go func() {
			log.Debug("handling conn")
			if err := z.handleConn(ctx, conn); err != nil {
				log.Errorf("failed to handle conn: %v", err)
			}
		}()
	}
}

// ZDS protocol is very simple, for every message sent, and ack is sent.
// the ack only has temporal correlation (i.e. it is the first and only ack msg after the message was sent)

      - default
    - key: istio-injection
      operator: DoesNotExist
  objectSelector:
    matchExpressions:
    - key: istio.io/rev
      operator: NotIn
      values:
      - canary
  reinvocationPolicy: Never
  rules:
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    resources:
    - pods
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
---

apiVersion: v1
name: istiod-remote
# This version is never actually shipped. istio/release-builder will replace it at build-time
# with the appropriate version
version: 1.0.0
appVersion: 1.0.0
tillerVersion: ">=2.7.2"
description: Helm chart for a remote cluster using an external istio control plane
keywords:
  - istio
  - external-istiod
sources:
  - https://github.com/istio/istio
engine: gotpl

	"strings"

	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

	binversion "istio.io/istio/operator/version"
)

var NeverMatch = &metav1.LabelSelector{
	MatchLabels: map[string]string{
		"istio.io/deactivated": "never-match",
	},
}

var ManifestsFlagHelpStr = `Specify a path to a directory of charts and profiles
(e.g. ~/Downloads/istio-` + binversion.OperatorVersionString + `/manifests).`

  // when this priority class should be used.
  // +optional
  optional string description = 4;

  // preemptionPolicy is the Policy for preempting pods with lower priority.
  // One of Never, PreemptLowerPriority.
  // Defaults to PreemptLowerPriority if unset.
  // +optional
  optional string preemptionPolicy = 5;
}

// PriorityClassList is a collection of priority classes.
message PriorityClassList {

  // (typically AWS load-balancers)
  // +optional
  optional string hostname = 2;

  // Ports is a list of records of service ports
  // If used, every port defined in the service should have an entry in it
  // +listType=atomic
  // +optional
  repeated PortStatus ports = 4;
}

// LoadBalancerStatus represents the status of a load-balancer.

          "type": "string"
        },
        "imagePullPolicy": {
          "type": "string",
          "enum": [
            "",
            "Always",
            "IfNotPresent",
            "Never"
          ]
        },
        "imagePullSecrets": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "name": {

//
// The sign will be omitted unless the number is negative.
//
// Examples:
//
// - 1.5 will be serialized as "1500m"
// - 1.5Gi will be serialized as "1536Mi"
//
// Note that the quantity will NEVER be internally represented by a
// floating point number. That is the whole point of this exercise.
//
// Non-canonical values will still parse as long as they are well formed,

  // according to whatever system is managing the endpoint. A nil value
  // indicates an unknown state. In most cases consumers should interpret this
  // unknown state as ready. For compatibility reasons, ready should never be
  // "true" for terminating endpoints, except when the normal readiness
  // behavior is being explicitly overridden, for example when the associated
  // Service has set the publishNotReadyAddresses flag.
  // +optional

  repeated Carp items = 2;
}

// CarpSpec is a description of a carp
message CarpSpec {
  // Restart policy for all containers within the carp.
  // One of Always, OnFailure, Never.
  // Default to Always.
  // More info: http://kubernetes.io/docs/user-guide/carp-states#restartpolicy
  // +optional
  optional string restartPolicy = 3;