// built in to Kubernetes, and have special scaling options on top of those
  // available to normal per-pod metrics using the "pods" source.
  // This is an alpha feature and can be enabled by the HPAContainerMetrics feature flag.
  // +optional
  optional ContainerResourceMetricSource containerResource = 7;

  // external refers to a global metric that is not associated

  // Kubernetes, and have special scaling options on top of those available
  // to normal per-pod metrics using the "pods" source.
  // This is an alpha feature and can be enabled by the HPAContainerMetrics feature flag.
  // +optional
  optional ContainerResourceMetricSource containerResource = 7;

  // external refers to a global metric that is not associated

component of Ambient mesh.

## Issue management

We use GitHub to track all of our bugs and feature requests. Each issue we track has a variety of metadata:

- **Epic**. An epic represents a feature area for Istio as a whole. Epics are fairly broad in scope and are basically product-level things.
Each issue is ultimately part of an epic.

  // This requires the ProcMountType feature flag to be enabled.
  // +optional
  repeated string allowedProcMountTypes = 21;

  // runtimeClass is the strategy that will dictate the allowable RuntimeClasses for a pod.
  // If this field is omitted, the pod's runtimeClassName field is unrestricted.
  // Enforcement of this field depends on the RuntimeClass feature gate being enabled.
  // +optional

  // Absolute number is calculated from percentage by rounding up. This can not be 0.
  // Defaults to 1. This field is alpha-level and is only honored by servers that enable the
  // MaxUnavailableStatefulSet feature. The field applies to all pods in the range 0 to
  // Replicas-1. That means if there is any unavailable pod in the range 0 to Replicas-1, it
  // will be counted towards MaxUnavailable.
  // +optional

            runAsNonRoot: false
            # Both ambient and sidecar repair mode require elevated node privileges to function.
            # But we don't need _everything_ in `privileged`, so drop+readd capabilities based on feature.
            # privileged is redundant with CAP_SYS_ADMIN
            # since it's redundant, hardcode it to `true`, then manually drop ALL + readd granular
            # capabilities we actually require
            capabilities: