}

// TokenReviewStatus is the result of the token authentication request.
message TokenReviewStatus {
  // Authenticated indicates that the token was associated with a known user.
  // +optional
  optional bool authenticated = 1;

  // User is the UserInfo associated with the provided token.
  // +optional
  optional UserInfo user = 2;

  // Audiences are audience identifiers chosen by the authenticator that are

// EventSeries contain information on series of events, i.e. thing that was/is happening
// continuously for some time. How often to update the EventSeries is up to the event reporters.
// The default event reporter in "k8s.io/client-go/tools/events/event_broadcaster.go" shows
// how this struct is updated on heartbeats and can guide customized reporter implementations.
message EventSeries {

	Destination string `json:"destination"`
	State       string `json:"state"`
	SecretMeta
}

// SecretMeta holds selected fields which can be extracted from parsed x509 cert
type SecretMeta struct {
	Valid        bool   `json:"cert_valid"`
	SerialNumber string `json:"serial_number"`
	NotAfter     string `json:"not_after"`
	NotBefore    string `json:"not_before"`
	Type         string `json:"type"`
}

	return cmd
}

// setTag creates or modifies a revision tag.
func setTag(ctx context.Context, kubeClient kube.CLIClient, tagName, revision, istioNS string, generate bool, w, stderr io.Writer) error {
	opts := &GenerateOptions{
		Tag:                  tagName,
		Revision:             revision,
		WebhookName:          webhookName,
		ManifestsPath:        manifestsPath,

	install "istio.io/istio/cni/test"
	"istio.io/istio/pkg/test/env"
)

var (
	Hub = "gcr.io/istio-release"
	Tag = "master-latest-daily"
)

type testCase struct {
	name             string
	chainedCNIPlugin bool
	preConfFile      string
	resultFileName   string
	// Must set chainedCNIPlugin to true if delayedConfFile is specified
	delayedConfFile        string
	expectedOutputFile     string
	expectedPostCleanFile  string

    - Config must exclude namespace that Istio control-plane is installed in (TODO: this may change, exclude at pod level is sufficient and we may want Istiod and other istio components to use ambient too)
    - If excluded, ignore the pod and return prevResult
1. Setup redirect rules for the pods:
    - Get the port list from pods definition, as well as annotations.

      # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
      # and doesn't spam the readiness endpoint too much
      #
      # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.

  // Defaults to 10.
  // +optional
  optional int32 revisionHistoryLimit = 6;

  // Indicates that the deployment is paused.
  // +optional
  optional bool paused = 7;

  // The maximum time in seconds for a deployment to make progress before it
  // is considered to be failed. The deployment controller will continue to

	excludeOutboundPorts string
	includeInboundPorts  string
	includeOutboundPorts string
	kubevirtInterfaces   string
	excludeInterfaces    string
	dnsRedirect          bool
	dualStack            bool
	invalidDrop          bool
}

type annotationValidationFunc func(value string) error

type annotationParam struct {
	key        string
	defaultVal string
	validator  annotationValidationFunc
}

this subset. properties: connectionPool: properties: http: description: HTTP connection pool settings. properties: h2UpgradePolicy: description: Specify if http1.1 connection should be upgraded to http2 for the associated destination. enum: - DEFAULT - DO_NOT_UPGRADE - UPGRADE type: string http1MaxPendingReque: description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. format: int32 type: integer http2MaxRequests: description: Maximum number of...