// with `resource: {group:"apps", version:"v1", resource:"deployments"}` (matching the resource the webhook registered for),
  // and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request).
  //
  // See documentation for the "matchPolicy" field in the webhook configuration type.
  // +optional

  // with `resource: {group:"apps", version:"v1", resource:"deployments"}` (matching the resource the webhook registered for),
  // and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request).
  //
  // See documentation for the "matchPolicy" field in the webhook configuration type.
  // +optional

        istio.io/deactivated: never-match
    reinvocationPolicy: Never
    rules:
      - apiGroups:
          - ""
        apiVersions:
          - v1
        operations:
          - CREATE
        resources:
          - pods
        scope: '*'
    sideEffects: None
    timeoutSeconds: 10
  - admissionReviewVersions:
      - v1beta1
      - v1
    clientConfig:
      service:
        name: istiod

     * exists and is not marked read-only. By default, resources are
     * considered to be read-only and therefore for <code>smb://</code>,
     * <code>smb://workgroup/</code>, and <code>smb://server/</code> resources
     * will be read-only.
     *
     * @return <code>true</code> if the resource exists is not marked
     *         read-only
     * @throws CIFSException
     */

import (
	"k8s.io/apimachinery/pkg/api/meta"
	"k8s.io/cli-runtime/pkg/resource"
	openapiclient "k8s.io/client-go/openapi"
	"k8s.io/kubectl/pkg/cmd/util"
	"k8s.io/kubectl/pkg/util/openapi"
	"k8s.io/kubectl/pkg/validation"

	"istio.io/istio/pkg/kube"
)

type Factory struct {
	kube.PartialFactory
	full util.Factory
}

func (f Factory) NewBuilder() *resource.Builder {
	return f.full.NewBuilder()
}

minimal L4 proxy, and as such, its xDS configuration is purposefully limited. In particular, ztunnel only supports 2 (custom) xDS resources: [`Workload`](../../pkg/workloadapi/workload.proto) and [`Authorization`](../../pkg/workloadapi/security/authorization.proto). As such, ztunnel does not receive `PeerAuthentication`s directly; when istiod detects a `PeerAuthentication` resource that targets an Ambient captured workload, it computes the effective policy for that workload (taking into account the mesh-wide...

	// Gather the statuses before printing so they may be sorted
	mappedResp := map[string]string{}
	for id, dr := range drs {
		for _, resource := range dr.Resources {
			if s.InternalDebugAllIstiod {
				mappedResp[id] = string(resource.Value) + "\n"
			} else {
				_, _ = s.Writer.Write(resource.Value)
				_, _ = s.Writer.Write([]byte("\n"))
			}
		}
	}
	if len(mappedResp) > 0 {

    /**
     * Get the list of resources for the given project and scope
     *
     * @param project the project
     * @param scope the scope, i.e. usually main or test
     * @return the list of resources
     */
    List<Resource> getResources(@Nonnull Project project, @Nonnull ProjectScope scope);

    /**
     * Add a resource set to the given project for the given scope.
     *

 * dependencies - resources - configuration - extension points of plugins
 *
 * For a particular application plugin there will be a declarative descriptor for that plugin type.
 *
 * - nexus - the plugin class - UI to contribute - what JS to hook into the UI - what resources to
 * load into the UI - having packed or unpacked plugins, and positioning resources if necessary -

type LockArgs struct {
	// Unique ID of lock/unlock request.
	UID string

	// Resources contains single or multiple entries to be locked/unlocked.
	Resources []string

	// Owner represents unique ID for this instance, an owner who originally requested
	// the locked resource, useful primarily in figuring out stale locks.
	Owner string