// At least one element is required. At most 255 elements are allowed.
  // +listType=set
  repeated int32 values = 3;
}

// PodFailurePolicyOnPodConditionsPattern describes a pattern for matching
// an actual pod condition type.
message PodFailurePolicyOnPodConditionsPattern {
  // Specifies the required Pod condition type. To match a pod condition

	@bin/check_samples.sh
	@testlinter
	@envvarlinter istioctl pilot security

# Allow-list:
# (k8s) Machinery, utils, klog
# (proto) Istio API non-CRDs, MeshConfig and ProxyConfig
# (proto) Envoy TLS proto for SDS
# (proto) Envoy Wasm filters for wasm xDS proxy
# (proto) xDS discovery service for xDS proxy

regex-based match (https://github.com/google/re2/wiki/Syntax). type: string type: object description: The header keys must be lowercase and use hyphen as the separator, e.g. type: object ignoreUriCase: description: Flag to specify whether the URI matching should be case-insensitive. type: boolean method: description: 'HTTP Method values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for RE2 style...

#### Caching

Config translation typically takes the overwhelming majority of Istiod's resource usage. In particular, protobuf encoding. As a result, caching has been introduced, storing the already encoded `protobuf.Any` for a given resource.

	}
	os.WriteFile(filepath.Join(cfg.MountedCNINetDir, cfg.KubeconfigFilename), []byte(expectedKC.Full), 0o644)

	err = checkExistingKubeConfigFile(cfg, expectedKC)
	if err != nil {
		t.Fatalf("expected no error, matching kubeconfig present, got %+v", err)
	}

    # When processing a leaf namespace Istio will search for declarations in that namespace first
    # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
    # is processed as if it were declared in the leaf namespace.
    rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}

}

// MetricSpec specifies how to scale based on a single metric
// (only `type` and one other matching field should be set at once).
message MetricSpec {
  // type is the type of metric source.  It should be one of "ContainerResource", "External",
  // "Object", "Pods" or "Resource", each mapping to a matching field in the object.
  // Note: "ContainerResource" type is available on when the feature-gate

}

// MetricSpec specifies how to scale based on a single metric
// (only `type` and one other matching field should be set at once).
message MetricSpec {
  // type is the type of metric source.  It should be one of "ContainerResource",
  // "External", "Object", "Pods" or "Resource", each mapping to a matching field in the object.
  // Note: "ContainerResource" type is available on when the feature-gate

// Node.  A ClusterCIDR is eligible to be used for a given Node when the node
// selector matches the node in question and has free CIDRs to allocate.  In
// case of multiple matching ClusterCIDR resources, the allocator will attempt
// to break ties using internal heuristics, but any ClusterCIDR whose node
// selector matches the Node may be used.
message ClusterCIDR {
  // Standard object's metadata.

                  set will be used only if the pools with priority can't be used.
                  If multiple matching IPAddressPools are available it will check
                  for the availability of IPs sorting the matching IPAddressPools
                  by priority, starting from the highest to the lowest. If multiple