// Limit warnings to 120 characters if possible.
  // Warnings over 256 characters and large numbers of warnings may be truncated.
  // +optional
  repeated string warnings = 7;
}

// AdmissionReview describes an admission review request/response.
message AdmissionReview {
  // Request describes the attributes for the admission request.
  // +optional

            properties:
              exportTo:
                description: A list of namespaces to which this destination rule is
                  exported.
                items:
                  type: string
                type: array
              host:
                description: The name of a service from the service registry.
                type: string

                              "type_url": "type.googleapis.com/stats.PluginConfig",
                              "value": {
                                "reporter": "SERVER_GATEWAY"
                              }
                            }
                          },
                          {
                            "name": "envoy.filters.http.router",

"sparkline": { "fillColor": "rgba(31, 118, 189, 0.18)", "full": true, "lineColor": "rgb(31, 120, 193)", "show": true }, "tableColumn": "", "targets": [ { "expr": "sum(irate(istio_requests_total{reporter=~\"$qrep\",destination_service=~\"$service\",response_code!~\"5.*\"}[5m])) / sum(irate(istio_requests_total{reporter=~\"$qrep\",destination_service=~\"$service\"}[5m]))", "format": "time_series", "intervalFactor": 1, "refId": "A" } ], "thresholds": "95, 99, 99.5", "title": "Client Success Rate (non-5xx responses)",...

  // Items is a list of ClusterRoleBindings
  repeated ClusterRoleBinding items = 2;
}

// ClusterRoleList is a collection of ClusterRoles
message ClusterRoleList {
  // Standard object's metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is a list of ClusterRoles
  repeated ClusterRole items = 2;
}

  repeated string verbs = 1;

  // NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full,
  // final step in the path.  "*" means all.
  // +optional
  repeated string nonResourceURLs = 2;
}

  // the kubelet plugin invoked will match the DriverName set in the
  // ResourceClaimStatus this AllocationResult is embedded in.
  //
  // +listType=atomic
  // +optional
  repeated ResourceHandle resourceHandles = 1;

  // This field will get set by the resource driver after it has allocated
  // the resource to inform the scheduler where it can schedule Pods using
  // the ResourceClaim.
  //

		// a block grant of addresses, we just need one for checking routes.
		podIps = append(podIps, ip)
	}
	// Note that we use the IP info from the CNI plugin here - the Pod struct as reported by K8S doesn't have this info
	// yet (because the K8S control plane doesn't), so it will be empty there.
	err = s.dataplane.AddPodToMesh(ctx, ambientPod, podIps, addCmd.Netns)
	if err != nil {
		return err
	}

  // +listType=atomic
  // +optional
  repeated IngressPortStatus ports = 4;
}

// IngressLoadBalancerStatus represents the status of a load-balancer.
message IngressLoadBalancerStatus {
  // ingress is a list containing ingress points for the load-balancer.
  // +optional
  repeated IngressLoadBalancerIngress ingress = 1;
}

  // +listType=atomic
  // +optional
  repeated PolicyRulesWithSubjects rules = 4;
}

// FlowSchemaStatus represents the current state of a FlowSchema.
message FlowSchemaStatus {
  // `conditions` is a list of the current states of FlowSchema.
  // +listType=map
  // +listMapKey=type
  // +optional
  repeated FlowSchemaCondition conditions = 1;
}