```

Use depth first search to traverse the created directory hierarchy when applying your YAML files. This is needed for
correct sequencing of dependencies. Child manifest directories must wait for their parent directory to be fully applied,
but not their sibling manifest directories.

#### Just apply it for me

The following command generates the manifests and applies them in the correct dependency order, waiting for the

// the related backend services. Incoming requests are first evaluated for a host
// match, then routed to the backend associated with the matching IngressRuleValue.
message IngressRule {
  // host is the fully qualified domain name of a network host, as defined by RFC 3986.
  // Note the following deviations from the "host" part of the
  // URI as defined in RFC 3986:

                              maximum: 4294967295
                              minimum: 0
                              type: integer
                            service:
                              description: The fully qualified service name for this
                                cluster.
                              type: string
                            subset:

description: Match on envoy cluster attributes. properties: name: description: The exact name of the cluster to match. type: string portNumber: description: The service port for which this cluster was generated. type: integer service: description: The fully qualified service name for this cluster. type: string subset: description: The subset associated with the service. type: string type: object context: description: The specific config generation context to match on. enum: - ANY - SIDECAR_INBOUND - SIDECAR_OUTBOUND...

  // immutable after creation. The following address types are currently
  // supported:
  // * IPv4: Represents an IPv4 Address.
  // * IPv6: Represents an IPv6 Address.
  // * FQDN: Represents a Fully Qualified Domain Name.
  optional string addressType = 4;

  // endpoints is a list of unique endpoints in this slice. Each slice may
  // include a maximum of 1000 endpoints.
  // +listType=atomic

  // Specifies the hostname of the Carp
  // If not specified, the carp's hostname will be set to a system-defined value.
  // +optional
  optional string hostname = 16;

  // If specified, the fully qualified Carp hostname will be "<hostname>.<subdomain>.<carp namespace>.svc.<cluster domain>".
  // If not specified, the carp will not have a domainname at all.
  // +optional
  optional string subdomain = 17;

  // The value will change as readiness probes keep executing. If no readiness
  // probes are specified, this field defaults to true once the container is
  // fully started (see Started field).
  //
  // The value is typically used to determine whether a container is ready to
  // accept traffic.
  optional bool ready = 4;

  optional string uid = 1;

  // Kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)
  optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind kind = 2;

  // Resource is the fully-qualified resource being requested (for example, v1.pods)
  optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionResource resource = 3;

      # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
      deletePods: false
      # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
      # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.

This is consumed in two ways:
* Some components just block on `watcher.WaitForCRD(...)` before doing the work they need.
* `kclient.NewDelayedInformer` can also fully abstract this away, by providing a client that handles this behind the scenes.

#### Credentials Controller