// Reason is optional.  It indicates why a request was allowed or denied.
  // +optional
  optional string reason = 2;

  // EvaluationError is an indication that some error occurred during the authorization check.
  // It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
  // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.

  // valid against the audience of the Kubernetes API server.
  // +optional
  repeated string audiences = 4;

  // Error indicates that the token couldn't be checked
  // +optional
  optional string error = 3;
}

// UserInfo holds the information about the user needed to implement the
// user.Info interface.
message UserInfo {

  optional string patchType = 5;

  // AuditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted).
  // MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with
  // admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by

  // +optional
  optional VolumeError detachError = 4;
}

// VolumeError captures an error encountered during a volume operation.
message VolumeError {
  // time represents the time the error was encountered.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time time = 1;

  // message represents the error encountered during Attach or Detach operation.

  // +optional
  repeated Subject subjects = 2;

  // RoleRef can only reference a ClusterRole in the global namespace.
  // If the RoleRef cannot be resolved, the Authorizer must return an error.
  optional RoleRef roleRef = 3;
}

// ClusterRoleBindingList is a collection of ClusterRoleBindings
message ClusterRoleBindingList {
  // Standard object's metadata.
  // +optional

}

// IngressPortStatus represents the error condition of a service port
message IngressPortStatus {
  // port is the port number of the ingress port.
  optional int32 port = 1;

  // protocol is the protocol of the ingress port.
  // The supported values are: "TCP", "UDP", "SCTP"
  optional string protocol = 2;

  // error is to record the problem with the service port

proxy1     cluster1     STALE        SYNCED      SYNCED      NOT SENT     SYNCED       istiod1     1.20
proxy2     cluster2     STALE        SYNCED      STALE       SYNCED       STALE        istiod2     1.19
proxy3     cluster3     NOT SENT     ERROR       STALE       NOT SENT     NOT SENT     istiod3     1.20

  // Reason is optional.  It indicates why a request was allowed or denied.
  // +optional
  optional string reason = 2;

  // EvaluationError is an indication that some error occurred during the authorization check.
  // It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
  // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.

HUB ?=istio
ifeq ($(HUB),)
  $(error "HUB cannot be empty")
endif

# For dockerx builds, allow HUBS which is a space separated list of hubs. Default to HUB.
HUBS ?= $(HUB)

# If tag not explicitly set in users' .istiorc.mk or command line, default to the git sha.
TAG ?= $(shell git rev-parse --verify HEAD)
ifeq ($(TAG),)
  $(error "TAG cannot be empty")
endif

PULL_POLICY ?= IfNotPresent

}

// IngressPortStatus represents the error condition of a service port
message IngressPortStatus {
  // port is the port number of the ingress port.
  optional int32 port = 1;

  // protocol is the protocol of the ingress port.
  // The supported values are: "TCP", "UDP", "SCTP"
  optional string protocol = 2;

  // error is to record the problem with the service port