return []string{"ANY"}, true
		}
	case *matcher.Matcher_OnMatch_Matcher:
		ms, f := recurse(name, v.Matcher)
		if !f {
			return []string{"NONE"}, true
		}
		return ms, true
	}
	// TODO support list
	n := match.GetMatcherTree().GetInput().GetName()

	var m map[string]*matcher.Matcher_OnMatch
	equality := "="
	switch v := match.GetMatcherTree().GetTreeType().(type) {

	err := netlink.IpsetFlush(name)
	if err != nil {
		return fmt.Errorf("failed to flush ipset %s: %w", name, err)
	}
	return nil
}

// Alpine and some distros struggles with this - ipset CLI utilities support this, but
// the kernel can be out of sync with the CLI utility, leading to errors like:
//
// ipset v7.10: Argument `comment' is supported in the kernel module of the set type hash:ip

  // encountered when an authorizer, such as an external authorizer, doesn't support rules evaluation.
  optional bool incomplete = 3;

  // EvaluationError can appear in combination with Rules. It indicates an error occurred during
  // rule evaluation, such as an authorizer that doesn't support rule evaluation, and that
  // ResourceRules and/or NonResourceRules may be incomplete.
  // +optional

This can be a `Service` or a `Workload`.

The address type has the following goals:
* It should support (but not require) on-demand lookups.
  * Specifically, ztunnel should be able to send a request to the control plane to answer "I got a request to send traffic to 1.1.1.1, what is 1.1.1.1?"

  //
  // "csi.storage.k8s.io/ephemeral" is a new feature in Kubernetes 1.16. It is only
  // required for drivers which support both the "Persistent" and "Ephemeral" VolumeLifecycleMode.
  // Other drivers can leave pod info disabled and/or ignore this field.
  // As Kubernetes 1.15 doesn't support this field, drivers can only support one mode when
  // deployed on such a cluster and the deployment determines which mode that is, for example

Copyright (c) 2013, The GoGo Authors. All rights reserved.

Protocol Buffers for Go with Gadgets

Go support for Protocol Buffers - Google's data interchange format

Copyright 2010 The Go Authors.  All rights reserved.
https://github.com/golang/protobuf

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:

3.5. Application of Additional Terms

     You may choose to offer, and to charge a fee for, warranty, support,
     indemnity or liability obligations to one or more recipients of Covered
     Software. However, You may do so only on Your own behalf, and not on behalf
     of any Contributor. You must make it absolutely clear that any such
     warranty, support, indemnity, or liability obligation is offered by You

  // This field IS NOT consulted in any way if "Allowed" is "true".
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Status status = 3;

  // The patch body. Currently we only support "JSONPatch" which implements RFC 6902.
  // +optional
  optional bytes patch = 4;

  // The type of Patch. Currently we only allow "JSONPatch".
  // +optional
  optional string patchType = 5;

```

## Uninstalling the Chart

To uninstall/delete the `istiod` deployment:

```console
helm delete istiod --namespace istio-system
```

## Configuration

To view support configuration options and documentation, run:

```console
helm show values istio/istiod
```

### Profiles

Istio Helm charts have a concept of a `profile`, which is a bundled collection of value presets.

   9. Accepting Warranty or Additional Liability. While redistributing
      the Work or Derivative Works thereof, You may choose to offer,
      and charge a fee for, acceptance of support, warranty, indemnity,
      or other liability obligations and/or rights consistent with this
      License. However, in accepting such obligations, You may act only