string hub = 2;

  // The container image tag to pull. Image will be `Hub/Image:Tag-Variant`.
  google.protobuf.Value tag = 3;

  // The container image variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
  string variant = 29;

  // Image name to pull from. Image will be `Hub/Image:Tag-Variant`.
  // If Image contains a "/", it will replace the entire `image` in the pod.

  // Some pod and container fields are restricted if this is set.
  //
  // If the OS field is set to linux, the following fields must be unset:
  // -securityContext.windowsOptions
  //
  // If the OS field is set to windows, following fields must be unset:
  // - spec.hostPID
  // - spec.hostIPC
  // - spec.hostUsers
  // - spec.securityContext.appArmorProfile
  // - spec.securityContext.seLinuxOptions

							Type:   ...

// newAliasTypeName returns a new TypeName, with a materialized *types.Alias if supported.
func newAliasTypeName(pos token.Pos, pkg *types.Package, name string, rhs types.Type) *types.TypeName {
	// When GODEBUG=gotypesalias=1 or unset, the Type() of the return value is a
	// *types.Alias. Copied from x/tools/internal/aliases.NewAlias.
	switch godebug.New("gotypesalias").Value() {
	case "", "1":
		tname := types.NewTypeName(pos, pkg, name, nil)

// and only change values not already seen. After doing this for both
// the environment and the default settings, the caller must also call
// cleargodebug(seen) to reset any now-unset values back to their defaults.
func parsegodebug(godebug string, seen map[string]bool) {
	for p := godebug; p != ""; {
		var field string
		if seen == nil {

	// != nil, in m.dirty[key].
	//
	// An entry can be deleted by atomic replacement with nil: when m.dirty is
	// next created, it will atomically replace nil with expunged and leave
	// m.dirty[key] unset.
	//
	// An entry's associated value can be updated by atomic replacement, provided
	// p != expunged. If p == expunged, an entry's associated value can be updated

    args:
      - name: err
        type: error

  - name: "ServiceEntryAddressesRequired"
    code: IST0134
    level: Warning
    description: "Virtual IP addresses are required for ports serving TCP (or unset) protocol when ISTIO_META_DNS_AUTO_ALLOCATE is not set on a proxy"
    template: "ServiceEntry addresses are required for this protocol."

  - name: "DeprecatedAnnotation"
    code: IST0135
    level: Info

// wake immediately unparks the scavenger if necessary.
//
// Safe to run without a P.
func (s *scavengerState) wake() {
	lock(&s.lock)
	if s.parked {
		// Unset sysmonWake, since the scavenger is now being awoken.
		s.sysmonWake.Store(0)

		// s.parked is unset to prevent a double wake-up.
		s.parked = false

		// Ready the goroutine by injecting it. We use injectglist instead

	// Some pod and container fields are restricted if this is set.
	//
	// If the OS field is set to linux, the following fields must be unset:
	// -securityContext.windowsOptions
	//
	// If the OS field is set to windows, following fields must be unset:
	// - spec.hostPID
	// - spec.hostIPC
	// - spec.hostUsers
	// - spec.securityContext.appArmorProfile
	// - spec.securityContext.seLinuxOptions

	}
	for k, v := range cfg.RuntimeValues {
		if v == "" {
			// Envoy runtime doesn't see "" as a special value, so we use it to mean 'unset default flag'
			delete(runtimeFlags, k)
			continue
		}
		// Envoy used to allow everything as string but stopped in https://github.com/envoyproxy/envoy/issues/27434
		// However, our API always takes in strings.