// Items is a list of ClusterRoles
  repeated ClusterRole items = 2;
}

// PolicyRule holds information that describes a policy rule, but does not contain information
// about who the rule applies to or which namespace the rule applies to.
message PolicyRule {
  // Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.
  repeated string verbs = 1;

// ExtraValue masks the value so protobuf can generate
// +protobuf.nullable=true
// +protobuf.options.(gogoproto.goproto_stringer)=false
message ExtraValue {
  // items, if empty, will result in an empty slice

  repeated string items = 1;
}

// TokenRequest requests a token for a given service account.
message TokenRequest {
  // Standard object's metadata.

  // +optional
  // +listType=atomic
  repeated EndpointPort ports = 3;
}

// EndpointSliceList represents a list of endpoint slices
message EndpointSliceList {
  // Standard list metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // items is the list of endpoint slices
  repeated EndpointSlice items = 2;
}

contact_links:
- name: "Crash bug"
  url: https://istio.io/about/security-vulnerabilities/

  // currentMetrics is the last read state of the metrics used by this autoscaler.
  // +optional
  repeated MetricStatus currentMetrics = 5;

  // conditions is the set of conditions required for this autoscaler to scale its target,
  // and indicates whether or not those conditions are met.
  // +optional
  repeated HorizontalPodAutoscalerCondition conditions = 6;
}

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // items is the list of ClusterCIDRs.
  repeated ClusterCIDR items = 2;
}

// ClusterCIDRSpec defines the desired state of ClusterCIDR.
message ClusterCIDRSpec {
  // nodeSelector defines which nodes the config is applicable to.

## Reporting a Vulnerability

Instructions for reporting a vulnerability can be found on the
[Istio Security Vulnerabilities] page. The Istio Product Security Working Group receives
vulnerability and security issue reports, and the company affiliation of the members of
the group can be found at [Early Disclosure Membership].

## Security Bulletins

Information about previous Istio vulnerabilities can be found on the

  // currentMetrics is the last read state of the metrics used by this autoscaler.
  // +optional
  repeated MetricStatus currentMetrics = 5;

  // conditions is the set of conditions required for this autoscaler to scale its target,
  // and indicates whether or not those conditions are met.
  // +optional
  repeated HorizontalPodAutoscalerCondition conditions = 6;
}

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // List of carps.
  // More info: http://kubernetes.io/docs/user-guide/carps
  repeated Carp items = 2;
}

// CarpSpec is a description of a carp
message CarpSpec {
  // Restart policy for all containers within the carp.
  // One of Always, OnFailure, Never.
  // Default to Always.

    verbs: ["update"]
    # TODO: should be on just */status but wildcard is not supported
    resources: ["*"]

  # Needed because status reporter sets the config map owner reference to the istiod pod
  - apiGroups: [""]
    verbs: ["update"]
    resources: ["pods/finalizers"]
{{- end }}
  - apiGroups: ["networking.istio.io"]