# JWT is intended for the CA.
      token:
        aud: istio-ca

    sts:
      # The service port used by Security Token Service (STS) server to handle token exchange requests.
      # Setting this port to a non-zero value enables STS server.
      servicePort: 0

    # The name of the CA for workload certificates.
    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates

  // +optional
  optional string requestSubResource = 15;

  // Name is the name of the object as presented in the request.  On a CREATE operation, the client may omit name and
  // rely on the server to generate the name.  If that is the case, this field will contain an empty string.
  // +optional
  optional string name = 5;

  // Namespace is the namespace associated with the request (if any).
  // +optional

// are responsible for serializing and deserializing the objects that contain
// their internal state.
// Once a ControllerRevision has been successfully created, it can not be updated.
// The API Server will fail validation of all requests that attempt to mutate
// the Data field. ControllerRevisions may, however, be deleted. Note that, due to its use by both

					},
				},
				&v1alpha3.Gateway{
					ObjectMeta: metav1.ObjectMeta{
						Name:      "fake-gw",
						Namespace: "default",
					},
					Spec: v1alpha32.Gateway{
						Servers: []*v1alpha32.Server{
							{
								Port: &v1alpha32.Port{
									Number:   80,
									Name:     "default",
									Protocol: "HTTP",
								},
								Hosts: []string{
									"productpage.exapple.com",

          "format": "time_series",
          "intervalFactor": 1,
          "refId": "A",
          "step": 4
        }
      ],
      "title": "Server Request Volume",
      "type": "stat"
    },
    {
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "fieldConfig": {
        "defaults": {

  // `assuredConcurrencyShares` (ACS) configures the execution
  // limit, which is a limit on the number of requests of this
  // priority level that may be exeucting at a given time.  ACS must
  // be a positive number. The server's concurrency limit (SCL) is
  // divided among the concurrency-controlled priority levels in
  // proportion to their assured concurrency shares. This produces
  // the assured concurrency value (ACV) --- the number of requests

  // `assuredConcurrencyShares` (ACS) configures the execution
  // limit, which is a limit on the number of requests of this
  // priority level that may be exeucting at a given time.  ACS must
  // be a positive number. The server's concurrency limit (SCL) is
  // divided among the concurrency-controlled priority levels in
  // proportion to their assured concurrency shares. This produces
  // the assured concurrency value (ACV) --- the number of requests

option go_package = "k8s.io/api/apiserverinternal/v1alpha1";

// An API server instance reports the version it can decode and the version it
// encodes objects to when persisting objects in the backend.
message ServerStorageVersion {
  // The ID of the reporting API server.
  optional string apiServerID = 1;

  // The API server encodes the object to this version when persisting it in
  // the backend (e.g., etcd).

```mermaid
graph LR
    subgraph Client Node
        Client
        CZ["Ztunnel"]
    end
    subgraph Server Node
        Server
        SZ["Ztunnel"]
    end
    Client--Plain-->CZ
    CZ-."HBONE (target)".->Server
    CZ--"HBONE (actual)"-->SZ
    SZ--Plain-->Server
```

### Pooling

User connections can be multiplexed over shared HBONE connections.

  optional int64 observedGeneration = 1;

  // DisruptedPods contains information about pods whose eviction was
  // processed by the API server eviction subresource handler but has not
  // yet been observed by the PodDisruptionBudget controller.
  // A pod will be in this map from the time when the API server processed the
  // eviction request to the time when the pod is seen by PDB controller