// +optional
  repeated PolicyRule rules = 2;
}

// RoleBinding references a role, but does not contain it.  It can reference a Role in the same namespace or a ClusterRole in the global namespace.
// It adds who information via Subjects and namespace information by which namespace it exists in.  RoleBindings in a given
// namespace only have effect in that namespace.
message RoleBinding {
  // Standard object's metadata.

for including it in the “.0” release. Otherwise, the PRs will not be merged until after the release.
* For large fixes (>100 LOC that’s not from generated files), SMEs from that area must also approve the PR.

## Bug Fixes

* Bug fixes will not be merged in until the first release has been published, unless it addresses a critical issue.

s/edit#heading=h.dwbqvwmg6ud3))

When a ztunnel receives traffic (authenticated or not) from a workload, it will forward that traffic to the Waypoint proxy **after** applying any `TRANSPORT` layer policies (i.e. `Authorization`s). Thus, if the destination workload has at least the equivalent of a `STRICT` `PeerAuthentication`, unauthenticated traffic will be rejected before it reaches the Waypoint proxy. If the effective policy is `PERMISSIVE` (the default), the ztunnel will open a vanilla...

	return maps.Clone(p.currentPodCache)
}

// Remove and return the Netns for the given uid
// No need to return NetnsCloser here it will be closed automatically on GC.
// (it may be used in parallel by other parts of the code, so we want it to be used only when not used)
func (p *podNetnsCache) Take(uid string) Netns {
	// lock current pod map
	p.mu.Lock()
	defer p.mu.Unlock()

See the License for the specific language governing permissions and
limitations under the License.
*/


// This file was autogenerated by go-to-protobuf. Do not edit it manually!

syntax = "proto2";

package k8s.io.api.admissionregistration.v1;

import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
import "k8s.io/apimachinery/pkg/runtime/generated.proto";

// of verbs matches the request and (b) at least one member of nonResourceURLs matches the request.
message NonResourcePolicyRule {
  // `verbs` is a list of matching verbs and may not be empty.
  // "*" matches all verbs. If it is present, it must be the only entry.
  // +listType=set
  // Required.
  repeated string verbs = 1;

  // `nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty.
  // For example:

// of verbs matches the request and (b) at least one member of nonResourceURLs matches the request.
message NonResourcePolicyRule {
  // `verbs` is a list of matching verbs and may not be empty.
  // "*" matches all verbs. If it is present, it must be the only entry.
  // +listType=set
  // Required.
  repeated string verbs = 1;

  // `nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty.
  // For example:

# If you're looking at this file in a different repo and want to make a change, please go to the
# common-files repo, make the change there and check it in. Then come back to this repo and run
# "make update-common".

run:
  # Timeout for analysis, e.g. 30s, 5m.
  # Default: 1m
  timeout: 20m
  build-tags:
  - integ
  - integfuzz
linters:
  disable-all: true

  // - "Forbid": forbids concurrent runs, skipping next run if previous run hasn't finished yet;
  // - "Replace": cancels currently running job and replaces it with a new one
  // +optional
  optional string concurrencyPolicy = 3;

  // This flag tells the controller to suspend subsequent executions, it does
  // not apply to already started executions.  Defaults to false.
  // +optional
  optional bool suspend = 4;

	openNetns := s.currentPodSnapshot.Get(string(pod.UID))
	if openNetns != nil {
		return openNetns, nil
	}
	log.Debug("pod netns was not found, trying to find it using procfs")
	// this can happen if the pod was dynamically added to the mesh after it was created.
	// in that case, try finding the netns using procfs.
	if err := s.rescanPod(pod); err != nil {
		log.Errorf("error scanning proc: error was %s", err)