export ISTIO_GO
SHELL := /bin/bash -o pipefail

# Version can be defined:
# (1) in a $VERSION shell variable, which takes precedence; or
# (2) in the VERSION file, in which we will append "-dev" to it
ifeq ($(VERSION),)
VERSION_FROM_FILE := $(shell cat VERSION)
ifeq ($(VERSION_FROM_FILE),)
$(error VERSION not detected. Make sure it's stored in the VERSION file or defined in VERSION variable)
endif

are intended to show Istio main components cost in terms of resources utilization under steady load.\n\n- **vCPU / 1k rps:** shows vCPU utilization by the main Istio components normalized by 1000 requests/second. When idle or low traffic, this chart will be blank. The curve for istio-proxy refers to the services sidecars only.\n- **vCPU:** vCPU utilization by Istio components, not normalized.\n- **Memory:** memory footprint for the components. Telemetry and policy are normalized by 1k rps, and no data...

  // Specifies the hostname of the Carp
  // If not specified, the carp's hostname will be set to a system-defined value.
  // +optional
  optional string hostname = 16;

  // If specified, the fully qualified Carp hostname will be "<hostname>.<subdomain>.<carp namespace>.svc.<cluster domain>".
  // If not specified, the carp will not have a domainname at all.
  // +optional
  optional string subdomain = 17;

    trustDomain: "cluster.local"

    # The namespace to treat as the administrative root namespace for Istio configuration.
    # When processing a leaf namespace Istio will search for declarations in that namespace first
    # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
    # is processed as if it were declared in the leaf namespace.

  // object in the same namespace as this pod.
  //
  // The template will be used to create a new ResourceClaim, which will
  // be bound to this pod. When this pod is deleted, the ResourceClaim
  // will also be deleted. The name of the ResourceClaim will be <pod
  // name>-<resource name>, where <resource name> is the
  // PodResourceClaim.Name. Pod validation will reject the pod if the

// corresponding increase or decrease in Mantissa) such that:
//
// - No precision is lost
// - No fractional digits will be emitted
// - The exponent (or suffix) is as large as possible.
//
// The sign will be omitted unless the number is negative.
//
// Examples:
//
// - 1.5 will be serialized as "1500m"
// - 1.5Gi will be serialized as "1536Mi"
//

// AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
message AggregationRule {
  // ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
  // If any of the selectors match, then the ClusterRole's permissions will be added
  // +optional
  repeated k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector clusterRoleSelectors = 1;
}

// AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
message AggregationRule {
  // ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
  // If any of the selectors match, then the ClusterRole's permissions will be added
  // +optional
  repeated k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector clusterRoleSelectors = 1;
}

  // +optional
  optional int64 expirationSeconds = 4;

  // BoundObjectRef is a reference to an object that the token will be bound to.
  // The token will only be valid for as long as the bound object exists.
  // NOTE: The API server's TokenReview endpoint will validate the
  // BoundObjectRef, but other audiences may not. Keep ExpirationSeconds
  // small if you want prompt revocation.
  // +optional

  // the volumeattachment status when the attach operation is complete.
  // If the CSIDriverRegistry feature gate is enabled and the value is
  // specified to false, the attach operation will be skipped.
  // Otherwise the attach operation will be called.
  //
  // This field is immutable.
  //
  // +optional
  optional bool attachRequired = 1;