}"
              },
              "expr": "sum(irate(container_cpu_usage_seconds_total{container=\"discovery\", pod=~\"istiod-.*|istio-pilot-.*\"}[1m]))",
              "format": "time_series",
              "intervalFactor": 1,
              "legendFormat": "Discovery (container)",

        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "refId": "A"
        }
      ],
      "title": "Proxy Resource Usage",
      "type": "row"
    },
    {
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {

      # deny for all go files
      AllGoFiles:
        files:
          - $all
        deny:
          - pkg: golang.org/x/net/http2/h2c
            desc: "h2c.NewHandler is unsafe; use wrapper istio.io/istio/pkg/h2c"
          - pkg: github.com/golang/protobuf/jsonpb
            desc: "don't use the jsonpb package directly; use util/protomarshal instead"

  // MatchConstraints specifies what resources this policy is designed to validate.
  // The AdmissionPolicy cares about a request if it matches _all_ Constraints.
  // However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API
  // ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding.
  // Required.
  optional MatchResources matchConstraints = 2;