optional int64 observedGeneration = 1;

  // DisruptedPods contains information about pods whose eviction was
  // processed by the API server eviction subresource handler but has not
  // yet been observed by the PodDisruptionBudget controller.
  // A pod will be in this map from the time when the API server processed the
  // eviction request to the time when the pod is seen by PDB controller

# To simplify the deployment, disable non-essential components
alertmanager:
  enabled: false
prometheus-pushgateway:
  enabled: false
kube-state-metrics:
  enabled: false
prometheus-node-exporter:
  enabled: false
server:
  podLabels:
    sidecar.istio.io/inject: "false"
  persistentVolume:
    enabled: false
  # Use port 9090 to match Istio documentation
  service:
    servicePort: 9090
  readinessProbeInitialDelay: 0

	assert.Equal(t, len(fds), 1)
	// in theory we should close the fd, but it's just a test..

	assert.Equal(t, m.Payload.(*zdsapi.WorkloadRequest_Add).Add.Uid, uid)
	// send ack so the server doesn't wait for us.
	sendAck(ztunClient)

	// second message should be the snap sent message
	m, fds = readRequest(t, ztunClient)
	assert.Equal(t, len(fds), 0)

default            sleep-7656cf8794-lxcmx                               10.244.2.58 ambient-worker2       None                                HBONE
gateway-system     gateway-api-admission-server-85985d48ff-5jcvd        10.244.2.8  ambient-worker2       None                                TCP

```

TODO. It is possible to add Istio-CNI later, and gradually migrate.

### Install Control plane

This can run in any cluster. A mesh should have at least one cluster should run Pilot or equivalent XDS server,
and it is recommended to have Pilot running in each region and in multiple availability zones for multi cluster.

```bash
iop istio-control istio-discovery $IBASE/istio-control/istio-discovery \

  // NOTE: The API server's TokenReview endpoint will validate the
  // BoundObjectRef, but other audiences may not. Keep ExpirationSeconds
  // small if you want prompt revocation.
  // +optional
  optional BoundObjectReference boundObjectRef = 3;
}

// TokenRequestStatus is the result of a token request.
message TokenRequestStatus {
  // Token is the opaque bearer token.
  optional string token = 1;

      containers:
        - name: istio-operator
          image: {{.Values.hub}}/operator:{{.Values.tag}}
          command:
          - operator
          - server
          - --monitoring-host={{ .Values.operator.monitoring.host }}
          - --monitoring-port={{ .Values.operator.monitoring.port }}
          securityContext:
            allowPrivilegeEscalation: false

			log.Errorf("Error running UDS log server: %v", err)
		}
	}()

	go func() {
		<-stop
		if err := l.loggingServer.Close(); err != nil {
			log.Errorf("CNI log server terminated with error: %v", err)
		} else {
			log.Debug("CNI log server terminated")
		}
	}()

	return nil
}

func (l *UDSLogger) handleLog(w http.ResponseWriter, req *http.Request) {

    server: https://50.76.2.1:443
  name: local
contexts:
- context:
    cluster: local
    user: istio-cni
  name: istio-cni-context
current-context: istio-cni-context
kind: Config
preferences: {}
users:

) ([]grpc.DialOption, error) {
	ctx := context.TODO()
	// If we are using the insecure 15010 don't bother getting a token
	if opts.Plaintext || opts.CertDir != "" {
		return make([]grpc.DialOption, 0), nil
	}
	// Use bearer token
	aud := tokenAudiences
	isMCP := strings.HasSuffix(opts.Xds, ".googleapis.com") || strings.HasSuffix(opts.Xds, ".googleapis.com:443")
	if isMCP {
		// Special credentials handling when using ASM Managed Control Plane.