// `assuredConcurrencyShares` (ACS) configures the execution
  // limit, which is a limit on the number of requests of this
  // priority level that may be exeucting at a given time.  ACS must
  // be a positive number. The server's concurrency limit (SCL) is
  // divided among the concurrency-controlled priority levels in
  // proportion to their assured concurrency shares. This produces
  // the assured concurrency value (ACV) --- the number of requests

  // `assuredConcurrencyShares` (ACS) configures the execution
  // limit, which is a limit on the number of requests of this
  // priority level that may be exeucting at a given time.  ACS must
  // be a positive number. The server's concurrency limit (SCL) is
  // divided among the concurrency-controlled priority levels in
  // proportion to their assured concurrency shares. This produces
  // the assured concurrency value (ACV) --- the number of requests

AGENT_BINARIES:=./pilot/cmd/pilot-agent
STANDARD_BINARIES:=./istioctl/cmd/istioctl \
  ./pilot/cmd/pilot-discovery \
  ./pkg/test/echo/cmd/client \
  ./pkg/test/echo/cmd/server \
  ./samples/extauthz/cmd/extauthz \
  ./operator/cmd/operator

# These are binaries that require Linux to build, and should
# be skipped on other platforms. Notably this includes the current Linux-only Istio CNI plugin

  // across all of the NetworkPolicy objects whose podSelector matches the pod. If
  // this field is empty then this NetworkPolicy does not allow any traffic (and serves
  // solely to ensure that the pods it selects are isolated by default)
  // +optional
  repeated NetworkPolicyIngressRule ingress = 2;

            "@type": "type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy",
            "stat_prefix": "outbound|443||gateway-api-admission-server.gateway-system.svc.cluster.local",
            "cluster": "outbound|443||gateway-api-admission-server.gateway-system.svc.cluster.local"
           }
          }
         ]
        }
       ],
       "traffic_direction": "OUTBOUND",

  // If not specified, this will default to the time zone of the kube-controller-manager process.
  // The set of valid time zone names and the time zone offset is loaded from the system-wide time zone
  // database by the API server during CronJob validation and the controller manager during execution.
  // If no system-wide time zone database can be found a bundled version of the database is used instead.

                type: integer
            type: object
          status:
            description: BFDProfileStatus defines the observed state of BFDProfile.
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:

	fs := &fakeServer{testWG: wg}

	fs.On("AddPodToMesh",
		ctx,
		pod,
		util.GetPodIPsIfPresent(pod),
		"",
	).Return(nil)

	server := &meshDataplane{
		kubeClient: client.Kube(),
		netServer:  fs,
	}

	handlers := setupHandlers(ctx, client, server, "istio-system")
	client.RunAndWait(ctx.Done())
	go handlers.Start()

	// label the namespace

// ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22.
message ClusterRole {
  // Standard object's metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Rules holds all the PolicyRules for this ClusterRole

// ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22.
message ClusterRole {
  // Standard object's metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Rules holds all the PolicyRules for this ClusterRole