- CAP_SYS_ADMIN
- CAP_NET_ADMIN
- CAP_NET_RAW

## Ambient mode details

See [architecture doc](../architecture/ambient/ztunnel-cni-lifecycle.md).

## Reference

### Design details

Broadly, `istio-cni` accomplishes ambient redirection by instructing ztunnel to set up sockets within the application pod network namespace, where:

			writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)
			return
		}
	}
	defer gr.Close()

	objInfo := gr.ObjInfo

	if !proxy.Proxy { // apply lifecycle rules only for local requests
		// Automatically remove the object/version if an expiry lifecycle rule can be applied
		if lc, err := globalLifecycleSys.Get(bucket); err == nil {
			rcfg, err := globalBucketObjectLockSys.Get(bucket)
			if err != nil {

  //
  // The other mode is "Ephemeral". In this mode, volumes are defined inline inside the pod spec
  // with CSIVolumeSource and their lifecycle is tied to the lifecycle of that pod.
  // A driver has to be aware of this because it is only going to get a NodePublishVolume call for such a volume.
  //
  // For more information about implementing this mode, see

    - [SIG API Machinery](#sig-api-machinery)
    - [SIG-autoscaling](#sig-autoscaling)
    - [SIG-Azure](#sig-azure)
    - [SIG-cli](#sig-cli)
    - [SIG-cloud-provider](#sig-cloud-provider)
    - [SIG-cluster-lifecycle](#sig-cluster-lifecycle)
    - [SIG-ibmcloud](#sig-ibmcloud)
    - [SIG-instrumentation](#sig-instrumentation)
    - [SIG-node](#sig-node)
    - [SIG-OpenStack](#sig-openstack)
    - [SIG-scheduling](#sig-scheduling)

     * <code>smb://server/</code>,
     * <li>or <code>null</code> if the resource cannot be resolved.
     * </ul>
     * 
     * If strict resource lifecycle is used, make sure you close the individual files after use.
     *
     * @return An array of <code>SmbResource</code> objects representing file

     */
    ModelBuildingRequest setValidationLevel(int validationLevel);

    /**
     * Indicates whether plugin executions and configurations should be processed. If enabled, lifecycle-induced plugin
     * executions will be injected into the model and common plugin configuration will be propagated to individual
     * executions.
     *

		},
		config.HelpKV{
			Key:         config.ScannerSubSys,
			Description: "manage namespace scanning for usage calculation, lifecycle, healing and more",
		},
		config.HelpKV{
			Key:         config.BatchSubSys,
			Description: "manage batch job workers and wait times",
		},
		config.HelpKV{
			Key:         config.CompressionSubSys,

as persistent local volumes. This architecture enables multi-tenant MinIO, allowing isolation of data between customers.

MinIO also supports multi-cluster, multi-site federation similar to AWS regions and tiers. Using MinIO Information Lifecycle Management (ILM), you can configure data to be tiered between NVMe based hot storage, and HDD based warm storage. All data is encrypted with per-object key. Access Control and Identity Management between the tenants are managed by MinIO using OpenID...

  - [Known Issues](#known-issues)
  - [Urgent Upgrade Notes](#urgent-upgrade-notes-1)
    - [(No, really, you MUST read this before you upgrade)](#no-really-you-must-read-this-before-you-upgrade-1)
      - [Cluster Lifecycle](#cluster-lifecycle)
      - [Storage](#storage)
    - [Deprecations and Removals](#deprecations-and-removals)
    - [Metrics Changes](#metrics-changes)
      - [Added metrics](#added-metrics)

     * resources, however comes at the cost of having to properly release all SmbFile instances you no longer need.
     * 
     * @return whether to use strict resource lifecycle
     */
    boolean isStrictResourceLifecycle ();


    /**
     * This is solely intended for debugging
     * 
     * @return whether to track the locations from which resources were created