message NonResourcePolicyRule {
  // `verbs` is a list of matching verbs and may not be empty.
  // "*" matches all verbs. If it is present, it must be the only entry.
  // +listType=set
  // Required.
  repeated string verbs = 1;

  // `nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty.
  // For example:
  //   - "/healthz" is legal
  //   - "/hea*" is illegal

}

func forEachLoopbackRoute(cfg *Config, f func(*netlink.Route) error) error {
	loopbackLink, err := netlink.LinkByName("lo")
	if err != nil {
		return fmt.Errorf("failed to find 'lo' link: %v", err)
	}

	// Set up netlink routes for localhost
	cidrs := []string{"0.0.0.0/0"}
	if cfg.EnableIPv6 {
		cidrs = append(cidrs, "0::0/0")
	}
	for _, fullCIDR := range cidrs {
		_, localhostDst, err := net.ParseCIDR(fullCIDR)

	config, err := kube.DefaultRestConfig(kubeconfig, "")
	if err != nil {
		log.Errorf("Failed setting up kubernetes client with kubeconfig %s", kubeconfig)
		return nil, err
	}

	log.Debugf("istio-cni set up kubernetes client with kubeconfig %s", kubeconfig)

	// Create the client
	return kubernetes.NewForConfig(config)
}

// getK8sPodInfo returns information of a POD

However, that doesn't necessarily mean a PR to add a value will be accepted.
The `values.yaml` API is intended to maintain a *minimal core set of configuration* that most users will use.
For bespoke use cases, [Helm Chart Customization](https://istio.io/latest/docs/setup/additional-setup/customize-installation-helm/#advanced-helm-chart-customization) can be used

metadata:
  labels:
    {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}}

  // "true" for terminating endpoints.
  // +optional
  optional bool ready = 1;

  // serving is identical to ready except that it is set regardless of the
  // terminating state of endpoints. This condition should be set to true for
  // a ready endpoint that is terminating. If nil, consumers should defer to
  // the ready condition.
  // +optional
  optional bool serving = 2;

	for _, pip := range podIPs {
		// Add to host ipset
		log.Debugf("adding pod %s probe to ipset %s with ip %s", pod.Name, hostsideProbeSet.Prefix, pip)
		// Add IP/port combo to set. Note that we set Replace to true - a pod ip/port combo already being
		// in the set is perfectly fine, and something we can always safely overwrite, so we will.
		if err := hostsideProbeSet.AddIP(pip, ipProto, podUID, true); err != nil {

	"istio.io/istio/operator/pkg/util/clog"
	"istio.io/istio/pkg/kube"
)

type operatorRemoveArgs struct {
	// skipConfirmation determines whether the user is prompted for confirmation.
	// If set to true, the user is not prompted and a Yes response is assumed in all cases.
	skipConfirmation bool
	// force proceeds even if there are validation errors
	force bool

The target destination address is set in the `:authority` header, and additional headers can be included as well.
Currently, only HTTP/2 is supported, though HTTP/1.1 and HTTP/3 are planned.

Currently, SNI is not set by Istio clients and ignored by Istio servers.
This makes identifying which certificate to use problematic for Ztunnel.

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

set -e
set -x

# The purpose of this file is to unify prow/lib.sh in both istio and istio.io
# repos to avoid code duplication.

####################################################################