// configuration. We don't have an easy way to allow a pluggable builder to provide its own configuration
        // parameters but this is sufficient for now. Ultimately we want components like Builders to provide a way to
        // extend the command line to accept its own configuration parameters.
        //
        if (context.invokerRequest.options().threads().isPresent()) {

    PULL_REQUEST_FEEDBACK("Pull Request Feedback", "Run various functional tests", "PullRequestFeedback"),
    READY_FOR_NIGHTLY("Ready for Nightly", "Rerun tests in different environments / 3rd party components", "ReadyforNightly"),
    READY_FOR_RELEASE("Ready for Release", "Once a day: Rerun tests in more environments", "ReadyforRelease"),

  optional ContainerResourceMetricSource containerResource = 7;

  // external refers to a global metric that is not associated
  // with any Kubernetes object. It allows autoscaling based on information
  // coming from components running outside of cluster
  // (for example length of queue in cloud messaging service, or
  // QPS from loadbalancer running outside of cluster).
  // +optional
  optional ExternalMetricSource external = 5;
}

         "targets": [
            {
               "datasource": {
                  "type": "prometheus",
                  "uid": "$datasource"
               },
               "expr": "sum by (tag) (istio_build{component=\"pilot\"})",
               "legendFormat": "Version ({{tag}})"
            }
         ],
         "title": "Pilot Versions",
         "type": "timeseries"
      },
      {
         "collapsed": false,

func generateMutatingWebhook(config *tagWebhookConfig, opts *GenerateOptions) (string, error) {
	flags := []string{
		"installPackagePath=" + opts.ManifestsPath,
		"profile=empty",
		"components.pilot.enabled=true",
		"revision=" + config.Revision,
		"values.revisionTags.[0]=" + config.Tag,
		"values.sidecarInjectorWebhook.enableNamespacesByDefault=" + strconv.FormatBool(opts.AutoInjectNamespaces),

Failing to do so can be an availability risk (if we deny traffic that should succeed) or a security risk (if we allow traffic that should be denied).

## High level overview

At a high level, the relevant components look as such:

```mermaid
flowchart TD
    CNIP["CNI Plugin"]
    CNI["CNI Agent"]
    Z["Ztunnel"]
    Pods["Pods"]
    CNI --Programs--> Z
    CNI --Watches--> Pods
    Z --Runs Within--> Pods

1. Check k8s pod namespace against exclusion list (plugin config)
    - Config must exclude namespace that Istio control-plane is installed in (TODO: this may change, exclude at pod level is sufficient and we may want Istiod and other istio components to use ambient too)
    - If excluded, ignore the pod and return prevResult
1. Setup redirect rules for the pods:
    - Get the port list from pods definition, as well as annotations.

#### Figure 2 - KMS key hierarchy

```
                                                          CMK (master key)

		cause:      err,
	}
}

func errParseInvalidPathComponent(err error) *s3Error {
	return &s3Error{
		code:       "ParseInvalidPathComponent",
		message:    "The SQL expression contains an invalid path component.",
		statusCode: 400,
		cause:      err,
	}
}

func errParseMissingIdentAfterAt(err error) *s3Error {
	return &s3Error{
		code:       "ParseMissingIdentAfterAt",

    /**
     * The context this file was opened with
     * 
     * @return the context associated with this file
     */
    CIFSContext getContext ();


    /**
     * Returns the last component of the target URL. This will
     * effectively be the name of the file or directory represented by this
     * <code>SmbResource</code> or in the case of URLs that only specify a server