},
          "last_updated": "2022-03-04T10:22:24.737Z"
        }
      ]
    },
    {
      "@type": "type.googleapis.com/envoy.admin.v3.ClustersConfigDump",
      "dynamic_active_clusters": [
        {
          "cluster": {
            "@type": "type.googleapis.com/envoy.config.cluster.v3.Cluster",
            "name": "outbound|9080|v1|productpage.default.svc.cluster.local",

        pj--trigger-->c
    end
```

At a high level, each client job will find the correct generator for the request, generate the required configuration, and send it.

#### Optimizations

A naive implementation would simply regenerate all resources, of all subscribed types, for each client, on any configuration change. However, this scales poorly. As a result, we have many levels of optimizations to avoid doing this work.

    taint:
      # Controls whether or not the untaint controller is active
      enabled: false
      # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
      namespace: ""
    affinity: {}

	return false, fmt.Errorf("no container %q in pod", containerName)
}

// describePeerAuthentication fetches all PeerAuthentication in workload and root namespace.
// It lists the ones applied to the pod, and the current active mTLS mode.
// When the client doesn't have access to root namespace, it will only show workload namespace Peerauthentications.
func describePeerAuthentication(
	writer io.Writer,
	kubeClient kube.CLIClient,

              },
              "expr": "sum(envoy_cluster_upstream_cx_active{cluster_name=\"xds-grpc\"})",
              "format": "time_series",
              "intervalFactor": 2,
              "legendFormat": "XDS Active Connections",
              "refId": "C",
              "step": 2
            }
          ],
          "title": "XDS Active Connections",
          "type": "timeseries"
        },
        {

		fmt.Sprintf("Comma-separated minimum per-logger level of messages to output, in the form of"+
			" [<logger>:]<level>,[<logger>:]<level>,... or <level> to change all active loggers, "+
			"where logger components can be listed by running \"istioctl x ztunnel-config log <pod-name[.namespace]>\""+
			", and level can be one of %s", levelListString))
	return cmd
}

  // level may borrow at any one time.
  // This field holds the ratio of that limit to the level's nominal
  // concurrency limit. When this field is non-nil, it must hold a
  // non-negative integer and the limit is calculated as follows.
  //
  // BorrowingCL(i) = round( NominalCL(i) * borrowingLimitPercent(i)/100.0 )
  //
  // The value of this field can be more than 100, implying that this

  // level may borrow at any one time.
  // This field holds the ratio of that limit to the level's nominal
  // concurrency limit. When this field is non-nil, it must hold a
  // non-negative integer and the limit is calculated as follows.
  //
  // BorrowingCL(i) = round( NominalCL(i) * borrowingLimitPercent(i)/100.0 )
  //
  // The value of this field can be more than 100, implying that this

  // can scale down.  It defaults to 1 pod.  minReplicas is allowed to be 0 if the
  // alpha feature gate HPAScaleToZero is enabled and at least one Object or External
  // metric is configured.  Scaling is active as long as at least one metric value is
  // available.
  // +optional
  optional int32 minReplicas = 2;

  // maxReplicas is the upper limit for the number of replicas to which the autoscaler can scale up.

  // can scale down.  It defaults to 1 pod.  minReplicas is allowed to be 0 if the
  // alpha feature gate HPAScaleToZero is enabled and at least one Object or External
  // metric is configured.  Scaling is active as long as at least one metric value is
  // available.
  // +optional
  optional int32 minReplicas = 2;