v1alpha1

type ArchConfig struct {

	// Sets pod scheduling weight for amd64 arch
	Amd64 uint32 `protobuf:"varint,1,opt,name=amd64,proto3" json:"amd64,omitempty"`
	// Sets pod scheduling weight for ppc64le arch.
	Ppc64Le uint32 `protobuf:"varint,2,opt,name=ppc64le,proto3" json:"ppc64le,omitempty"`
	// Sets pod scheduling weight for s390x arch.
	S390X uint32 `protobuf:"varint,3,opt,name=s390x,proto3" json:"s390x,omitempty"`
	// Sets pod scheduling weight for arm64 arch.
	Arm64 uint32 `protobuf:"varint,4,opt,name=arm64,proto3" json:"arm64,omitempty"`
	// contains filtered or unexported fields
}

type BaseConfig struct {

	// For Helm2 use, adds the CRDs to templates.
	EnableCRDTemplates *wrapperspb.BoolValue `protobuf:"bytes,1,opt,name=enableCRDTemplates,proto3" json:"enableCRDTemplates,omitempty"`
	// URL to use for validating webhook.
	ValidationURL string `protobuf:"bytes,2,opt,name=validationURL,proto3" json:"validationURL,omitempty"`
	// For istioctl usage to disable istio config crds in base
	EnableIstioConfigCRDs *wrapperspb.BoolValue `protobuf:"bytes,3,opt,name=enableIstioConfigCRDs,proto3" json:"enableIstioConfigCRDs,omitempty"`
	ValidateGateway       *wrapperspb.BoolValue `protobuf:"bytes,4,opt,name=validateGateway,proto3" json:"validateGateway,omitempty"`
	// validation webhook CA bundle
	ValidationCABundle string `protobuf:"bytes,5,opt,name=validationCABundle,proto3" json:"validationCABundle,omitempty"`
	// contains filtered or unexported fields
}

type CNIAmbientConfig struct {

	// Controls whether ambient redirection is enabled
	Enabled *wrapperspb.BoolValue `protobuf:"bytes,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
	// The directory path containing the configuration files for Ambient. Defaults to /etc/ambient-config.
	ConfigDir string `protobuf:"bytes,3,opt,name=configDir,proto3" json:"configDir,omitempty"`
	// If enabled, and ambient is enabled, DNS redirection will be enabled.
	DnsCapture *wrapperspb.BoolValue `protobuf:"bytes,5,opt,name=dnsCapture,proto3" json:"dnsCapture,omitempty"`
	// contains filtered or unexported fields
}

type CNIConfig struct {

	// Controls whether CNI is installed.
	Enabled *wrapperspb.BoolValue `protobuf:"bytes,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
	// Hub to pull the container image from. Image will be `Hub/Image:Tag-Variant`.
	Hub string `protobuf:"bytes,2,opt,name=hub,proto3" json:"hub,omitempty"`
	// The container image tag to pull. Image will be `Hub/Image:Tag-Variant`.
	Tag *structpb.Value `protobuf:"bytes,3,opt,name=tag,proto3" json:"tag,omitempty"`
	// The container image variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
	Variant string `protobuf:"bytes,29,opt,name=variant,proto3" json:"variant,omitempty"`
	// Image name to pull from. Image will be `Hub/Image:Tag-Variant`.
	// If Image contains a "/", it will replace the entire `image` in the pod.
	Image string `protobuf:"bytes,4,opt,name=image,proto3" json:"image,omitempty"`
	// Specifies the image pull policy. one of Always, Never, IfNotPresent.
	// Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated.
	//
	// More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
	PullPolicy string `protobuf:"bytes,5,opt,name=pullPolicy,proto3" json:"pullPolicy,omitempty"`
	// The directory path within the cluster node's filesystem where the CNI binaries are to be installed. Typically /var/lib/cni/bin.
	CniBinDir string `protobuf:"bytes,6,opt,name=cniBinDir,proto3" json:"cniBinDir,omitempty"`
	// The directory path within the cluster node's filesystem where the CNI configuration files are to be installed. Typically /etc/cni/net.d.
	CniConfDir string `protobuf:"bytes,7,opt,name=cniConfDir,proto3" json:"cniConfDir,omitempty"`
	// The name of the CNI plugin configuration file. Defaults to istio-cni.conf.
	CniConfFileName string `protobuf:"bytes,8,opt,name=cniConfFileName,proto3" json:"cniConfFileName,omitempty"`
	// The directory path within the cluster node's filesystem where network namespaces are located.
	// Defaults to '/var/run/netns', in minikube/docker/others can be '/var/run/docker/netns'.
	CniNetnsDir string `protobuf:"bytes,31,opt,name=cniNetnsDir,proto3" json:"cniNetnsDir,omitempty"`
	// List of namespaces that should be ignored by the CNI plugin.
	ExcludeNamespaces []string `protobuf:"bytes,9,rep,name=excludeNamespaces,proto3" json:"excludeNamespaces,omitempty"`
	// K8s affinity to set on the istio-cni Pods. Can be used to exclude istio-cni from being scheduled on specified nodes.
	Affinity *v1.Affinity `protobuf:"bytes,20,opt,name=affinity,proto3" json:"affinity,omitempty"`
	// Additional annotations to apply to the istio-cni Pods.
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	PodAnnotations *structpb.Struct `protobuf:"bytes,10,opt,name=podAnnotations,proto3" json:"podAnnotations,omitempty"`
	// PodSecurityPolicy cluster role. No longer used anywhere.
	PspClusterRole string `protobuf:"bytes,11,opt,name=psp_cluster_role,json=pspClusterRole,proto3" json:"psp_cluster_role,omitempty"`
	// Configuration log level of istio-cni binary. By default, istio-cni sends all logs to the UDS server.
	// To see the logs, change global.logging.level to cni:debug.
	LogLevel string `protobuf:"bytes,12,opt,name=logLevel,proto3" json:"logLevel,omitempty"`
	// Configuration for the CNI Repair controller.
	Repair *CNIRepairConfig `protobuf:"bytes,13,opt,name=repair,proto3" json:"repair,omitempty"`
	// Configure the plugin as a chained CNI plugin. When true, the configuration is added to the CNI chain; when false,
	// the configuration is added as a standalone file in the CNI configuration directory.
	Chained *wrapperspb.BoolValue `protobuf:"bytes,14,opt,name=chained,proto3" json:"chained,omitempty"`
	// The resource quotas configration for the CNI DaemonSet.
	ResourceQuotas *ResourceQuotas `protobuf:"bytes,16,opt,name=resource_quotas,json=resourceQuotas,proto3" json:"resource_quotas,omitempty"`
	// The k8s resource requests and limits for the istio-cni Pods.
	Resources *Resources `protobuf:"bytes,17,opt,name=resources,proto3" json:"resources,omitempty"`
	// No longer used for CNI. See: https://github.com/istio/istio/issues/49004
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	Privileged *wrapperspb.BoolValue `protobuf:"bytes,18,opt,name=privileged,proto3" json:"privileged,omitempty"`
	// The Container seccompProfile
	//
	// See: https://kubernetes.io/docs/tutorials/security/seccomp/
	SeccompProfile *v1.SeccompProfile `protobuf:"bytes,19,opt,name=seccompProfile,proto3" json:"seccompProfile,omitempty"`
	// Configuration for Istio Ambient.
	Ambient *CNIAmbientConfig `protobuf:"bytes,21,opt,name=ambient,proto3" json:"ambient,omitempty"`
	// Specifies the CNI provider. Can be either "default" or "multus". When set to "multus", an additional
	// NetworkAttachmentDefinition resource is deployed to the cluster to allow the istio-cni plugin to be
	// invoked in a cluster using the Multus CNI plugin.
	Provider string `protobuf:"bytes,22,opt,name=provider,proto3" json:"provider,omitempty"`
	// The number of pods that can be unavailable during a rolling update of the CNI DaemonSet (see
	// `updateStrategy.rollingUpdate.maxUnavailable` here:
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
	// May be specified as a number of pods or as a percent of the total number
	// of pods at the start of the update.
	RollingMaxUnavailable *IntOrString `protobuf:"bytes,23,opt,name=rollingMaxUnavailable,proto3" json:"rollingMaxUnavailable,omitempty"`
	// contains filtered or unexported fields
}

type CNIRepairConfig struct {

	// Controls whether repair behavior is enabled.
	Enabled *wrapperspb.BoolValue `protobuf:"bytes,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
	// Hub to pull the container image from. Image will be `Hub/Image:Tag-Variant`.
	Hub string `protobuf:"bytes,2,opt,name=hub,proto3" json:"hub,omitempty"`
	// The container image tag to pull. Image will be `Hub/Image:Tag-Variant`.
	Tag *structpb.Value `protobuf:"bytes,3,opt,name=tag,proto3" json:"tag,omitempty"`
	// Image name to pull from. Image will be `Hub/Image:Tag-Variant`.
	// If Image contains a "/", it will replace the entire `image` in the pod.
	Image string `protobuf:"bytes,4,opt,name=image,proto3" json:"image,omitempty"`
	// The Repair controller has 3 modes (labelPods, deletePods, and repairPods). Pick which one meets your use cases. Note only one may be used.
	// The mode defines the action the controller will take when a pod is detected as broken.
	// If labelPods is true, the controller will label all broken pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
	// This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
	// Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
	LabelPods bool `protobuf:"varint,5,opt,name=labelPods,proto3" json:"labelPods,omitempty"`
	// The Repair controller has 3 modes (labelPods, deletePods, and repairPods). Pick which one meets your use cases. Note only one may be used.
	// The mode defines the action the controller will take when a pod is detected as broken.
	// If repairPods is true, the controller will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
	// Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
	// This requires no RBAC privilege, but will require the CNI agent to run as a privileged pod.
	RepairPods bool `protobuf:"varint,11,opt,name=repairPods,proto3" json:"repairPods,omitempty"`
	// No longer used.
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	CreateEvents string `protobuf:"bytes,6,opt,name=createEvents,proto3" json:"createEvents,omitempty"`
	// The Repair controller has 3 modes (labelPods, deletePods, and repairPods). Pick which one meets your use cases. Note only one may be used.
	// The mode defines the action the controller will take when a pod is detected as broken.
	// If deletePods is true, the controller will delete the broken pod. The pod will then be rescheduled, hopefully onto a node that is fully ready.
	// Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
	DeletePods bool `protobuf:"varint,7,opt,name=deletePods,proto3" json:"deletePods,omitempty"`
	// The label key to apply to a broken pod when the controller is in labelPods mode.
	BrokenPodLabelKey string `protobuf:"bytes,8,opt,name=brokenPodLabelKey,proto3" json:"brokenPodLabelKey,omitempty"`
	// The label value to apply to a broken pod when the controller is in labelPods mode.
	BrokenPodLabelValue string `protobuf:"bytes,9,opt,name=brokenPodLabelValue,proto3" json:"brokenPodLabelValue,omitempty"`
	// The name of the init container to use for the repairPods mode.
	InitContainerName string `protobuf:"bytes,10,opt,name=initContainerName,proto3" json:"initContainerName,omitempty"`
	// contains filtered or unexported fields
}

type CNIUsageConfig struct {

	// Controls whether CNI should be used.
	Enabled *wrapperspb.BoolValue `protobuf:"bytes,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	Chained *wrapperspb.BoolValue `protobuf:"bytes,2,opt,name=chained,proto3" json:"chained,omitempty"`
	// Specifies the CNI provider. Can be either "default" or "multus". When set to "multus", an annotation
	// `k8s.v1.cni.cncf.io/networks` is set on injected pods to point to a NetworkAttachmentDefinition
	Provider string `protobuf:"bytes,3,opt,name=provider,proto3" json:"provider,omitempty"`
	// contains filtered or unexported fields
}

type DefaultPodDisruptionBudgetConfig struct {

	// Controls whether a PodDisruptionBudget with a default minAvailable value of 1 is created for each deployment.
	Enabled *wrapperspb.BoolValue `protobuf:"bytes,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
	// contains filtered or unexported fields
}

type DefaultResourcesConfig struct {

	// k8s resources settings.
	//
	// See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container
	Requests *ResourcesRequestsConfig `protobuf:"bytes,1,opt,name=requests,proto3" json:"requests,omitempty"`
	// contains filtered or unexported fields
}

type EgressGatewayConfig struct {

	// Controls whether auto scaling with a HorizontalPodAutoscaler is enabled.
	AutoscaleEnabled *wrapperspb.BoolValue `protobuf:"bytes,1,opt,name=autoscaleEnabled,proto3" json:"autoscaleEnabled,omitempty"`
	// maxReplicas setting for HorizontalPodAutoscaler.
	AutoscaleMax uint32 `protobuf:"varint,2,opt,name=autoscaleMax,proto3" json:"autoscaleMax,omitempty"`
	// minReplicas setting for HorizontalPodAutoscaler.
	AutoscaleMin uint32 `protobuf:"varint,3,opt,name=autoscaleMin,proto3" json:"autoscaleMin,omitempty"`
	// K8s memory utilization setting for HorizontalPodAutoscaler target.
	//
	// See https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	Memory *TargetUtilizationConfig `protobuf:"bytes,4,opt,name=memory,proto3" json:"memory,omitempty"`
	// K8s utilization setting for HorizontalPodAutoscaler target.
	//
	// See https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	Cpu           *TargetUtilizationConfig `protobuf:"bytes,5,opt,name=cpu,proto3" json:"cpu,omitempty"`
	CustomService *wrapperspb.BoolValue    `protobuf:"bytes,6,opt,name=customService,proto3" json:"customService,omitempty"`
	// Controls whether an egress gateway is enabled.
	Enabled *wrapperspb.BoolValue `protobuf:"bytes,7,opt,name=enabled,proto3" json:"enabled,omitempty"`
	// Environment variables passed to the proxy container.
	Env    *structpb.Struct  `protobuf:"bytes,8,opt,name=env,proto3" json:"env,omitempty"`
	Labels map[string]string `` /* 153-byte string literal not displayed */
	Name   string            `protobuf:"bytes,25,opt,name=name,proto3" json:"name,omitempty"`
	// K8s node selector.
	//
	// See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	NodeSelector *structpb.Struct `protobuf:"bytes,10,opt,name=nodeSelector,proto3" json:"nodeSelector,omitempty"`
	// K8s annotations for pods.
	//
	// See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	PodAnnotations *structpb.Struct `protobuf:"bytes,11,opt,name=podAnnotations,proto3" json:"podAnnotations,omitempty"`
	// Pod anti-affinity label selector.
	//
	// Specify the pod anti-affinity that allows you to constrain which nodes
	// your pod is eligible to be scheduled based on labels on pods that are
	// already running on the node rather than based on labels on nodes.
	// There are currently two types of anti-affinity:
	//
	//	"requiredDuringSchedulingIgnoredDuringExecution"
	//	"preferredDuringSchedulingIgnoredDuringExecution"
	//
	// which denote “hard” vs. “soft” requirements, you can define your values
	// in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
	// correspondingly.
	// See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
	//
	// Examples:
	// podAntiAffinityLabelSelector:
	//   - key: security
	//     operator: In
	//     values: S1,S2
	//     topologyKey: "kubernetes.io/hostname"
	//     This pod anti-affinity rule says that the pod requires not to be scheduled
	//     onto a node if that node is already running a pod with label having key
	//     “security” and value “S1”.
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	PodAntiAffinityLabelSelector []*v11.LabelSelector `protobuf:"bytes,12,rep,name=podAntiAffinityLabelSelector,proto3" json:"podAntiAffinityLabelSelector,omitempty"`
	// See PodAntiAffinityLabelSelector.
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	PodAntiAffinityTermLabelSelector []*v11.LabelSelector `protobuf:"bytes,13,rep,name=podAntiAffinityTermLabelSelector,proto3" json:"podAntiAffinityTermLabelSelector,omitempty"`
	// Ports Configuration for the egress gateway service.
	Ports []*PortsConfig `protobuf:"bytes,14,rep,name=ports,proto3" json:"ports,omitempty"`
	// K8s resources settings.
	//
	// See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	Resources *Resources `protobuf:"bytes,15,opt,name=resources,proto3" json:"resources,omitempty"`
	// Config for secret volume mounts.
	SecretVolumes []*SecretVolume `protobuf:"bytes,16,rep,name=secretVolumes,proto3" json:"secretVolumes,omitempty"`
	// Annotations to add to the egress gateway service.
	ServiceAnnotations *structpb.Struct `protobuf:"bytes,17,opt,name=serviceAnnotations,proto3" json:"serviceAnnotations,omitempty"`
	// Service type.
	//
	// See https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
	Type string `protobuf:"bytes,18,opt,name=type,proto3" json:"type,omitempty"`
	// Enables cross-cluster access using SNI matching.
	Zvpn *ZeroVPNConfig `protobuf:"bytes,19,opt,name=zvpn,proto3" json:"zvpn,omitempty"`
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	Tolerations []*v1.Toleration `protobuf:"bytes,20,rep,name=tolerations,proto3" json:"tolerations,omitempty"`
	// K8s rolling update strategy
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	RollingMaxSurge *IntOrString `protobuf:"bytes,21,opt,name=rollingMaxSurge,proto3" json:"rollingMaxSurge,omitempty"`
	// The number of pods that can be unavailable during a rolling update (see
	// `strategy.rollingUpdate.maxUnavailable` here:
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/deployment-v1/#DeploymentSpec).
	// May be specified as a number of pods or as a percent of the total number
	// of pods at the start of the update.
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	RollingMaxUnavailable *IntOrString          `protobuf:"bytes,22,opt,name=rollingMaxUnavailable,proto3" json:"rollingMaxUnavailable,omitempty"`
	ConfigVolumes         []*structpb.Struct    `protobuf:"bytes,23,rep,name=configVolumes,proto3" json:"configVolumes,omitempty"`
	AdditionalContainers  []*structpb.Struct    `protobuf:"bytes,24,rep,name=additionalContainers,proto3" json:"additionalContainers,omitempty"`
	RunAsRoot             *wrapperspb.BoolValue `protobuf:"bytes,26,opt,name=runAsRoot,proto3" json:"runAsRoot,omitempty"`
	// The injection template to use for the gateway. If not set, no injection will be performed.
	InjectionTemplate string          `protobuf:"bytes,27,opt,name=injectionTemplate,proto3" json:"injectionTemplate,omitempty"`
	ServiceAccount    *ServiceAccount `protobuf:"bytes,28,opt,name=serviceAccount,proto3" json:"serviceAccount,omitempty"`
	// Defines which IP family to use for single stack or the order of IP families for dual-stack.
	// Valid list items are "IPv4", "IPv6".
	// More info: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
	IpFamilies []string `protobuf:"bytes,29,rep,name=ipFamilies,proto3" json:"ipFamilies,omitempty"`
	// Controls whether Services are configured to use IPv4, IPv6, or both. Valid options
	// are PreferDualStack, RequireDualStack, and SingleStack.
	// More info: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
	IpFamilyPolicy string `protobuf:"bytes,30,opt,name=ipFamilyPolicy,proto3" json:"ipFamilyPolicy,omitempty"` // Next available 31.
	// contains filtered or unexported fields
}

type GatewaysConfig struct {

	// Configuration for an egress gateway.
	IstioEgressgateway *EgressGatewayConfig `protobuf:"bytes,1,opt,name=istio_egressgateway,json=istio-egressgateway,proto3" json:"istio_egressgateway,omitempty"`
	// Controls whether any gateways are enabled.
	Enabled *wrapperspb.BoolValue `protobuf:"bytes,2,opt,name=enabled,proto3" json:"enabled,omitempty"`
	// Configuration for an ingress gateway.
	IstioIngressgateway *IngressGatewayConfig `protobuf:"bytes,4,opt,name=istio_ingressgateway,json=istio-ingressgateway,proto3" json:"istio_ingressgateway,omitempty"`
	// contains filtered or unexported fields
}

type GlobalConfig struct {

	// Specifies pod scheduling arch(amd64, ppc64le, s390x, arm64) and weight as follows:
	//
	//	0 - Never scheduled
	//	1 - Least preferred
	//	2 - No preference
	//	3 - Most preferred
	//
	// Deprecated: replaced by the affinity k8s settings which allows architecture nodeAffinity configuration of this behavior.
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	Arch *ArchConfig `protobuf:"bytes,1,opt,name=arch,proto3" json:"arch,omitempty"`
	// List of certSigners to allow "approve" action in the ClusterRole
	CertSigners []string `protobuf:"bytes,68,rep,name=certSigners,proto3" json:"certSigners,omitempty"`
	// TODO: remove this?
	// No longer used.
	ConfigRootNamespace string `protobuf:"bytes,50,opt,name=configRootNamespace,proto3" json:"configRootNamespace,omitempty"`
	// Controls whether the server-side validation is enabled.
	ConfigValidation *wrapperspb.BoolValue `protobuf:"bytes,3,opt,name=configValidation,proto3" json:"configValidation,omitempty"`
	// TODO: remove this?
	// No longer used.
	DefaultConfigVisibilitySettings []string `protobuf:"bytes,52,rep,name=defaultConfigVisibilitySettings,proto3" json:"defaultConfigVisibilitySettings,omitempty"`
	// Default k8s node selector for all the Istio control plane components
	//
	// See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	DefaultNodeSelector *structpb.Struct `protobuf:"bytes,6,opt,name=defaultNodeSelector,proto3" json:"defaultNodeSelector,omitempty"`
	// Specifies the default pod disruption budget configuration.
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	DefaultPodDisruptionBudget *DefaultPodDisruptionBudgetConfig `protobuf:"bytes,7,opt,name=defaultPodDisruptionBudget,proto3" json:"defaultPodDisruptionBudget,omitempty"`
	// Default k8s resources settings for all Istio control plane components.
	//
	// See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	DefaultResources *DefaultResourcesConfig `protobuf:"bytes,9,opt,name=defaultResources,proto3" json:"defaultResources,omitempty"`
	// Default node tolerations to be applied to all deployments so that all pods can be
	// scheduled to nodes with matching taints. Each component can overwrite
	// these default values by adding its tolerations block in the relevant section below
	// and setting the desired values.
	// Configure this field in case that all pods of Istio control plane are expected to
	// be scheduled to particular nodes with specified taints.
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	DefaultTolerations []*v1.Toleration `protobuf:"bytes,55,rep,name=defaultTolerations,proto3" json:"defaultTolerations,omitempty"`
	// Specifies the docker hub for Istio images.
	Hub string `protobuf:"bytes,12,opt,name=hub,proto3" json:"hub,omitempty"`
	// Specifies the image pull policy for the Istio images. one of Always, Never, IfNotPresent.
	// Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated.
	//
	// More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
	ImagePullPolicy string `protobuf:"bytes,13,opt,name=imagePullPolicy,proto3" json:"imagePullPolicy,omitempty"`
	// ImagePullSecrets for the control plane ServiceAccount, list of secrets in the same namespace
	// to use for pulling any images in pods that reference this ServiceAccount.
	// Must be set for any cluster configured with private docker registry.
	ImagePullSecrets []string `protobuf:"bytes,37,rep,name=imagePullSecrets,proto3" json:"imagePullSecrets,omitempty"`
	// Specifies the default namespace for the Istio control plane components.
	IstioNamespace string `protobuf:"bytes,14,opt,name=istioNamespace,proto3" json:"istioNamespace,omitempty"`
	// Specifies whether istio components should output logs in json format by adding --log_as_json argument to each container.
	LogAsJson *wrapperspb.BoolValue `protobuf:"bytes,36,opt,name=logAsJson,proto3" json:"logAsJson,omitempty"`
	// Specifies the global logging level settings for the Istio control plane components.
	Logging *GlobalLoggingConfig `protobuf:"bytes,17,opt,name=logging,proto3" json:"logging,omitempty"`
	// The Mesh Identifier. It should be unique within the scope where
	// meshes will interact with each other, but it is not required to be
	// globally/universally unique. For example, if any of the following are true,
	// then two meshes must have different Mesh IDs:
	// - Meshes will have their telemetry aggregated in one place
	// - Meshes will be federated together
	// - Policy will be written referencing one mesh from the other
	//
	// If an administrator expects that any of these conditions may become true in
	// the future, they should ensure their meshes have different Mesh IDs
	// assigned.
	//
	// Within a multicluster mesh, each cluster must be (manually or auto)
	// configured to have the same Mesh ID value. If an existing cluster 'joins' a
	// multicluster mesh, it will need to be migrated to the new mesh ID. Details
	// of migration TBD, and it may be a disruptive operation to change the Mesh
	// ID post-install.
	//
	// If the mesh admin does not specify a value, Istio will use the value of the
	// mesh's Trust Domain. The best practice is to select a proper Trust Domain
	// value.
	MeshID string `protobuf:"bytes,53,opt,name=meshID,proto3" json:"meshID,omitempty"`
	// Configure the mesh networks to be used by the Split Horizon EDS.
	//
	// The following example defines two networks with different endpoints association methods.
	// For `network1` all endpoints that their IP belongs to the provided CIDR range will be
	// mapped to network1. The gateway for this network example is specified by its public IP
	// address and port.
	// The second network, `network2`, in this example is defined differently with all endpoints
	// retrieved through the specified Multi-Cluster registry being mapped to network2. The
	// gateway is also defined differently with the name of the gateway service on the remote
	// cluster. The public IP for the gateway will be determined from that remote service (only
	// LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
	// it still need to be configured manually).
	//
	// meshNetworks:
	//
	//	network1:
	//	  endpoints:
	//	  - fromCidr: "192.168.0.1/24"
	//	  gateways:
	//	  - address: 1.1.1.1
	//	    port: 80
	//	network2:
	//	  endpoints:
	//	  - fromRegistry: reg1
	//	  gateways:
	//	  - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
	//	    port: 443
	MeshNetworks *structpb.Struct `protobuf:"bytes,19,opt,name=meshNetworks,proto3" json:"meshNetworks,omitempty"`
	// Specifies the Configuration for Istio mesh across multiple clusters through Istio gateways.
	MultiCluster *MultiClusterConfig `protobuf:"bytes,22,opt,name=multiCluster,proto3" json:"multiCluster,omitempty"`
	// Network defines the network this cluster belong to. This name
	// corresponds to the networks in the map of mesh networks.
	Network string `protobuf:"bytes,39,opt,name=network,proto3" json:"network,omitempty"`
	// Custom DNS config for the pod to resolve names of services in other
	// clusters. Use this to add additional search domains, and other settings.
	// see https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
	// This does not apply to gateway pods as they typically need a different
	// set of DNS settings than the normal application pods (e.g. in multicluster scenarios).
	PodDNSSearchNamespaces []string `protobuf:"bytes,43,rep,name=podDNSSearchNamespaces,proto3" json:"podDNSSearchNamespaces,omitempty"`
	// Controls whether the creation of the sidecar injector ConfigMap should be skipped.
	// Defaults to false. When set to true, the sidecar injector ConfigMap will not be created.
	OmitSidecarInjectorConfigMap *wrapperspb.BoolValue `protobuf:"bytes,38,opt,name=omitSidecarInjectorConfigMap,proto3" json:"omitSidecarInjectorConfigMap,omitempty"`
	// Controls whether the WebhookConfiguration resource(s) should be created. The current behavior
	// of Istiod is to manage its own webhook configurations.
	// When this option is set to true, Istio Operator, instead of webhooks, manages the
	// webhook configurations. When this option is set as false, webhooks manage their
	// own webhook configurations.
	OperatorManageWebhooks *wrapperspb.BoolValue `protobuf:"bytes,41,opt,name=operatorManageWebhooks,proto3" json:"operatorManageWebhooks,omitempty"`
	// Specifies the k8s priorityClassName for the istio control plane components.
	//
	// See https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	PriorityClassName string `protobuf:"bytes,27,opt,name=priorityClassName,proto3" json:"priorityClassName,omitempty"`
	// Specifies how proxies are configured within Istio.
	Proxy *ProxyConfig `protobuf:"bytes,28,opt,name=proxy,proto3" json:"proxy,omitempty"`
	// Specifies the Configuration for proxy_init container which sets the pods' networking to intercept the inbound/outbound traffic.
	ProxyInit *ProxyInitConfig `protobuf:"bytes,29,opt,name=proxy_init,proto3" json:"proxy_init,omitempty"`
	// Specifies the Configuration for the SecretDiscoveryService instead of using K8S secrets to mount the certificates.
	Sds *SDSConfig `protobuf:"bytes,30,opt,name=sds,proto3" json:"sds,omitempty"`
	// Specifies the tag for the Istio docker images.
	Tag *structpb.Value `protobuf:"bytes,31,opt,name=tag,proto3" json:"tag,omitempty"`
	// The variant of the Istio container images to use. Options are "debug" or "distroless". Unset will use the default for the given version.
	Variant string `protobuf:"bytes,67,opt,name=variant,proto3" json:"variant,omitempty"`
	// Specifies the Configuration for each of the supported tracers.
	Tracer *TracerConfig `protobuf:"bytes,33,opt,name=tracer,proto3" json:"tracer,omitempty"`
	// Controls whether to use of Mesh Configuration Protocol to distribute configuration.
	UseMCP *wrapperspb.BoolValue `protobuf:"bytes,35,opt,name=useMCP,proto3" json:"useMCP,omitempty"`
	// Specifies the Istio control plane’s pilot Pod IP address or remote cluster DNS resolvable hostname.
	RemotePilotAddress string `protobuf:"bytes,48,opt,name=remotePilotAddress,proto3" json:"remotePilotAddress,omitempty"`
	// Specifies the configution of istiod
	Istiod *IstiodConfig `protobuf:"bytes,54,opt,name=istiod,proto3" json:"istiod,omitempty"`
	// Configure the Pilot certificate provider.
	// Currently, four providers are supported: "kubernetes", "istiod", "custom" and "none".
	PilotCertProvider string `protobuf:"bytes,56,opt,name=pilotCertProvider,proto3" json:"pilotCertProvider,omitempty"`
	// Configure the policy for validating JWT.
	// This is deprecated and has no effect.
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	JwtPolicy string `protobuf:"bytes,57,opt,name=jwtPolicy,proto3" json:"jwtPolicy,omitempty"`
	// Specifies the configuration for Security Token Service.
	Sts *STSConfig `protobuf:"bytes,58,opt,name=sts,proto3" json:"sts,omitempty"`
	// Configures the revision this control plane is a part of
	Revision string `protobuf:"bytes,59,opt,name=revision,proto3" json:"revision,omitempty"`
	// Controls whether the in-cluster MTLS key and certs are loaded from the secret volume mounts.
	MountMtlsCerts *wrapperspb.BoolValue `protobuf:"bytes,60,opt,name=mountMtlsCerts,proto3" json:"mountMtlsCerts,omitempty"`
	// The address of the CA for CSR.
	CaAddress string `protobuf:"bytes,61,opt,name=caAddress,proto3" json:"caAddress,omitempty"`
	// Controls whether one external istiod is enabled.
	ExternalIstiod *wrapperspb.BoolValue `protobuf:"bytes,62,opt,name=externalIstiod,proto3" json:"externalIstiod,omitempty"`
	// Controls whether a remote cluster is the config cluster for an external istiod
	ConfigCluster *wrapperspb.BoolValue `protobuf:"bytes,64,opt,name=configCluster,proto3" json:"configCluster,omitempty"`
	// The name of the CA for workloads.
	// For example, when caName=GkeWorkloadCertificate, GKE workload certificates
	// will be used as the certificates for workloads.
	// The default value is "" and when caName="", the CA will be configured by other
	// mechanisms (e.g., environmental variable CA_PROVIDER).
	CaName string `protobuf:"bytes,65,opt,name=caName,proto3" json:"caName,omitempty"`
	// TODO: remove this?
	// No longer used.
	Autoscalingv2API *wrapperspb.BoolValue `protobuf:"bytes,66,opt,name=autoscalingv2API,proto3" json:"autoscalingv2API,omitempty"`
	// Platform in which Istio is deployed. Possible values are: "openshift" and "gcp"
	// An empty value means it is a vanilla Kubernetes distribution, therefore no special
	// treatment will be considered.
	Platform string `protobuf:"bytes,69,opt,name=platform,proto3" json:"platform,omitempty"`
	// Defines which IP family to use for single stack or the order of IP families for dual-stack.
	// Valid list items are "IPv4", "IPv6".
	// More info: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
	IpFamilies []string `protobuf:"bytes,70,rep,name=ipFamilies,proto3" json:"ipFamilies,omitempty"`
	// Controls whether Services are configured to use IPv4, IPv6, or both. Valid options
	// are PreferDualStack, RequireDualStack, and SingleStack.
	// More info: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
	IpFamilyPolicy string `protobuf:"bytes,71,opt,name=ipFamilyPolicy,proto3" json:"ipFamilyPolicy,omitempty"` // The next available key is 72
	// contains filtered or unexported fields
}

type GlobalLoggingConfig struct {

	// Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
	// The control plane has different scopes depending on component, but can configure default log level across all components
	// If empty, default scope and level will be used as configured in code
	Level string `protobuf:"bytes,1,opt,name=level,proto3" json:"level,omitempty"`
	// contains filtered or unexported fields
}

type IngressControllerMode int32

type IngressGatewayConfig struct {

	// Controls whether auto scaling with a HorizontalPodAutoscaler is enabled.
	AutoscaleEnabled *wrapperspb.BoolValue `protobuf:"bytes,1,opt,name=autoscaleEnabled,proto3" json:"autoscaleEnabled,omitempty"`
	// maxReplicas setting for HorizontalPodAutoscaler.
	AutoscaleMax uint32 `protobuf:"varint,2,opt,name=autoscaleMax,proto3" json:"autoscaleMax,omitempty"`
	// minReplicas setting for HorizontalPodAutoscaler.
	AutoscaleMin uint32 `protobuf:"varint,3,opt,name=autoscaleMin,proto3" json:"autoscaleMin,omitempty"`
	// K8s memory utilization setting for HorizontalPodAutoscaler target.
	//
	// See https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	Memory *TargetUtilizationConfig `protobuf:"bytes,4,opt,name=memory,proto3" json:"memory,omitempty"`
	// K8s cpu utilization setting for HorizontalPodAutoscaler target.
	//
	// See https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	Cpu           *TargetUtilizationConfig `protobuf:"bytes,5,opt,name=cpu,proto3" json:"cpu,omitempty"`
	CustomService *wrapperspb.BoolValue    `protobuf:"bytes,6,opt,name=customService,proto3" json:"customService,omitempty"`
	// Controls whether an ingress gateway is enabled.
	Enabled *wrapperspb.BoolValue `protobuf:"bytes,10,opt,name=enabled,proto3" json:"enabled,omitempty"`
	// Environment variables passed to the proxy container.
	Env                      *structpb.Struct  `protobuf:"bytes,11,opt,name=env,proto3" json:"env,omitempty"`
	Labels                   map[string]string `` /* 154-byte string literal not displayed */
	LoadBalancerIP           string            `protobuf:"bytes,16,opt,name=loadBalancerIP,proto3" json:"loadBalancerIP,omitempty"`
	LoadBalancerSourceRanges []string          `protobuf:"bytes,17,rep,name=loadBalancerSourceRanges,proto3" json:"loadBalancerSourceRanges,omitempty"`
	Name                     string            `protobuf:"bytes,44,opt,name=name,proto3" json:"name,omitempty"`
	// K8s node selector.
	//
	// See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	NodeSelector *structpb.Struct `protobuf:"bytes,19,opt,name=nodeSelector,proto3" json:"nodeSelector,omitempty"`
	// K8s annotations for pods.
	//
	// See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	PodAnnotations *structpb.Struct `protobuf:"bytes,20,opt,name=podAnnotations,proto3" json:"podAnnotations,omitempty"`
	// See EgressGatewayConfig.
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	PodAntiAffinityLabelSelector []*v11.LabelSelector `protobuf:"bytes,21,rep,name=podAntiAffinityLabelSelector,proto3" json:"podAntiAffinityLabelSelector,omitempty"`
	// See EgressGatewayConfig.
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	PodAntiAffinityTermLabelSelector []*v11.LabelSelector `protobuf:"bytes,22,rep,name=podAntiAffinityTermLabelSelector,proto3" json:"podAntiAffinityTermLabelSelector,omitempty"`
	// Port Configuration for the ingress gateway.
	Ports []*PortsConfig `protobuf:"bytes,23,rep,name=ports,proto3" json:"ports,omitempty"`
	// Number of replicas for the ingress gateway Deployment.
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	ReplicaCount uint32 `protobuf:"varint,24,opt,name=replicaCount,proto3" json:"replicaCount,omitempty"`
	// K8s resources settings.
	//
	// See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	Resources *structpb.Struct `protobuf:"bytes,25,opt,name=resources,proto3" json:"resources,omitempty"`
	// Config for secret volume mounts.
	SecretVolumes []*SecretVolume `protobuf:"bytes,27,rep,name=secretVolumes,proto3" json:"secretVolumes,omitempty"`
	// Annotations to add to the egress gateway service.
	ServiceAnnotations *structpb.Struct `protobuf:"bytes,28,opt,name=serviceAnnotations,proto3" json:"serviceAnnotations,omitempty"`
	// Service type.
	//
	// See https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
	Type string `protobuf:"bytes,29,opt,name=type,proto3" json:"type,omitempty"`
	// Enables cross-cluster access using SNI matching.
	Zvpn *IngressGatewayZvpnConfig `protobuf:"bytes,30,opt,name=zvpn,proto3" json:"zvpn,omitempty"`
	// K8s rolling update strategy
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	RollingMaxSurge *IntOrString `protobuf:"bytes,31,opt,name=rollingMaxSurge,proto3" json:"rollingMaxSurge,omitempty"`
	// The number of pods that can be unavailable during a rolling update (see
	// `strategy.rollingUpdate.maxUnavailable` here:
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/deployment-v1/#DeploymentSpec).
	// May be specified as a number of pods or as a percent of the total number
	// of pods at the start of the update.
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	RollingMaxUnavailable *IntOrString `protobuf:"bytes,32,opt,name=rollingMaxUnavailable,proto3" json:"rollingMaxUnavailable,omitempty"`
	ExternalTrafficPolicy string       `protobuf:"bytes,34,opt,name=externalTrafficPolicy,proto3" json:"externalTrafficPolicy,omitempty"`
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	Tolerations          []*v1.Toleration      `protobuf:"bytes,35,rep,name=tolerations,proto3" json:"tolerations,omitempty"`
	IngressPorts         []*structpb.Struct    `protobuf:"bytes,36,rep,name=ingressPorts,proto3" json:"ingressPorts,omitempty"`
	AdditionalContainers []*structpb.Struct    `protobuf:"bytes,37,rep,name=additionalContainers,proto3" json:"additionalContainers,omitempty"`
	ConfigVolumes        []*structpb.Struct    `protobuf:"bytes,38,rep,name=configVolumes,proto3" json:"configVolumes,omitempty"`
	RunAsRoot            *wrapperspb.BoolValue `protobuf:"bytes,45,opt,name=runAsRoot,proto3" json:"runAsRoot,omitempty"`
	// The injection template to use for the gateway. If not set, no injection will be performed.
	InjectionTemplate string          `protobuf:"bytes,46,opt,name=injectionTemplate,proto3" json:"injectionTemplate,omitempty"`
	ServiceAccount    *ServiceAccount `protobuf:"bytes,47,opt,name=serviceAccount,proto3" json:"serviceAccount,omitempty"`
	// Defines which IP family to use for single stack or the order of IP families for dual-stack.
	// Valid list items are "IPv4", "IPv6".
	// More info: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
	IpFamilies []string `protobuf:"bytes,48,rep,name=ipFamilies,proto3" json:"ipFamilies,omitempty"`
	// Controls whether Services are configured to use IPv4, IPv6, or both. Valid options
	// are PreferDualStack, RequireDualStack, and SingleStack.
	// More info: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
	IpFamilyPolicy string `protobuf:"bytes,49,opt,name=ipFamilyPolicy,proto3" json:"ipFamilyPolicy,omitempty"` // Next available 50.
	// contains filtered or unexported fields
}

type IngressGatewayZvpnConfig struct {

	// Controls whether ZeroVPN is enabled.
	Enabled *wrapperspb.BoolValue `protobuf:"bytes,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
	Suffix  string                `protobuf:"bytes,2,opt,name=suffix,proto3" json:"suffix,omitempty"`
	// contains filtered or unexported fields
}

type IntOrString struct {
	Type   int64                   `protobuf:"varint,1,opt,name=type,proto3" json:"type,omitempty"`
	IntVal *wrapperspb.Int32Value  `protobuf:"bytes,2,opt,name=intVal,proto3" json:"intVal,omitempty"`
	StrVal *wrapperspb.StringValue `protobuf:"bytes,3,opt,name=strVal,proto3" json:"strVal,omitempty"`
	// contains filtered or unexported fields
}

type IstioOperator struct {
	metav1.TypeMeta `json:",inline"`
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	// Spec defines the implementation of this definition.
	// +optional
	Spec *operatorv1alpha1.IstioOperatorSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`

	Status *operatorv1alpha1.InstallStatus `json:"status,omitempty"`
}

type IstioOperatorList struct {
	metav1.TypeMeta `json:",inline"`
	// +optional
	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
	Items           []IstioOperator `json:"items" protobuf:"bytes,2,rep,name=items"`
}

type IstiodConfig struct {

	// If enabled, istiod will perform config analysis
	EnableAnalysis *wrapperspb.BoolValue `protobuf:"bytes,2,opt,name=enableAnalysis,proto3" json:"enableAnalysis,omitempty"`
	// contains filtered or unexported fields
}

type IstiodRemoteConfig struct {

	// URL to use for sidecar injector webhook.
	InjectionURL string `protobuf:"bytes,1,opt,name=injectionURL,proto3" json:"injectionURL,omitempty"`
	// Path to use for the sidecar injector webhook service.
	InjectionPath string `protobuf:"bytes,2,opt,name=injectionPath,proto3" json:"injectionPath,omitempty"`
	// injector ca bundle
	InjectionCABundle string `protobuf:"bytes,3,opt,name=injectionCABundle,proto3" json:"injectionCABundle,omitempty"`
	// contains filtered or unexported fields
}

type MultiClusterConfig struct {

	// Enables the connection between two kubernetes clusters via their respective ingressgateway services.
	// Use if the pods in each cluster cannot directly talk to one another.
	Enabled *wrapperspb.BoolValue `protobuf:"bytes,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
	// The name of the cluster this installation will run in. This is required for sidecar injection
	// to properly label proxies
	ClusterName string `protobuf:"bytes,2,opt,name=clusterName,proto3" json:"clusterName,omitempty"`
	// The suffix for global service names.
	GlobalDomainSuffix string `protobuf:"bytes,3,opt,name=globalDomainSuffix,proto3" json:"globalDomainSuffix,omitempty"`
	// Enable envoy filter to translate `globalDomainSuffix` to cluster local suffix for cross cluster communication.
	IncludeEnvoyFilter *wrapperspb.BoolValue `protobuf:"bytes,4,opt,name=includeEnvoyFilter,proto3" json:"includeEnvoyFilter,omitempty"`
	// contains filtered or unexported fields
}

type OutboundTrafficPolicyConfig struct {
	Mode OutboundTrafficPolicyConfig_Mode `protobuf:"varint,2,opt,name=mode,proto3,enum=v1alpha1.OutboundTrafficPolicyConfig_Mode" json:"mode,omitempty"`
	// contains filtered or unexported fields
}

type OutboundTrafficPolicyConfig_Mode int32

type PilotConfig struct {

	// Controls whether Pilot is enabled.
	Enabled *wrapperspb.BoolValue `protobuf:"bytes,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
	// Controls whether a HorizontalPodAutoscaler is installed for Pilot.
	AutoscaleEnabled *wrapperspb.BoolValue `protobuf:"bytes,2,opt,name=autoscaleEnabled,proto3" json:"autoscaleEnabled,omitempty"`
	// Minimum number of replicas in the HorizontalPodAutoscaler for Pilot.
	AutoscaleMin uint32 `protobuf:"varint,3,opt,name=autoscaleMin,proto3" json:"autoscaleMin,omitempty"`
	// Maximum number of replicas in the HorizontalPodAutoscaler for Pilot.
	AutoscaleMax uint32 `protobuf:"varint,4,opt,name=autoscaleMax,proto3" json:"autoscaleMax,omitempty"`
	// See https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#configurable-scaling-behavior
	AutoscaleBehavior *structpb.Struct `protobuf:"bytes,40,opt,name=autoscaleBehavior,proto3" json:"autoscaleBehavior,omitempty"`
	// Number of replicas in the Pilot Deployment.
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	ReplicaCount uint32 `protobuf:"varint,5,opt,name=replicaCount,proto3" json:"replicaCount,omitempty"`
	// Image name used for Pilot.
	//
	// This can be set either to image name if hub is also set, or can be set to the full hub:name string.
	//
	// Examples: custom-pilot, docker.io/someuser:custom-pilot
	Image string `protobuf:"bytes,6,opt,name=image,proto3" json:"image,omitempty"`
	// Trace sampling fraction.
	//
	// Used to set the fraction of time that traces are sampled. Higher values are more accurate but add CPU overhead.
	//
	// Allowed values: 0.0 to 1.0
	TraceSampling float64 `protobuf:"fixed64,8,opt,name=traceSampling,proto3" json:"traceSampling,omitempty"`
	// K8s resources settings.
	//
	// See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	Resources *Resources `protobuf:"bytes,9,opt,name=resources,proto3" json:"resources,omitempty"`
	// Namespace that the configuration management feature is installed into, if different from Pilot namespace.
	ConfigNamespace string `protobuf:"bytes,10,opt,name=configNamespace,proto3" json:"configNamespace,omitempty"`
	// Target CPU utilization used in HorizontalPodAutoscaler.
	//
	// See https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	Cpu *TargetUtilizationConfig `protobuf:"bytes,11,opt,name=cpu,proto3" json:"cpu,omitempty"`
	// K8s node selector.
	//
	// See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	NodeSelector *structpb.Struct `protobuf:"bytes,12,opt,name=nodeSelector,proto3" json:"nodeSelector,omitempty"`
	// Maximum duration that a sidecar can be connected to a pilot.
	//
	// This setting balances out load across pilot instances, but adds some resource overhead.
	//
	// Examples: 300s, 30m, 1h
	KeepaliveMaxServerConnectionAge *durationpb.Duration `protobuf:"bytes,13,opt,name=keepaliveMaxServerConnectionAge,proto3" json:"keepaliveMaxServerConnectionAge,omitempty"`
	// Labels that are added to Pilot deployment.
	//
	// See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
	DeploymentLabels *structpb.Struct `protobuf:"bytes,14,opt,name=deploymentLabels,proto3" json:"deploymentLabels,omitempty"`
	// Labels that are added to Pilot pods.
	//
	// See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
	PodLabels *structpb.Struct `protobuf:"bytes,36,opt,name=podLabels,proto3" json:"podLabels,omitempty"`
	// Configuration settings passed to Pilot as a ConfigMap.
	//
	// This controls whether the mesh config map, generated from values.yaml is generated.
	// If false, pilot wil use default values or user-supplied values, in that order of preference.
	ConfigMap *wrapperspb.BoolValue `protobuf:"bytes,18,opt,name=configMap,proto3" json:"configMap,omitempty"`
	// Controls whether Pilot is configured through the Mesh Control Protocol (MCP).
	//
	// If set to true, Pilot requires an MCP server (like Galley) to be installed.
	UseMCP *wrapperspb.BoolValue `protobuf:"bytes,20,opt,name=useMCP,proto3" json:"useMCP,omitempty"`
	// Environment variables passed to the Pilot container.
	//
	// Examples:
	// env:
	//
	//	ENV_VAR_1: value1
	//	ENV_VAR_2: value2
	Env *structpb.Struct `protobuf:"bytes,21,opt,name=env,proto3" json:"env,omitempty"`
	// K8s affinity to set on the Pilot Pods.
	Affinity *v1.Affinity `protobuf:"bytes,22,opt,name=affinity,proto3" json:"affinity,omitempty"`
	// K8s rolling update strategy
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	RollingMaxSurge *IntOrString `protobuf:"bytes,24,opt,name=rollingMaxSurge,proto3" json:"rollingMaxSurge,omitempty"`
	// The number of pods that can be unavailable during a rolling update (see
	// `strategy.rollingUpdate.maxUnavailable` here:
	// https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/deployment-v1/#DeploymentSpec).
	// May be specified as a number of pods or as a percent of the total number
	// of pods at the start of the update.
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	RollingMaxUnavailable *IntOrString `protobuf:"bytes,25,opt,name=rollingMaxUnavailable,proto3" json:"rollingMaxUnavailable,omitempty"`
	// The node tolerations to be applied to the Pilot deployment so that it can be
	// scheduled to particular nodes with matching taints.
	// More info: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	Tolerations []*v1.Toleration `protobuf:"bytes,26,rep,name=tolerations,proto3" json:"tolerations,omitempty"`
	// Specifies whether protocol sniffing is enabled for outbound traffic.
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	EnableProtocolSniffingForOutbound *wrapperspb.BoolValue `protobuf:"bytes,28,opt,name=enableProtocolSniffingForOutbound,proto3" json:"enableProtocolSniffingForOutbound,omitempty"`
	// Specifies whether protocol sniffing is enabled for inbound traffic.
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	EnableProtocolSniffingForInbound *wrapperspb.BoolValue `protobuf:"bytes,29,opt,name=enableProtocolSniffingForInbound,proto3" json:"enableProtocolSniffingForInbound,omitempty"`
	// K8s annotations for pods.
	//
	// See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	PodAnnotations *structpb.Struct `protobuf:"bytes,30,opt,name=podAnnotations,proto3" json:"podAnnotations,omitempty"`
	// K8s annotations for the Service.
	//
	// See: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
	ServiceAnnotations *structpb.Struct `protobuf:"bytes,37,opt,name=serviceAnnotations,proto3" json:"serviceAnnotations,omitempty"`
	// K8s annotations for the service account
	ServiceAccountAnnotations *structpb.Struct `protobuf:"bytes,56,opt,name=serviceAccountAnnotations,proto3" json:"serviceAccountAnnotations,omitempty"`
	// ConfigSource describes a source of configuration data for networking
	// rules, and other Istio configuration artifacts. Multiple data sources
	// can be configured for a single control plane.
	ConfigSource *PilotConfigSource `protobuf:"bytes,31,opt,name=configSource,proto3" json:"configSource,omitempty"`
	// Specifies an extra root certificate in PEM format. This certificate will be trusted
	// by pilot when resolving JWKS URIs.
	JwksResolverExtraRootCA string `protobuf:"bytes,32,opt,name=jwksResolverExtraRootCA,proto3" json:"jwksResolverExtraRootCA,omitempty"`
	// Hub to pull the container image from. Image will be `Hub/Image:Tag-Variant`.
	Hub string `protobuf:"bytes,34,opt,name=hub,proto3" json:"hub,omitempty"`
	// The container image tag to pull. Image will be `Hub/Image:Tag-Variant`.
	Tag *structpb.Value `protobuf:"bytes,35,opt,name=tag,proto3" json:"tag,omitempty"`
	// The container image variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
	Variant string `protobuf:"bytes,39,opt,name=variant,proto3" json:"variant,omitempty"`
	// The seccompProfile for the Pilot container.
	//
	// See: https://kubernetes.io/docs/tutorials/security/seccomp/
	SeccompProfile *v1.SeccompProfile `protobuf:"bytes,38,opt,name=seccompProfile,proto3" json:"seccompProfile,omitempty"`
	// The k8s topologySpreadConstraints for the Pilot pods.
	TopologySpreadConstraints []*v1.TopologySpreadConstraint `protobuf:"bytes,41,rep,name=topologySpreadConstraints,proto3" json:"topologySpreadConstraints,omitempty"`
	// Additional container arguments for the Pilot container.
	ExtraContainerArgs []*structpb.Struct `protobuf:"bytes,42,rep,name=extraContainerArgs,proto3" json:"extraContainerArgs,omitempty"`
	// Additional volumeMounts to add to the Pilot container.
	VolumeMounts []*v1.VolumeMount `protobuf:"bytes,49,rep,name=volumeMounts,proto3" json:"volumeMounts,omitempty"`
	// Additional volumes to add to the Pilot Pod.
	Volumes []*v1.Volume `protobuf:"bytes,51,rep,name=volumes,proto3" json:"volumes,omitempty"`
	// Defines which IP family to use for single stack or the order of IP families for dual-stack.
	// Valid list items are "IPv4", "IPv6".
	// More info: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
	IpFamilies []string `protobuf:"bytes,52,rep,name=ipFamilies,proto3" json:"ipFamilies,omitempty"`
	// Controls whether Services are configured to use IPv4, IPv6, or both. Valid options
	// are PreferDualStack, RequireDualStack, and SingleStack.
	// More info: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
	IpFamilyPolicy string `protobuf:"bytes,53,opt,name=ipFamilyPolicy,proto3" json:"ipFamilyPolicy,omitempty"`
	// Target memory utilization used in HorizontalPodAutoscaler.
	//
	// See https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	Memory *TargetUtilizationConfig `protobuf:"bytes,54,opt,name=memory,proto3" json:"memory,omitempty"`
	// Configures whether to use an existing CNI installation for workloads
	Cni   *CNIUsageConfig             `protobuf:"bytes,55,opt,name=cni,proto3" json:"cni,omitempty"`
	Taint *PilotTaintControllerConfig `protobuf:"bytes,57,opt,name=taint,proto3" json:"taint,omitempty"`
	// contains filtered or unexported fields
}

type PilotConfigSource struct {

	// Describes the source of configuration, if nothing is specified default is MCP.
	SubscribedResources []string `protobuf:"bytes,1,rep,name=subscribedResources,proto3" json:"subscribedResources,omitempty"`
	// contains filtered or unexported fields
}

type PilotIngressConfig struct {

	// Sets the type ingress service for Pilot.
	//
	// If empty, node-port is assumed.
	//
	// Allowed values: node-port, istio-ingressgateway, ingress
	IngressService        string                `protobuf:"bytes,1,opt,name=ingressService,proto3" json:"ingressService,omitempty"`
	IngressControllerMode IngressControllerMode `` /* 132-byte string literal not displayed */
	// If mode is STRICT, this value must be set on "kubernetes.io/ingress.class" annotation to activate.
	IngressClass string `protobuf:"bytes,3,opt,name=ingressClass,proto3" json:"ingressClass,omitempty"`
	// contains filtered or unexported fields
}

type PilotPolicyConfig struct {

	// Controls whether Istio policy is applied to Pilot.
	Enabled *wrapperspb.BoolValue `protobuf:"bytes,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
	// contains filtered or unexported fields
}

type PilotTaintControllerConfig struct {

	// Enable the untaint controller for new nodes. This aims to solve a race for CNI installation on
	// new nodes. For this to work, the newly added nodes need to have the istio CNI taint as they are
	// added to the cluster. This is usually done by configuring the cluster infra provider.
	Enabled bool `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
	// The namespace of the CNI daemonset, incase it's not the same as istiod.
	Namespace string `protobuf:"bytes,2,opt,name=namespace,proto3" json:"namespace,omitempty"`
	// contains filtered or unexported fields
}

type PortsConfig struct {

	// Port name.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Port number.
	Port int32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	// NodePort number.
	NodePort int32 `protobuf:"varint,3,opt,name=nodePort,proto3" json:"nodePort,omitempty"`
	// Target port number.
	TargetPort int32 `protobuf:"varint,4,opt,name=targetPort,proto3" json:"targetPort,omitempty"`
	// Protocol name.
	Protocol string `protobuf:"bytes,5,opt,name=protocol,proto3" json:"protocol,omitempty"`
	// contains filtered or unexported fields
}

type ProxyConfig struct {

	// Controls the 'policy' in the sidecar injector.
	AutoInject string `protobuf:"bytes,4,opt,name=autoInject,proto3" json:"autoInject,omitempty"`
	// Domain for the cluster, default: "cluster.local".
	//
	// K8s allows this to be customized, see https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/
	ClusterDomain string `protobuf:"bytes,5,opt,name=clusterDomain,proto3" json:"clusterDomain,omitempty"`
	// Per Component log level for proxy, applies to gateways and sidecars.
	//
	// If a component level is not set, then the global "logLevel" will be used. If left empty, "misc:error" is used.
	ComponentLogLevel string `protobuf:"bytes,6,opt,name=componentLogLevel,proto3" json:"componentLogLevel,omitempty"`
	// Enables core dumps for newly injected sidecars.
	//
	// If set, newly injected sidecars will have core dumps enabled.
	EnableCoreDump *wrapperspb.BoolValue `protobuf:"bytes,9,opt,name=enableCoreDump,proto3" json:"enableCoreDump,omitempty"`
	// Specifies the Istio ingress ports not to capture.
	ExcludeInboundPorts string `protobuf:"bytes,12,opt,name=excludeInboundPorts,proto3" json:"excludeInboundPorts,omitempty"`
	// Lists the excluded IP ranges of Istio egress traffic that the sidecar captures.
	ExcludeIPRanges string `protobuf:"bytes,13,opt,name=excludeIPRanges,proto3" json:"excludeIPRanges,omitempty"`
	// Image name or path for the proxy, default: "proxyv2".
	//
	// If registry or tag are not specified, global.hub and global.tag are used.
	//
	// Examples: my-proxy (uses global.hub/tag), docker.io/myrepo/my-proxy:v1.0.0
	Image string `protobuf:"bytes,14,opt,name=image,proto3" json:"image,omitempty"`
	// Lists the IP ranges of Istio egress traffic that the sidecar captures.
	//
	// Example: "172.30.0.0/16,172.20.0.0/16"
	// This would only capture egress traffic on those two IP Ranges, all other outbound traffic would # be allowed by the sidecar."
	IncludeIPRanges string `protobuf:"bytes,16,opt,name=includeIPRanges,proto3" json:"includeIPRanges,omitempty"`
	// Log level for proxy, applies to gateways and sidecars. If left empty, "warning" is used. Expected values are: trace\|debug\|info\|warning\|error\|critical\|off
	LogLevel string `protobuf:"bytes,18,opt,name=logLevel,proto3" json:"logLevel,omitempty"`
	// Enables privileged securityContext for the istio-proxy container.
	//
	// See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
	Privileged *wrapperspb.BoolValue `protobuf:"bytes,19,opt,name=privileged,proto3" json:"privileged,omitempty"`
	// Sets the initial delay for readiness probes in seconds.
	ReadinessInitialDelaySeconds uint32 `protobuf:"varint,20,opt,name=readinessInitialDelaySeconds,proto3" json:"readinessInitialDelaySeconds,omitempty"`
	// Sets the interval between readiness probes in seconds.
	ReadinessPeriodSeconds uint32 `protobuf:"varint,21,opt,name=readinessPeriodSeconds,proto3" json:"readinessPeriodSeconds,omitempty"`
	// Sets the number of successive failed probes before indicating readiness failure.
	ReadinessFailureThreshold uint32 `protobuf:"varint,22,opt,name=readinessFailureThreshold,proto3" json:"readinessFailureThreshold,omitempty"`
	// Configures the startup probe for the istio-proxy container.
	StartupProbe *StartupProbe `protobuf:"bytes,41,opt,name=startupProbe,proto3" json:"startupProbe,omitempty"`
	// Default port used for the Pilot agent's health checks.
	StatusPort uint32 `protobuf:"varint,23,opt,name=statusPort,proto3" json:"statusPort,omitempty"`
	// K8s resources settings.
	//
	// See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	Resources *Resources `protobuf:"bytes,24,opt,name=resources,proto3" json:"resources,omitempty"`
	// Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver.
	// If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
	Tracer Tracer `protobuf:"varint,25,opt,name=tracer,proto3,enum=v1alpha1.Tracer" json:"tracer,omitempty"`
	// A comma separated list of outbound ports to be excluded from redirection to Envoy.
	ExcludeOutboundPorts string `protobuf:"bytes,28,opt,name=excludeOutboundPorts,proto3" json:"excludeOutboundPorts,omitempty"`
	// The k8s lifecycle hooks definition (pod.spec.containers.lifecycle) for the proxy container.
	// More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
	Lifecycle *v1.Lifecycle `protobuf:"bytes,36,opt,name=lifecycle,proto3" json:"lifecycle,omitempty"`
	// Controls if sidecar is injected at the front of the container list and blocks the start of the other containers until the proxy is ready
	//
	// Deprecated: replaced by ProxyConfig setting which allows per-pod configuration of this behavior.
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	HoldApplicationUntilProxyStarts *wrapperspb.BoolValue `protobuf:"bytes,37,opt,name=holdApplicationUntilProxyStarts,proto3" json:"holdApplicationUntilProxyStarts,omitempty"`
	// A comma separated list of inbound ports for which traffic is to be redirected to Envoy.
	// The wildcard character '*' can be used to configure redirection for all ports.
	IncludeInboundPorts string `protobuf:"bytes,38,opt,name=includeInboundPorts,proto3" json:"includeInboundPorts,omitempty"`
	// A comma separated list of outbound ports for which traffic is to be redirected to Envoy, regardless of the destination IP.
	IncludeOutboundPorts string `protobuf:"bytes,39,opt,name=includeOutboundPorts,proto3" json:"includeOutboundPorts,omitempty"`
	// contains filtered or unexported fields
}

type ProxyInitConfig struct {

	// Specifies the image for the proxy_init container.
	Image string `protobuf:"bytes,1,opt,name=image,proto3" json:"image,omitempty"`
	// K8s resources settings.
	//
	// See https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.
	Resources *Resources `protobuf:"bytes,5,opt,name=resources,proto3" json:"resources,omitempty"`
	// contains filtered or unexported fields
}

type ResourceQuotas struct {

	// Controls whether to create resource quotas or not for the CNI DaemonSet.
	Enabled *wrapperspb.BoolValue `protobuf:"bytes,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
	// The hard limit on the number of pods in the namespace where the CNI DaemonSet is deployed.
	Pods int64 `protobuf:"varint,2,opt,name=pods,proto3" json:"pods,omitempty"`
	// contains filtered or unexported fields
}