type: object
                    delegate:
                      description: Delegate is used to specify the particular VirtualService
                        which can be used to define delegate HTTPRoute.
                      properties:
                        name:
                          description: Name specifies the name of the delegate VirtualService.
                          type: string

  # TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
  verbs: ["create", "get", "watch", "list", "update", "delete"]

# For status controller, so it can delete the distribution report configmap
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["delete"]

# For gateway deployment controller
- apiGroups: ["coordination.k8s.io"]
  resources: ["leases"]

  // object in the same namespace as this pod.
  //
  // The template will be used to create a new ResourceClaim, which will
  // be bound to this pod. When this pod is deleted, the ResourceClaim
  // will also be deleted. The name of the ResourceClaim will be <pod
  // name>-<resource name>, where <resource name> is the
  // PodResourceClaim.Name. Pod validation will reject the pod if the

However, all other types *cannot* be deleted explicitly, and instead are cleaned up when all references are removed. This means we can send partial updates for non-root types, without deleting unsent resources. This effectively allows doing delta updates over SotW. This optimization is critical for our endpoints generator, ensuring that when a pod scales we only need to update the endpoints...

func (m *MockedIpsetDeps) addIP(name string, ip netip.Addr, ipProto uint8, comment string, replace bool) error {
	args := m.Called(name, ip, ipProto, comment, replace)
	return args.Error(0)
}

func (m *MockedIpsetDeps) deleteIP(name string, ip netip.Addr, ipProto uint8) error {
	args := m.Called(name, ip, ipProto)
	return args.Error(0)
}

func (m *MockedIpsetDeps) flush(name string) error {
	args := m.Called(name)
	return args.Error(0)

message UserInfo {
  // The name that uniquely identifies this user among all active users.
  // +optional
  optional string username = 1;

  // A unique value that identifies this user across time. If this user is
  // deleted and another user by the same name is added, they will have
  // different UIDs.
  // +optional
  optional string uid = 2;

  // The names of groups this user is a part of.
  // +optional

// limitations under the License.

package repair

import (
	"istio.io/istio/pkg/monitoring"
)

var (
	typeLabel  = monitoring.CreateLabel("type")
	deleteType = "delete"
	repairType = "repair"
	labelType  = "label"

	resultLabel   = monitoring.CreateLabel("result")
	resultSuccess = "success"
	resultSkip    = "skip"
	resultFail    = "fail"

	podsRepaired = monitoring.NewSum(

To install the chart with the release name `istio-ingressgateway`:

```console
helm install istio-ingressgateway istio/gateway
```

## Uninstalling the Chart

To uninstall/delete the `istio-ingressgateway` deployment:

```console
helm delete istio-ingressgateway
```

## Configuration

To view support configuration options and documentation, run:

```console
helm show values istio/gateway
```

            "type": "prometheus",
            "uid": "${datasource}"
          },
          "expr": "max(pilot_k8s_cfg_events{type=\"VirtualService\", event=\"add\"}) - (max(pilot_k8s_cfg_events{type=\"VirtualService\", event=\"delete\"}) or max(up * 0))",
          "format": "time_series",
          "intervalFactor": 1,
          "refId": "A"
        }
      ],
      "title": "Virtual Services",
      "type": "stat"
    },
    {

    verbs: ["watch", "get", "list"]
{{- if .Values.cni.repair.repairPods }}
{{- /*  No privileges needed*/}}
{{- else if .Values.cni.repair.deletePods }}
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["delete"]
{{- else if .Values.cni.repair.labelPods }}
  - apiGroups: [""]
    {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
    resources: ["pods/status"]