// +optional
  optional string path = 1;

  // PathType determines the interpretation of the Path matching. PathType can
  // be one of the following values:
  // * Exact: Matches the URL path exactly.
  // * Prefix: Matches based on a URL path prefix split by '/'. Matching is
  //   done on a path element by element basis. A path element refers is the

  // distinguish between parameters stored here and and those stored in
  // ResourceClaimSpec.
  // +optional
  optional ResourceClassParametersReference parametersRef = 3;

  // Only nodes matching the selector will be considered by the scheduler
  // when trying to find a Node that fits a Pod when that Pod uses
  // a ResourceClaim that has not been allocated yet.
  //

  // More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller/#what-is-a-replicationcontroller
  optional int32 replicas = 1;

  // The number of pods that have labels matching the labels of the pod template of the replicaset.
  // +optional
  optional int32 fullyLabeledReplicas = 2;

  // readyReplicas is the number of pods targeted by this ReplicaSet controller with a Ready Condition.

  // At least one element is required. At most 255 elements are allowed.
  // +listType=set
  repeated int32 values = 3;
}

// PodFailurePolicyOnPodConditionsPattern describes a pattern for matching
// an actual pod condition type.
message PodFailurePolicyOnPodConditionsPattern {
  // Specifies the required Pod condition type. To match a pod condition

				{
					Name:     "istio-sidecar-injector",
					Revision: "default",
					Reason: "No matching namespace labels (istio.io/rev=default, istio-injection=enabled) " +
						"or pod labels (istio.io/rev=default, sidecar.istio.io/inject=true)",
				},
				{
					Name:     "istio-sidecar-injector-1-16",
					Revision: "1-16",
					Reason:   "No matching namespace labels (istio.io/rev=1-16) or pod labels (istio.io/rev=1-16)",
				},
				{

  // `resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the
  // target resource.
  // At least one of `resourceRules` and `nonResourceRules` has to be non-empty.
  // +listType=atomic
  // +optional
  repeated ResourcePolicyRule resourceRules = 2;

  // `nonResourceRules` is a list of NonResourcePolicyRules that identify matching requests according to their verb

  // `resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the
  // target resource.
  // At least one of `resourceRules` and `nonResourceRules` has to be non-empty.
  // +listType=atomic
  // +optional
  repeated ResourcePolicyRule resourceRules = 2;

  // `nonResourceRules` is a list of NonResourcePolicyRules that identify matching requests according to their verb

# Istio CNI Node Agent

The Istio CNI Node Agent is responsible for several things

- Install an Istio CNI plugin binary on each node's filesystem, updating that node's CNI config in e.g (`/etc/cni/net.d`), and watching the config and binary paths to reinstall if things are modified.

  // More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller/#what-is-a-replicationcontroller
  optional int32 replicas = 1;

  // The number of pods that have labels matching the labels of the pod template of the replicaset.
  // +optional
  optional int32 fullyLabeledReplicas = 2;

  // readyReplicas is the number of pods targeted by this ReplicaSet with a Ready Condition.
  // +optional

This means Ztunnel will have multiple distinct certificates at a time, one for each unique identity (service account) running on its node.

When fetching certificates, ztunnel will authenticate to the CA with its own identity, but request the identity of another workload.
Critically, the CA must enforce that the ztunnel has permission to request that identity.