// replicas is the number of Pods created by the StatefulSet controller.
  optional int32 replicas = 2;

  // readyReplicas is the number of pods created by this StatefulSet controller with a Ready Condition.
  optional int32 readyReplicas = 3;

  // currentReplicas is the number of Pods created by the StatefulSet controller from the StatefulSet version
  // indicated by currentRevision.

  // where "pod-specific-string" is managed by the StatefulSet controller.
  optional string serviceName = 5;

  // podManagementPolicy controls how pods are created during initial scale up,
  // when replacing pods on nodes, or when scaling down. The default policy is
  // `OrderedReady`, where pods are created in increasing order (pod-0, then
  // pod-1, etc) and the controller will wait until each pod is ready before

`IstioOperatorSpec` has pass-through fields to the Helm values.yaml API, but these are additionally validated through
a [schema](../operator/pkg/apis/istio/v1alpha1/values_types.proto).
1. [Controller](#k8s-controller) code. The code comprises the K8s listener, webhook and logic for reconciling the cluster
to an `IstioOperatorSpec` CR.
1. [Manifest creation](#manifest-creation) code. User settings are overlaid on top of the

  // associated IngressClass defines which controller will implement the
  // resource. This replaces the deprecated `kubernetes.io/ingress.class`
  // annotation. For backwards compatibility, when that annotation is set, it
  // must be given precedence over this field. The controller may emit a
  // warning if the field and annotation have different values.

  namespace: {{.Namespace | quote}}
  annotations:
    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
  labels:
    {{- toJsonMap
      .InfrastructureLabels
      (strdict
        "gateway.networking.k8s.io/gateway-name" .Name
        "istio.io/gateway-name" .Name
      ) | nindent 4 }}

    env: {}
    
    # Settings related to the untaint controller
    # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
    # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
    taint:

    extraContainerArgs: []
    env: {}
    # Settings related to the untaint controller
    # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
    # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
    taint:

	// Repair
	registerBooleanParameter(constants.RepairEnabled, true, "Whether to enable race condition repair or not")
	registerBooleanParameter(constants.RepairDeletePods, false, "Controller will delete pods when detecting pod broken by race condition")
	registerBooleanParameter(constants.RepairLabelPods, false, "Controller will label pods when detecting pod broken by race condition")

  // processed by the API server eviction subresource handler but has not
  // yet been observed by the PodDisruptionBudget controller.
  // A pod will be in this map from the time when the API server processed the
  // eviction request to the time when the pod is seen by PDB controller
  // as having been marked for deletion (or after a timeout). The key in the map is the name of the pod

                    }
                }
            }
            catch ( IOException ioe ) {
                if ( log.isDebugEnabled() ) {
                    log.debug(String.format("Getting domain controller for %s failed", domain), ioe);
                }
                ce.map.put(DC_ENTRY, NEGATIVE_ENTRY);
                if ( tf.getConfig().isDfsStrictView() && ioe instanceof SmbAuthException ) {