s.pods.AddEventHandler(controllers.FromEventHandler(func(o controllers.Event) {
		s.queue.Add(o)
	}))

	// Namespaces could be anything though, so we watch all of those
	//
	// NOTE that we are requeueing namespaces here explicitly to work around
	// test flakes with the fake kube client in `pkg/kube/client.go` -

  // It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
  // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
  // +optional
  optional string evaluationError = 3;
}

charts unmodified (but validated through a
[schema](pkg/apis/istio/v1alpha1/values_types.proto)). Values.yaml settings
are overridden the same way as the new API, though a customized CR overlaid over default values for the selected
profile. Here's an example of overriding some global level default values ([samples/values-global.yaml](samples/values-global.yaml)):

```yaml

  // a direct binding between Ingress controller and Ingress resources. Newly
  // created Ingress resources should prefer using the field. However, even
  // though the annotation is officially deprecated, for backwards compatibility
  // reasons, ingress controllers should still honor that annotation if present.
  // +optional
  optional string ingressClassName = 4;

// kubelet plugin registration.
// CSINode has the same name as a node. If the object is missing, it means either
// there are no CSI Drivers available on the node, or the Kubelet version is low
// enough that it doesn't create this object.
// CSINode has an OwnerReference that points to the corresponding node object.
message CSINode {
  // metadata.name must be the Kubernetes node name.

values.yaml ## Acceptable Pull Requests Helm charts `values.yaml` represent a complex user facing API that tends to grow uncontrollably over time due to design choices in Helm. The underlying Kubernetes resources we configure have 1000s of fields; given enough users and bespoke use cases, eventually someone will want to customize every one of those fields. If all fields are exposed in `values.yaml`, we end up with an massive API that is also likely worse than just using the Kubernetes API directly. To avoid...

		if err != nil {
			return false
		}
		name := r.Name
		err = drc[j].RouteConfig.UnmarshalTo(r)
		if err != nil {
			return false
		}
		return name < r.Name
	})

	// In Istio 1.5, it is not enough just to sort the routes.  The virtual hosts
	// within a route might have a different order.  Sort those too.
	for i := range drc {
		route := &route.RouteConfiguration{}
		err = drc[i].RouteConfig.UnmarshalTo(route)

			// something first, we expect to get an os.ErrDeadlineExceeded error
			// here if the connection is still alive.
			// note that unlike tcp connections, reading is a good enough test here.
			_, err := conn.readMessage(time.Second / 100)
			switch {
			case !errors.Is(err, os.ErrDeadlineExceeded):
				log.Debugf("ztunnel keepalive failed: %v", err)
				if errors.Is(err, io.EOF) {

  optional MetricValueStatus current = 2;

  // container is the name of the container in the pods of the scaling target
  optional string container = 3;
}

// CrossVersionObjectReference contains enough information to let you identify the referred resource.
message CrossVersionObjectReference {

  // container is the name of the container in the pods of the scaling target
  optional string container = 4;
}

// CrossVersionObjectReference contains enough information to let you identify the referred resource.
message CrossVersionObjectReference {
  // Kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds