Repository: kiali/kiali

Issue:
Document out what is cached in Kiali
Since we started performance optimization tasks. Where we are architecturally?
List of areas which are cached.
Areas which are not cached.

Connections between cached/not cached areas and performance results.

Hints from issue comments:
@jshaughn: @hhovsepy Does it make sense to tie this work to https://github.com/kiali/kiali/pull/7142?  or maybe we could merge that one and create this under there?  Or would it make more sense to just have this documented in the code itself?

cc @nrfox @hhovsepy: @jshaughn I think we can make sure the [#7142](https://github.com/kiali/kiali/pull/7142) is merged, then in a further PR add comments in code for the areas which are cached, and also for the areas which require a further caching work + add subsection in this document about cached areas.@jshaughn: @hhovsepy I merged #7142 @nrfox: You can look at `KialiCache` to get a good sense of what is cached.

https://github.com/kiali/kiali/blob/03544b84caf9c827b0e26256148cf6ca3cc452c1/kubernetes/cache/cache.go#L43-L98

What's not included there are:
- prom metrics. Results from specific queries are cached: https://github.com/kiali/kiali/blob/03544b84caf9c827b0e26256148cf6ca3cc452c1/prometheus/cache.go#L25-L35
- Tempo traces: https://github.com/kiali/kiali/blob/03544b84caf9c827b0e26256148cf6ca3cc452c1/tracing/tempo/http_client.go#L34@jmazzitelli: The "excluded resources" are also not cached (this came up in https://github.com/kiali/kiali/issues/8084)

Solution patch:
diff --git a/CACHE.md b/CACHE.md
new file mode 100644
index 000000000..9a0f779e8
--- /dev/null
+++ b/CACHE.md
@@ -0,0 +1,85 @@
+# Caching in Kiali
+
+Kiali implements multiple caching layers to optimize performance and reduce the number of API calls to Kubernetes, Prometheus, and Tempo. This document describes what data is cached and what is always fetched directly from the source.
+
+## Kiali Cache
+
+The Kiali cache stores essential metadata and service mesh-related information to improve UI responsiveness and reduce the load on backend services.
+
+- Mesh Configuration: Caches mesh-wide settings, such as control planes running in the mesh from various sources e.g. istio configmap, istiod deployment envvars, etc.
+- Ambient Mesh Status: Stores a flag indicating whether Istio Ambient mode is enabled.
+- Build Information: Cached version and build details of the running Kiali instance.
+- Clusters: Stores the list of known clusters to optimize multi-cluster queries.
+- Istio Validations: Caches Istio Config validation results by cluster and namespaces.
+- Namespaces: Holds namespace data stored per cluster.
+- Proxy Status: Stores the status of pod proxies, suc as xDS.
+- Registry Services: Caches Kubernetes service registry data to speed up service discovery and loading.
+- Waypoint Proxies: Stores workload data for waypoint proxies to enhance service mesh observability.
+- Webhooks Availability: Cached information about whether webhooks can be listed for a given cluster.
+- Ztunnel Config Dump: Caches Ztunnel pod configurations for additional retrieval of protocol details.
+- Ztunnel Pods: Maintains a cache of ztunnel pods discovered in the mesh.
+
+## Kubernetes Cache
+
+Kiali maintains an internal cache for commonly used Kubernetes resources such as Services, Workloads, ConfigMaps and Istio Configs.
+
+- ConfigMaps
+
+- Workloads:
+  - DaemonSets
+  - Deployments
+  - Endpoints
+  - Pods
+  - ReplicaSets
+  - StatefulSets
+
+- Services
+
+- Istio Resources: 
+  - DestinationRules
+  - EnvoyFilters
+  - Gateways
+  - Sidecars
+  - ServiceEntries
+  - Telemetries
+  - VirtualServices
+  - WasmPlugins
+  - WorkloadEntries
+  - WorkloadGroups
+
+- Security Policies: 
+  - AuthorizationPolicies
+  - PeerAuthentications
+  - RequestAuthentications
+
+- K8s Gateway API Resources: 
+  - Gateways
+  - GRPCRoutes
+  - HTTPRoutes
+  - ReferenceGrants
+  - TCPRoutes
+  - TLSRoutes
+
+## Prometheus Cache
+
+Kiali caches Prometheus metrics of loading request rates per cluster and namespace.
+
+- App Request Rates
+- Service Request Rates
+- Workload Request Rates
+
+## Tempo Cache
+
+Kiali uses a cache for distributed tracing data retrieved from Tempo to improve trace analysis performance.
+
+- Tracing Data: cached traces.
+
+## Non cached data. Directly Fetched Kubernetes Resources
+
+Some Kubernetes resources could not be cached and are always retrieved directly from the K8s API.
+
+- CronJobs
+- DeploymentConfigs
+- Jobs
+- ReplicationControllers
+
diff --git a/business/checkers/authorization_policies_checker.go b/business/checkers/authorization_policies_checker.go
index 546719a7e..99899867c 100644
--- a/business/checkers/authorization_policies_checker.go
+++ b/business/checkers/authorization_policies_checker.go
@@ -20,7 +20,7 @@ type AuthorizationPolicyChecker struct {
 	ServiceEntries        []*networking_v1.ServiceEntry
 	AuthorizationPolicies []*security_v1.AuthorizationPolicy
 	VirtualServices       []*networking_v1.VirtualService
-	WorkloadsPerNamespace map[string]models.WorkloadList
+	WorkloadsPerNamespace map[string]models.Workloads
 }
 
 func (a AuthorizationPolicyChecker) Check() models.IstioValidations {
diff --git a/business/checkers/common/multi_match_selector_checker.go b/business/checkers/common/multi_match_selector_checker.go
index 59429ee3a..597b2a84a 100644
--- a/business/checkers/common/multi_match_selector_checker.go
+++ b/business/checkers/common/multi_match_selector_checker.go
@@ -14,12 +14,12 @@ type GenericMultiMatchChecker struct {
 	ObjectGVK             schema.GroupVersionKind
 	Keys                  []models.IstioValidationKey
 	Selectors             map[int]map[string]string
-	WorkloadsPerNamespace map[string]models.WorkloadList
+	WorkloadsPerNamespace map[string]models.Workloads
 	Path                  string
 	skipSelSubj           bool
 }
 
-func PeerAuthenticationMultiMatchChecker(cluster string, objectGVK schema.GroupVersionKind, pa []*security_v1.PeerAuthentication, workloadsPerNamespace map[string]models.WorkloadList) GenericMultiMatchChecker {
+func PeerAuthenticationMultiMatchChecker(cluster string, objectGVK schema.GroupVersionKind, pa []*security_v1.PeerAuthentication, workloadsPerNamespace map[string]models.Workloads) GenericMultiMatchChecker {
 	keys := []models.IstioValidationKey{}
 	selectors := make(map[int]map[string]string, len(pa))
 	for i, p := range pa {
@@ -47,7 +47,7 @@ func PeerAuthenticationMultiMatchChecker(cluster string, objectGVK schema.GroupV
 	}
 }
 
-func RequestAuthenticationMultiMatchChecker(cluster string, objectGVK schema.GroupVersionKind, ra []*security_v1.RequestAuthentication, workloadsPerNamespace map[string]models.WorkloadList) GenericMultiMatchChecker {
+func RequestAuthenticationMultiMatchChecker(cluster string, objectGVK schema.GroupVersionKind, ra []*security_v1.RequestAuthentication, workloadsPerNamespace map[string]models.Workloads) GenericMultiMatchChecker {
 	keys := []models.IstioValidationKey{}
 	selectors := make(map[int]map[string]string, len(ra))
 	for i, r := range ra {
@@ -76,13 +76,13 @@ func RequestAuthenticationMultiMatchChecker(cluster string, objectGVK schema.Gro
 	}
 }
 
-func SidecarSelectorMultiMatchChecker(cluster string, objectGVK schema.GroupVersionKind, sc []*networking_v1.Sidecar, workloadsPerNamespace map[string]models.WorkloadList) GenericMultiMatchChecker {
+func SidecarSelectorMultiMatchChecker(cluster string, objectGVK schema.GroupVersionKind, sc []*networking_v1.Sidecar, workloadsPerNamespace map[string]models.Workloads) GenericMultiMatchChecker {
 	keys := []models.IstioValidationKey{}
 	selectors := make(map[int]map[string]string, len(sc))
 	i := 0
 	for _, s := range sc {
-		for _, wls := range workloadsPerNamespace {
-			if s.Namespace != wls.Namespace {
+		for ns, _ := range workloadsPerNamespace {
+			if s.Namespace != ns {
 				// Workloads from Sidecar's own Namespaces only are considered in Selector
 				continue
 			}
@@ -227,12 +227,12 @@ func (m GenericMultiMatchChecker) multiMatchSubjects() ReferenceMap {
 			continue
 		}
 
-		for _, wls := range m.WorkloadsPerNamespace {
-			for _, w := range wls.Workloads {
+		for ns, workloads := range m.WorkloadsPerNamespace {
+			for _, w := range workloads {
 				if !selector.Matches(labels.Set(w.Labels)) {
 					continue
 				}
-				workloadKey := models.BuildKey(w.WorkloadGVK, w.Name, wls.Namespace, m.Cluster)
+				workloadKey := models.BuildKey(w.WorkloadGVK, w.Name, ns, m.Cluster)
 				workloadSubjects.Add(workloadKey, subjectKey)
 			}
 		}
diff --git a/business/checkers/common/workload_selector_checker.go b/business/checkers/common/workload_selector_checker.go
index 3d999787c..aeced6c3d 100644
--- a/business/checkers/common/workload_selector_checker.go
+++ b/business/checkers/common/workload_selector_checker.go
@@ -10,11 +10,11 @@ import (
 type GenericNoWorkloadFoundChecker struct {
 	ObjectGVK             schema.GroupVersionKind
 	SelectorLabels        map[string]string
-	WorkloadsPerNamespace map[string]models.WorkloadList
+	WorkloadsPerNamespace map[string]models.Workloads
 	Path                  string
 }
 
-func SelectorNoWorkloadFoundChecker(objectGVK schema.GroupVersionKind, selectorLabels map[string]string, workloadsPerNamespace map[string]models.WorkloadList) GenericNoWorkloadFoundChecker {
+func SelectorNoWorkloadFoundChecker(objectGVK schema.GroupVersionKind, selectorLabels map[string]string, workloadsPerNamespace map[string]models.Workloads) GenericNoWorkloadFoundChecker {
 	return GenericNoWorkloadFoundChecker{
 		ObjectGVK:             objectGVK,
 		SelectorLabels:        selectorLabels,
@@ -23,7 +23,7 @@ func SelectorNoWorkloadFoundChecker(objectGVK schema.GroupVersionKind, selectorL
 	}
 }
 
-func WorkloadSelectorNoWorkloadFoundChecker(objectGVK schema.GroupVersionKind, selectorLabels map[string]string, workloadsPerNamespace map[string]models.WorkloadList) GenericNoWorkloadFoundChecker {
+func WorkloadSelectorNoWorkloadFoundChecker(objectGVK schema.GroupVersionKind, selectorLabels map[string]string, workloadsPerNamespace map[string]models.Workloads) GenericNoWorkloadFoundChecker {
 	return GenericNoWorkloadFoundChecker{
 		ObjectGVK:             objectGVK,
 		SelectorLabels:        selectorLabels,
@@ -47,8 +47,8 @@ func (wsc GenericNoWorkloadFoundChecker) Check() ([]*models.IstioCheck, bool) {
 func (wsc GenericNoWorkloadFoundChecker) hasMatchingWorkload(labelSelector map[string]string) bool {
 	selector := labels.SelectorFromSet(labelSelector)
 
-	for _, wls := range wsc.WorkloadsPerNamespace {
-		for _, wl := range wls.Workloads {
+	for _, workloads := range wsc.WorkloadsPerNamespace {
+		for _, wl := range workloads {
 			wlLabelSet := labels.Set(wl.Labels)
 			if selector.Matches(wlLabelSet) {
 				return true
diff --git a/business/checkers/destinationrules/no_dest_checker.go b/business/checkers/destinationrules/no_dest_checker.go
index b6ba25017..944b0ec44 100644
--- a/business/checkers/destinationrules/no_dest_checker.go
+++ b/business/checkers/destinationrules/no_dest_checker.go
@@ -12,7 +12,7 @@ import (
 
 type NoDestinationChecker struct {
 	Namespaces            models.Namespaces
-	WorkloadsPerNamespace map[string]models.WorkloadList
+	WorkloadsPerNamespace map[string]models.Workloads
 	DestinationRule       *networking_v1.DestinationRule
 	VirtualServices       []*networking_v1.VirtualService
 	ServiceEntries        []*networking_v1.ServiceEntry
@@ -97,10 +97,10 @@ func (n NoDestinationChecker) hasMatchingWorkload(host kubernetes.Host, subsetLa
 	if len(selectors) != 0 {
 		selector := labels.SelectorFromSet(labels.Set(selectors))
 
-		for _, wl := range n.WorkloadsPerNamespace[localNs].Workloads {
-			wlLabelSet := labels.Set(wl.Labels)
-			if selector.Matches(wlLabelSet) {
-				if subsetSelector.Matches(wlLabelSet) {
+		for _, w := range n.WorkloadsPerNamespace[localNs] {
+			wLabelSet := labels.Set(w.Labels)
+			if selector.Matches(wLabelSet) {
+				if subsetSelector.Matches(wLabelSet) {
 					return true
 				}
 			}
@@ -130,7 +130,7 @@ func (n NoDestinationChecker) hasMatchingService(host kubernetes.Host, itemNames
 
 	if localNs == itemNamespace {
 		// Check Workloads
-		if matches := kubernetes.HasMatchingWorkloads(localSvc, n.WorkloadsPerNamespace[localNs].GetLabels()); matches {
+		if matches := kubernetes.HasMatchingWorkloads(localSvc, models.GetLabels(n.WorkloadsPerNamespace[localNs])); matches {
 			return matches
 		}
 	}
diff --git a/business/checkers/gateway_checker.go b/business/checkers/gateway_checker.go
index 6366d8dbd..9da70aacb 100644
--- a/business/checkers/gateway_checker.go
+++ b/business/checkers/gateway_checker.go
@@ -10,7 +10,7 @@ import (
 
 type GatewayChecker struct {
 	Gateways              []*networking_v1.Gateway
-	WorkloadsPerNamespace map[string]models.WorkloadList
+	WorkloadsPerNamespace map[string]models.Workloads
 	IsGatewayToNamespace  bool
 	Cluster               string
 }
diff --git a/business/checkers/gateways/selector_checker.go b/business/checkers/gateways/selector_checker.go
index 97eaf4efd..692a67819 100644
--- a/business/checkers/gateways/selector_checker.go
+++ b/business/checkers/gateways/selector_checker.go
@@ -8,7 +8,7 @@ import (
 )
 
 type SelectorChecker struct {
-	WorkloadsPerNamespace map[string]models.WorkloadList
+	WorkloadsPerNamespace map[string]models.Workloads
 	Gateway               *networking_v1.Gateway
 	IsGatewayToNamespace  bool
 }
@@ -26,12 +26,12 @@ func (s SelectorChecker) Check() ([]*models.IstioCheck, bool) {
 func (s SelectorChecker) hasMatchingWorkload(labelSelector map[string]string) bool {
 	selector := labels.SelectorFromSet(labelSelector)
 
-	for _, wls := range s.WorkloadsPerNamespace {
-		if s.IsGatewayToNamespace && wls.Namespace != s.Gateway.Namespace {
+	for ns, workloads := range s.WorkloadsPerNamespace {
+		if s.IsGatewayToNamespace && ns != s.Gateway.Namespace {
 			continue
 		}
-		for _, wl := range wls.Workloads {
-			wlLabelSet := labels.Set(wl.Labels)
+		for _, w := range workloads {
+			wlLabelSet := labels.Set(w.Labels)
 			if selector.Matches(wlLabelSet) {
 				return true
 			}
diff --git a/business/checkers/no_service_checker.go b/business/checkers/no_service_checker.go
index 5d3d6a41e..d1a6e4eab 100644
--- a/business/checkers/no_service_checker.go
+++ b/business/checkers/no_service_checker.go
@@ -12,7 +12,7 @@ import (
 type NoServiceChecker struct {
 	Namespaces            models.Namespaces
 	IstioConfigList       *models.IstioConfigList
-	WorkloadsPerNamespace map[string]models.WorkloadList
+	WorkloadsPerNamespace map[string]models.Workloads
 	AuthorizationDetails  *kubernetes.RBACDetails
 	RegistryServices      []*kubernetes.RegistryService
 	PolicyAllowAny        bool
@@ -71,7 +71,7 @@ func runGatewayCheck(virtualService *networking_v1.VirtualService, gatewayNames
 	return models.IstioValidations{key: validations}
 }
 
-func runDestinationRuleCheck(destinationRule *networking_v1.DestinationRule, workloads map[string]models.WorkloadList,
+func runDestinationRuleCheck(destinationRule *networking_v1.DestinationRule, workloads map[string]models.Workloads,
 	serviceEntries []*networking_v1.ServiceEntry, clusterNamespaces models.Namespaces, registryStatus []*kubernetes.RegistryService, virtualServices []*networking_v1.VirtualService,
 	policyAllowAny bool, cluster string) models.IstioValidations {
 	key, validations := EmptyValidValidation(destinationRule.Name, destinationRule.Namespace, kubernetes.DestinationRules, cluster)
diff --git a/business/checkers/peer_authentication_checker.go b/business/checkers/peer_authentication_checker.go
index d4296e052..94c2e85c7 100644
--- a/business/checkers/peer_authentication_checker.go
+++ b/business/checkers/peer_authentication_checker.go
@@ -13,7 +13,7 @@ import (
 type PeerAuthenticationChecker struct {
 	PeerAuthentications   []*security_v1.PeerAuthentication
 	MTLSDetails           kubernetes.MTLSDetails
-	WorkloadsPerNamespace map[string]models.WorkloadList
+	WorkloadsPerNamespace map[string]models.Workloads
 	Cluster               string
 }
 
diff --git a/business/checkers/request_authentication_checker.go b/business/checkers/request_authentication_checker.go
index cabf526fb..a530c6f74 100644
--- a/business/checkers/request_authentication_checker.go
+++ b/business/checkers/request_authentication_checker.go
@@ -10,7 +10,7 @@ import (
 
 type RequestAuthenticationChecker struct {
 	RequestAuthentications []*security_v1.RequestAuthentication
-	WorkloadsPerNamespace  map[string]models.WorkloadList
+	WorkloadsPerNamespace  map[string]models.Workloads
 	Cluster                string
 }
 
diff --git a/business/checkers/sidecars_checker.go b/business/checkers/sidecars_checker.go
index 912afb756..af44b66a1 100644
--- a/business/checkers/sidecars_checker.go
+++ b/business/checkers/sidecars_checker.go
@@ -13,7 +13,7 @@ type SidecarChecker struct {
 	Sidecars              []*networking_v1.Sidecar
 	ServiceEntries        []*networking_v1.ServiceEntry
 	Namespaces            models.Namespaces
-	WorkloadsPerNamespace map[string]models.WorkloadList
+	WorkloadsPerNamespace map[string]models.Workloads
 	RegistryServices      []*kubernetes.RegistryService
 	Cluster               string
 }
diff --git a/business/checkers/workloads/uncovered_workload_checker.go b/business/checkers/workloads/uncovered_workload_checker.go
index 67ebfa01c..4d68c7027 100644
--- a/business/checkers/workloads/uncovered_workload_checker.go
+++ b/business/checkers/workloads/uncovered_workload_checker.go
@@ -9,7 +9,7 @@ import (
 )
 
 type UncoveredWorkloadChecker struct {
-	Workload              models.WorkloadListItem
+	Workload              *models.Workload
 	Namespace             string
 	AuthorizationPolicies []*security_v1.AuthorizationPolicy
 }
diff --git a/business/checkers/workloads_checker.go b/business/checkers/workloads_checker.go
index 6283b4c74..3cef3946a 100644
--- a/business/checkers/workloads_checker.go
+++ b/business/checkers/workloads_checker.go
@@ -12,16 +12,16 @@ const WorkloadCheckerType = "workload"
 
 type WorkloadChecker struct {
 	AuthorizationPolicies []*security_v1.AuthorizationPolicy
-	WorkloadsPerNamespace map[string]models.WorkloadList
+	WorkloadsPerNamespace map[string]models.Workloads
 	Cluster               string
 }
 
 func (w WorkloadChecker) Check() models.IstioValidations {
 	validations := models.IstioValidations{}
 
-	for _, wls := range w.WorkloadsPerNamespace {
-		for _, wl := range wls.Workloads {
-			validations.MergeValidations(w.runChecks(wl, wls.Namespace))
+	for ns, workloads := range w.WorkloadsPerNamespace {
+		for _, wl := range workloads {
+			validations.MergeValidations(w.runChecks(wl, ns))
 		}
 	}
 
@@ -29,7 +29,7 @@ func (w WorkloadChecker) Check() models.IstioValidations {
 }
 
 // runChecks runs all the individual checks for a single workload and appends the result into validations.
-func (w WorkloadChecker) runChecks(workload models.WorkloadListItem, namespace string) models.IstioValidations {
+func (w WorkloadChecker) runChecks(workload *models.Workload, namespace string) models.IstioValidations {
 	wlName := workload.Name
 	key, rrValidation := EmptyValidValidation(wlName, namespace, schema.GroupVersionKind{Group: "", Version: "", Kind: WorkloadCheckerType}, w.Cluster)
 
diff --git a/business/istio_validations.go b/business/istio_validations.go
index 4c6f3099b..fc402fd59 100644
--- a/business/istio_validations.go
+++ b/business/istio_validations.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"maps"
 	"slices"
+	"strconv"
 	"strings"
 
 	networking_v1 "istio.io/client-go/pkg/apis/networking/v1"
@@ -18,6 +19,7 @@ import (
 	"github.com/kiali/kiali/config"
 	"github.com/kiali/kiali/kubernetes"
 	"github.com/kiali/kiali/kubernetes/cache"
+	"github.com/kiali/kiali/log"
 	"github.com/kiali/kiali/models"
 	"github.com/kiali/kiali/observability"
 	"github.com/kiali/kiali/prometheus/internalmetrics"
@@ -58,18 +60,9 @@ type ReferenceChecker interface {
 	References() models.IstioReferencesMap
 }
 
-func validationsForCluster(validations models.IstioValidations, cluster string) models.IstioValidations {
-	clusterValidations := models.IstioValidations{}
-	for validationKey, validation := range validations {
-		if validationKey.Cluster == cluster {
-			clusterValidations[validationKey] = validation
-		}
-	}
-	return clusterValidations
-}
-
 func (in *IstioValidationsService) GetValidations(ctx context.Context, cluster string) (models.IstioValidations, error) {
-	return validationsForCluster(in.kialiCache.Validations().Items(), cluster), nil
+	validations := in.kialiCache.Validations().Items()
+	return models.IstioValidations(validations).FilterByCluster(cluster), nil
 }
 
 func (in *IstioValidationsService) GetValidationsForNamespace(ctx context.Context, cluster, namespace string) (models.IstioValidations, error) {
@@ -101,7 +94,8 @@ func (in *IstioValidationsService) GetValidationsForService(ctx context.Context,
 		return nil, fmt.Errorf("service [namespace: %s] [name: %s] doesn't exist for Validations", namespace, service)
 	}
 
-	return validationsForCluster(in.kialiCache.Validations().Items(), cluster).FilterBySingleType(schema.GroupVersionKind{Group: "", Version: "", Kind: "service"}, service), nil
+	validations := in.kialiCache.Validations().Items()
+	return models.IstioValidations(validations).FilterByCluster(cluster).FilterBySingleType(schema.GroupVersionKind{Group: "", Version: "", Kind: "service"}, service), nil
 }
 
 func (in *IstioValidationsService) GetValidationsForWorkload(ctx context.Context, cluster, namespace, workload string) (models.IstioValidations, error) {
@@ -114,7 +108,8 @@ func (in *IstioValidationsService) GetValidationsForWorkload(ctx context.Context
 		return nil, err
 	}
 
-	return validationsForCluster(in.kialiCache.Validations().Items(), cluster).FilterBySingleType(schema.GroupVersionKind{Group: "", Version: "", Kind: "workload"}, workload), nil
+	validations := in.kialiCache.Validations().Items()
+	return models.IstioValidations(validations).FilterByCluster(cluster).FilterBySingleType(schema.GroupVersionKind{Group: "", Version: "", Kind: "workload"}, workload), nil
 }
 
 type validationNamespaceInfo struct {
@@ -130,20 +125,60 @@ type validationClusterInfo struct {
 	registryServices []*kubernetes.RegistryService // registry services for the cluster (all namespaces)
 }
 
+// changeMap key values are determined by the validation logic, and typically identifies a config object,
+// or set of confg objects. The value is typically resourceVersion, or some equivalent.
+type ValidationChangeMap map[string]string
+
+func (in ValidationChangeMap) update(key, value string, report bool) bool {
+	prev, exists := in[key]
+
+	if !exists {
+		if report {
+			log.Tracef("validations: new config detected: %s", key)
+		}
+		in[key] = value
+		return true
+	}
+
+	if prev != value {
+		if report {
+			log.Tracef("validations: config change detected: %s", key)
+		}
+		in[key] = value
+		return true
+	}
+
+	return false
+}
+
 // validationInfo holds information gathered during a single validation reconciliation. It is used to hold information that
 // may otherwise need to be recalculated.
 type validationInfo struct {
 	// cross-cluster information
-	clusters []string                                  // all clusters being validated
-	mesh     *models.Mesh                              // control plane info
-	nsMap    map[string][]models.Namespace             // cluster => namespaces
-	saMap    map[string][]string                       // cluster => serviceAccounts
-	wlMap    map[string]map[string]models.WorkloadList // cluster => namespace => WorkloadList, all workloads
+	clusters []string                               // all clusters being validated
+	mesh     *models.Mesh                           // control plane info
+	nsMap    map[string][]models.Namespace          // cluster => namespaces
+	saMap    map[string][]string                    // cluster => serviceAccounts
+	wlMap    map[string]map[string]models.Workloads // cluster => namespace => []Workload, all workloads
 
 	// clusterInfo is reset for each cluster being validated
 	clusterInfo *validationClusterInfo
+
 	// nsInfo is reset for each namespace being validated (for the cluster being validated)
 	nsInfo *validationNamespaceInfo
+
+	// changeMap is used to store config ResourceVersion, or an equivalent. When supplied to
+	// NewValidationInfo() it sets changeDetection enabled.  It is expected to persist through
+	// multiple validation runs, and it is used to check for changes and eliminate checker runs
+	// when nothing significant has changed. If not supplied then no change detection is performed.
+	changeMap ValidationChangeMap
+
+	// hasBaseChange indicates whether a change is detected in the base data, likely meaning that
+	// we need a full validation pass, on each cluster
+	hasBaseChange bool
+
+	// reportChange is an internal flag for debugging, that logs keys that have a value change
+	reportChange bool
 }
 
 // NewValidationInfo returns an initialized validationInfo structure. This is not a "free" call, the initial structure is
@@ -151,7 +186,7 @@ type validationInfo struct {
 // a validation pass to hold "computed" information, and avoid performing the same work multiple times, when evaluating
 // different clusters, or different namespaces for a cluster. Initially unused structures/maps will be set to nil, and
 // arrays will be initialized to empty.
-func (in *IstioValidationsService) NewValidationInfo(ctx context.Context, clusters []string) (*validationInfo, error) {
+func (in *IstioValidationsService) NewValidationInfo(ctx context.Context, clusters []string, changeMap ValidationChangeMap) (*validationInfo, error) {
 	var end observability.EndFunc
 	ctx, end = observability.StartSpan(ctx, "newValidationInfo",
 		observability.Attribute("package", "business"),
@@ -159,10 +194,11 @@ func (in *IstioValidationsService) NewValidationInfo(ctx context.Context, cluste
 	defer end()
 
 	vInfo := validationInfo{
-		clusters: clusters,
-		nsMap:    map[string][]models.Namespace{},
-		saMap:    map[string][]string{},
-		wlMap:    map[string]map[string]models.WorkloadList{},
+		changeMap: changeMap,
+		clusters:  clusters,
+		nsMap:     map[string][]models.Namespace{},
+		saMap:     map[string][]string{},
+		wlMap:     map[string]map[string]models.Workloads{},
 	}
 	mesh, err := in.mesh.discovery.Mesh(ctx)
 	if err != nil {
@@ -170,6 +206,7 @@ func (in *IstioValidationsService) NewValidationInfo(ctx context.Context, cluste
 	}
 	vInfo.mesh = mesh
 
+	// gather base info, mapped by cluster
 	for _, cluster := range clusters {
 		workloads, err := in.workload.GetAllWorkloads(ctx, cluster, "")
 		if err != nil {
@@ -186,12 +223,45 @@ func (in *IstioValidationsService) NewValidationInfo(ctx context.Context, cluste
 		vInfo.saMap[cluster] = in.getServiceAccounts(namespaces, vInfo.wlMap[cluster])
 	}
 
+	// if changeDetection is enabled then loop through the workloads, looking for a change
+	if changeMap != nil {
+		vInfo.reportChange = true
+
+		changeDetected := false
+		numWorkloads := 0
+		for _, workloadsMap := range vInfo.wlMap {
+			for _, workloads := range workloadsMap {
+				numWorkloads += len(workloads)
+				for _, w := range workloads {
+					changeDetected = changeMap.update(w.ValidationKey, w.ValidationVersion, vInfo.reportChange) || changeDetected
+				}
+			}
+		}
+		changeDetected = changeMap.update("validation-num-workloads", strconv.Itoa(numWorkloads), vInfo.reportChange) || changeDetected
+		vInfo.hasBaseChange = changeDetected
+	}
+
 	return &vInfo, nil
 }
 
-// Validate runs a full validation on all objects. It returns an IstioValidations object with all the checks found when running all
-// the enabled checkers.
-func (in *IstioValidationsService) Validate(ctx context.Context, cluster string, vInfo *validationInfo) (models.IstioValidations, error) {
+func (in *validationInfo) changeDetectionEnabled() bool {
+	return in.changeMap != nil
+}
+
+func (in *validationInfo) update(kind, cluster, namespace, name, value string) bool {
+	key := fmt.Sprintf("%s:%s:%s:%s", kind, cluster, namespace, name)
+	return in.changeMap.update(key, value, in.reportChange)
+}
+
+func (in *validationInfo) forceCheckers() bool {
+	return in.hasBaseChange
+}
+
+// Validate runs a full validation on all objects. The first return variable is the "validationPerformed" bool, indicating whether or not
+// the validation checkers were run. It will return false if a changeMap is provided in vInfo and no config changes were detected for the
+// cluster. Otherwise, it will return true. When true the new "validations" are returned in the second return variable. When false
+// the second argument is nil.
+func (in *IstioValidationsService) Validate(ctx context.Context, cluster string, vInfo *validationInfo) (bool, models.IstioValidations, error) {
 	var end observability.EndFunc
 	ctx, end = observability.StartSpan(ctx, "getValidations",
 		observability.Attribute("package", "business"),
@@ -204,7 +274,8 @@ func (in *IstioValidationsService) Validate(ctx context.Context, cluster string,
 
 	validations := models.IstioValidations{}
 	vInfo.clusterInfo = &validationClusterInfo{
-		cluster: cluster,
+		cluster:          cluster,
+		registryServices: []*kubernetes.RegistryService{},
 	}
 
 	if registryStatus := in.kialiCache.GetRegistryStatus(cluster); registryStatus != nil {
@@ -230,10 +301,18 @@ func (in *IstioValidationsService) Validate(ctx context.Context, cluster string,
 	}
 	istioConfigList, err := in.istioConfig.GetIstioConfigListForCluster(ctx, cluster, meta_v1.NamespaceAll, criteria)
 	if err != nil {
-		return nil, err
+		return false, nil, err
 	}
 	vInfo.clusterInfo.istioConfig = istioConfigList
 
+	// if change detection is enabled then decide if we need to run the checkers
+	if vInfo.changeDetectionEnabled() {
+		changeDetected := detectClusterConfigChange(vInfo)
+		if !changeDetected && !vInfo.forceCheckers() {
+			return false, nil, nil
+		}
+	}
+
 	for _, namespace := range vInfo.nsMap[cluster] {
 		vInfo.nsInfo = &validationNamespaceInfo{
 			namespace: &namespace,
@@ -241,43 +320,132 @@ func (in *IstioValidationsService) Validate(ctx context.Context, cluster string,
 
 		err := in.setNamespaceIstioConfig(vInfo)
 		if err != nil {
-			return nil, err
+			return false, nil, err
 		}
 
 		if err := in.setNonLocalMTLSConfig(vInfo); err != nil {
-			return nil, err
+			return false, nil, err
 		}
 
 		objectCheckers := in.getAllObjectCheckers(vInfo)
 
-		// Get group validations for same kind istio objects
 		validations.MergeValidations(runObjectCheckers(objectCheckers))
 	}
 
-	return validations, nil
+	return true, validations, nil
 }
 
-// toWorkloadMap takes a list of workloads from different namespaces, and returns a map: namespace => WorkloadList
-func toWorkloadMap(workloads models.Workloads) map[string]models.WorkloadList {
-	workloadMap := map[string]models.WorkloadList{}
+// toWorkloadMap takes a list of workloads from different namespaces, and returns a map: namespace => models.Workloads
+func toWorkloadMap(workloads models.Workloads) map[string]models.Workloads {
+	workloadMap := map[string]models.Workloads{}
 
 	for _, w := range workloads {
-		wItem := &models.WorkloadListItem{Health: *models.EmptyWorkloadHealth()}
-		wItem.ParseWorkload(w)
-		workloadList, ok := workloadMap[w.Namespace]
+		workloads, ok := workloadMap[w.Namespace]
 		if ok {
-			workloadList.Workloads = append(workloadList.Workloads, *wItem)
+			workloads = append(workloads, w)
 		} else {
-			workloadList = models.WorkloadList{
-				Namespace: w.Namespace,
-				Workloads: []models.WorkloadListItem{*wItem},
-			}
+			workloads = models.Workloads{w}
 		}
-		workloadMap[w.Namespace] = workloadList
+		workloadMap[w.Namespace] = workloads
 	}
 	return workloadMap
 }
 
+// detectClusterConfigChange checks the version values for all of the relevant cluster config, updating
+// as needed, and returns whether a change was detected.
+func detectClusterConfigChange(vInfo *validationInfo) bool {
+	change := false
+	cluster := vInfo.clusterInfo.cluster
+
+	// loop through the services and gather up their resourceVersions
+	for _, s := range vInfo.clusterInfo.registryServices {
+		change = vInfo.update("SV", cluster, s.Attributes.Namespace, s.Attributes.Name, s.ResourceVersion) || change
+	}
+
+	// loop through the config and gather up their resourceVersions
+	config := vInfo.clusterInfo.istioConfig
+	for _, c := range config.AuthorizationPolicies {
+		change = vInfo.update("AP", cluster, c.Namespace, c.Name, c.ResourceVersion) || change
+	}
+	for _, c := range config.DestinationRules {
+		change = vInfo.update("DR", cluster, c.Namespace, c.Name, c.ResourceVersion) || change
+	}
+	for _, c := range config.EnvoyFilters {
+		change = vInfo.update("EF", cluster, c.Namespace, c.Name, c.ResourceVersion) || change
+	}
+	for _, c := range config.Gateways {
+		change = vInfo.update("GW", cluster, c.Namespace, c.Name, c.ResourceVersion) || change
+	}
+	for _, c := range config.K8sGateways {
+		change = vInfo.update("KG", cluster, c.Namespace, c.Name, c.ResourceVersion) || change
+	}
+	for _, c := range config.K8sGRPCRoutes {
+		change = vInfo.update("KGRPC", cluster, c.Namespace, c.Name, c.ResourceVersion) || change
+	}
+	for _, c := range config.K8sHTTPRoutes {
+		change = vInfo.update("KHTTP", cluster, c.Namespace, c.Name, c.ResourceVersion) || change
+	}
+	for _, c := range config.K8sReferenceGrants {
+		change = vInfo.update("KRG", cluster, c.Namespace, c.Name, c.ResourceVersion) || change
+	}
+	for _, c := range config.K8sTCPRoutes {
+		change = vInfo.update("KTCP", cluster, c.Namespace, c.Name, c.ResourceVersion) || change
+	}
+	for _, c := range config.K8sTLSRoutes {
+		change = vInfo.update("KTLS", cluster, c.Namespace, c.Name, c.ResourceVersion) || change
+	}
+	for _, c := range config.PeerAuthentications {
+		change = vInfo.update("PA", cluster, c.Namespace, c.Name, c.ResourceVersion) || change
+	}
+	for _, c := range config.RequestAuthentications {
+		change = vInfo.update("RA", cluster, c.Namespace, c.Name, c.ResourceVersion) || change
+	}
+	for _, c := range config.ServiceEntries {
+		change = vInfo.update("SE", cluster, c.Namespace, c.Name, c.ResourceVersion) || change
+	}
+	for _, c := range config.Sidecars {
+		change = vInfo.update("SC", cluster, c.Namespace, c.Name, c.ResourceVersion) || change
+	}
+	for _, c := range config.Telemetries {
+		change = vInfo.update("TE", cluster, c.Namespace, c.Name, c.ResourceVersion) || change
+	}
+	for _, c := range config.VirtualServices {
+		change = vInfo.update("VS", cluster, c.Namespace, c.Name, c.ResourceVersion) || change
+	}
+	for _, c := range config.WasmPlugins {
+		change = vInfo.update("WP", cluster, c.Namespace, c.Name, c.ResourceVersion) || change
+	}
+	for _, c := range config.WorkloadEntries {
+		change = vInfo.update("WE", cluster, c.Namespace, c.Name, c.ResourceVersion) || change
+	}
+	for _, c := range config.WorkloadGroups {
+		change = vInfo.update("WG", cluster, c.Namespace, c.Name, c.ResourceVersion) || change
+	}
+
+	numConfig := len(config.AuthorizationPolicies) +
+		len(config.DestinationRules) +
+		len(config.EnvoyFilters) +
+		len(config.Gateways) +
+		len(config.K8sGateways) +
+		len(config.K8sGRPCRoutes) +
+		len(config.K8sHTTPRoutes) +
+		len(config.K8sReferenceGrants) +
+		len(config.K8sTCPRoutes) +
+		len(config.K8sTLSRoutes) +
+		len(config.PeerAuthentications) +
+		len(config.RequestAuthentications) +
+		len(config.ServiceEntries) +
+		len(config.Sidecars) +
+		len(config.Telemetries) +
+		len(config.VirtualServices) +
+		len(config.WorkloadEntries) +
+		len(config.WorkloadGroups) +
+		len(config.WasmPlugins)
+	change = vInfo.update("validation-num-config", cluster, "", "", strconv.Itoa(numConfig)) || change
+
+	return change
+}
+
 // getAllObjectCheckers returns all of the checkers to be executed for a full validation.
 // TODO: we may want to to pass vInfo into all of these, if the checkers themselves are re-computing information
 func (in *IstioValidationsService) getAllObjectCheckers(vInfo *validationInfo) []checkers.ObjectChecker {
@@ -336,7 +504,7 @@ func (in *IstioValidationsService) ValidateIstioObject(ctx context.Context, clus
 	defer timer.ObserveDuration()
 
 	// validating a single object is not particularly efficient, it still requires a lot of up-front setup
-	vInfo, err := in.NewValidationInfo(ctx, in.namespace.GetClusterList())
+	vInfo, err := in.NewValidationInfo(ctx, in.namespace.GetClusterList(), nil)
 	if err != nil {
 		return nil, models.IstioReferencesMap{}, err
 	}
@@ -523,16 +691,16 @@ func runObjectReferenceChecker(referenceChecker ReferenceChecker) models.IstioRe
 // getServiceAccounts gets SA information given the namespaces and workloads for a given cluster.
 func (in *IstioValidationsService) getServiceAccounts(
 	namespaces []models.Namespace,
-	workloadsMap map[string]models.WorkloadList,
+	workloadsMap map[string]models.Workloads,
 ) []string {
 	serviceAccounts := map[string]bool{}
 	istioDomain := strings.Replace(config.Get().ExternalServices.Istio.IstioIdentityDomain, "svc.", "", 1)
 
 	for _, ns := range namespaces {
 		saFullNameNs := fmt.Sprintf("%s/ns/%s/sa/", istioDomain, ns.Name)
-		workloadList := workloadsMap[ns.Name]
-		for _, wl := range workloadList.Workloads {
-			for _, sAccountName := range wl.ServiceAccountNames {
+		workloads := workloadsMap[ns.Name]
+		for _, w := range workloads {
+			for _, sAccountName := range w.ServiceAccountNames {
 				saFullName := saFullNameNs + sAccountName
 				serviceAccounts[saFullName] = true
 			}
diff --git a/business/references/auth_policy_references.go b/business/references/auth_policy_references.go
index bde8bdd7a..71e305bc4 100644
--- a/business/references/auth_policy_references.go
+++ b/business/references/auth_policy_references.go
@@ -18,7 +18,7 @@ type AuthorizationPolicyReferences struct {
 	ServiceEntries        []*networking_v1.ServiceEntry
 	VirtualServices       []*networking_v1.VirtualService
 	RegistryServices      []*kubernetes.RegistryService
-	WorkloadsPerNamespace map[string]models.WorkloadList
+	WorkloadsPerNamespace map[string]models.Workloads
 }
 
 func (n AuthorizationPolicyReferences) References() models.IstioReferencesMap {
@@ -96,14 +96,14 @@ func (n AuthorizationPolicyReferences) getWorkloadReferences(ap *security_v1.Aut
 		selector := labels.SelectorFromSet(ap.Spec.Selector.MatchLabels)
 
 		// AuthPolicy searches Workloads from own namespace, or from all namespaces when AuthPolicy is in root namespace
-		for _, wls := range n.WorkloadsPerNamespace {
-			if !config.IsRootNamespace(ap.Namespace) && wls.Namespace != ap.Namespace {
+		for ns, workloads := range n.WorkloadsPerNamespace {
+			if !config.IsRootNamespace(ap.Namespace) && ns != ap.Namespace {
 				continue
 			}
-			for _, wl := range wls.Workloads {
+			for _, wl := range workloads {
 				wlLabelSet := labels.Set(wl.Labels)
 				if selector.Matches(wlLabelSet) {
-					result = append(result, models.WorkloadReference{Name: wl.Name, Namespace: wls.Namespace})
+					result = append(result, models.WorkloadReference{Name: wl.Name, Namespace: ns})
 				}
 			}
 		}
diff --git a/business/references/destination_rule_references.go b/business/references/destination_rule_references.go
index 4667a481f..04697af7c 100644
--- a/business/references/destination_rule_references.go
+++ b/business/references/destination_rule_references.go
@@ -15,7 +15,7 @@ type DestinationRuleReferences struct {
 	Namespaces            models.Namespaces
 	DestinationRules      []*networking_v1.DestinationRule
 	VirtualServices       []*networking_v1.VirtualService
-	WorkloadsPerNamespace map[string]models.WorkloadList
+	WorkloadsPerNamespace map[string]models.Workloads
 	ServiceEntries        []*networking_v1.ServiceEntry
 	RegistryServices      []*kubernetes.RegistryService
 }
@@ -84,11 +84,11 @@ func (n DestinationRuleReferences) getWorkloadReferences(dr *networking_v1.Desti
 			subsetLabelSet := labels.Set(subset.Labels)
 			subsetSelector := labels.SelectorFromSet(subsetLabelSet)
 
-			for _, wl := range n.WorkloadsPerNamespace[localNs].Workloads {
-				wlLabelSet := labels.Set(wl.Labels)
+			for _, w := range n.WorkloadsPerNamespace[localNs] {
+				wlLabelSet := labels.Set(w.Labels)
 				if selector.Matches(wlLabelSet) {
 					if subsetSelector.Matches(wlLabelSet) {
-						allWorkloads = append(allWorkloads, models.WorkloadReference{Name: wl.Name, Namespace: localNs})
+						allWorkloads = append(allWorkloads, models.WorkloadReference{Name: w.Name, Namespace: localNs})
 					}
 				}
 			}
diff --git a/business/references/gateway_references.go b/business/references/gateway_references.go
index fac70d040..e79e6171e 100644
--- a/business/references/gateway_references.go
+++ b/business/references/gateway_references.go
@@ -13,7 +13,7 @@ import (
 type GatewayReferences struct {
 	Gateways              []*networking_v1.Gateway
 	VirtualServices       []*networking_v1.VirtualService
-	WorkloadsPerNamespace map[string]models.WorkloadList
+	WorkloadsPerNamespace map[string]models.Workloads
 }
 
 func (n GatewayReferences) References() models.IstioReferencesMap {
@@ -38,11 +38,11 @@ func (n GatewayReferences) getWorkloadReferences(gw *networking_v1.Gateway) []mo
 	selector := labels.SelectorFromSet(gw.Spec.Selector)
 
 	// Gateway searches Workloads from all namespace
-	for _, wls := range n.WorkloadsPerNamespace {
-		for _, wl := range wls.Workloads {
+	for ns, workloads := range n.WorkloadsPerNamespace {
+		for _, wl := range workloads {
 			wlLabelSet := labels.Set(wl.Labels)
 			if selector.Matches(wlLabelSet) {
-				result = append(result, models.WorkloadReference{Name: wl.Name, Namespace: wls.Namespace})
+				result = append(result, models.WorkloadReference{Name: wl.Name, Namespace: ns})
 			}
 		}
 	}
diff --git a/business/references/k8s_gateway_references.go b/business/references/k8s_gateway_references.go
index 7940ab6e7..34390851f 100644
--- a/business/references/k8s_gateway_references.go
+++ b/business/references/k8s_gateway_references.go
@@ -12,7 +12,7 @@ type K8sGatewayReferences struct {
 	K8sGateways           []*k8s_networking_v1.Gateway
 	K8sHTTPRoutes         []*k8s_networking_v1.HTTPRoute
 	K8sGRPCRoutes         []*k8s_networking_v1.GRPCRoute
-	WorkloadsPerNamespace map[string]models.WorkloadList
+	WorkloadsPerNamespace map[string]models.Workloads
 }
 
 func (g K8sGatewayReferences) References() models.IstioReferencesMap {
@@ -33,9 +33,9 @@ func (g K8sGatewayReferences) getWorkloadReferences(gw *k8s_networking_v1.Gatewa
 	result := make([]models.WorkloadReference, 0)
 
 	// Gateway searches Workloads from own namespace and Gateway Label
-	for _, wl := range g.WorkloadsPerNamespace[gw.Namespace].Workloads {
-		if gw.Name == wl.Labels[config.Get().IstioLabels.AmbientWaypointGatewayLabel] {
-			result = append(result, models.WorkloadReference{Name: wl.Name, Namespace: gw.Namespace})
+	for _, w := range g.WorkloadsPerNamespace[gw.Namespace] {
+		if gw.Name == w.Labels[config.Get().IstioLabels.AmbientWaypointGatewayLabel] {
+			result = append(result, models.WorkloadReference{Name: w.Name, Namespace: gw.Namespace})
 		}
 	}
 	return result
diff --git a/business/references/peer_auth_references.go b/business/references/peer_auth_references.go
index 6a0157eb7..9d1530e2e 100644
--- a/business/references/peer_auth_references.go
+++ b/business/references/peer_auth_references.go
@@ -13,7 +13,7 @@ import (
 
 type PeerAuthReferences struct {
 	MTLSDetails           kubernetes.MTLSDetails
-	WorkloadsPerNamespace map[string]models.WorkloadList
+	WorkloadsPerNamespace map[string]models.Workloads
 }
 
 func (n PeerAuthReferences) References() models.IstioReferencesMap {
@@ -101,10 +101,10 @@ func (n PeerAuthReferences) getWorkloadReferences(pa *security_v1.PeerAuthentica
 		selector := labels.SelectorFromSet(pa.Spec.Selector.MatchLabels)
 
 		// PeerAuth searches Workloads from own namespace
-		for _, wl := range n.WorkloadsPerNamespace[pa.Namespace].Workloads {
-			wlLabelSet := labels.Set(wl.Labels)
+		for _, w := range n.WorkloadsPerNamespace[pa.Namespace] {
+			wlLabelSet := labels.Set(w.Labels)
 			if selector.Matches(wlLabelSet) {
-				result = append(result, models.WorkloadReference{Name: wl.Name, Namespace: pa.Namespace})
+				result = append(result, models.WorkloadReference{Name: w.Name, Namespace: pa.Namespace})
 			}
 		}
 	}
diff --git a/business/references/sidecar_references.go b/business/references/sidecar_references.go
index 9d39aebb1..4aa7a1c13 100644
--- a/business/references/sidecar_references.go
+++ b/business/references/sidecar_references.go
@@ -18,7 +18,7 @@ type SidecarReferences struct {
 	Namespaces            models.Namespaces
 	ServiceEntries        []*networking_v1.ServiceEntry
 	RegistryServices      []*kubernetes.RegistryService
-	WorkloadsPerNamespace map[string]models.WorkloadList
+	WorkloadsPerNamespace map[string]models.Workloads
 }
 
 func (n SidecarReferences) References() models.IstioReferencesMap {
@@ -106,10 +106,10 @@ func (n SidecarReferences) getWorkloadReferences(sc *networking_v1.Sidecar) []mo
 		selector := labels.SelectorFromSet(sc.Spec.WorkloadSelector.Labels)
 
 		// Sidecar searches Workloads from own namespace
-		for _, wl := range n.WorkloadsPerNamespace[sc.Namespace].Workloads {
-			wlLabelSet := labels.Set(wl.Labels)
+		for _, w := range n.WorkloadsPerNamespace[sc.Namespace] {
+			wlLabelSet := labels.Set(w.Labels)
 			if selector.Matches(wlLabelSet) {
-				result = append(result, models.WorkloadReference{Name: wl.Name, Namespace: sc.Namespace})
+				result = append(result, models.WorkloadReference{Name: w.Name, Namespace: sc.Namespace})
 			}
 		}
 	}
diff --git a/business/references/workloadgroup_references.go b/business/references/workloadgroup_references.go
index c8446ea15..b387ba524 100644
--- a/business/references/workloadgroup_references.go
+++ b/business/references/workloadgroup_references.go
@@ -12,7 +12,7 @@ import (
 type WorkloadGroupReferences struct {
 	WorkloadGroups        []*networking_v1.WorkloadGroup
 	WorkloadEntries       []*networking_v1.WorkloadEntry
-	WorkloadsPerNamespace map[string]models.WorkloadList
+	WorkloadsPerNamespace map[string]models.Workloads
 }
 
 func (n WorkloadGroupReferences) References() models.IstioReferencesMap {
@@ -33,10 +33,10 @@ func (n WorkloadGroupReferences) getWorkloadReferences(wg *networking_v1.Workloa
 	result := make([]models.WorkloadReference, 0)
 
 	// Searches Workloads from all namespace
-	for _, wls := range n.WorkloadsPerNamespace {
-		for _, wl := range wls.Workloads {
-			if wg.Namespace == wls.Namespace && wg.Name == wl.Name {
-				result = append(result, models.WorkloadReference{Name: wl.Name, Namespace: wls.Namespace})
+	for ns, workloads := range n.WorkloadsPerNamespace {
+		for _, w := range workloads {
+			if wg.Namespace == ns && wg.Name == w.Name {
+				result = append(result, models.WorkloadReference{Name: w.Name, Namespace: ns})
 			}
 		}
 	}
diff --git a/business/services.go b/business/services.go
index 2bbb28960..b6935e9e5 100644
--- a/business/services.go
+++ b/business/services.go
@@ -581,11 +581,12 @@ func (in *SvcService) GetServiceDetails(ctx context.Context, cluster, namespace,
 		return nil, err
 	}
 
+	config := config.Get()
 	wo := models.WorkloadOverviews{}
 	isAmbient := len(ws) > 0
 	for _, w := range ws {
 		wi := &models.WorkloadListItem{}
-		wi.ParseWorkload(w)
+		wi.ParseWorkload(w, config)
 		wo = append(wo, wi)
 		// The service is not marked as Ambient if any of the workloads is Ambient
 		if !w.IsAmbient {
diff --git a/business/workloads.go b/business/workloads.go
index 9afe925cb..7d5d3fd46 100644
--- a/business/workloads.go
+++ b/business/workloads.go
@@ -8,6 +8,7 @@ import (
 	"io"
 	"net/http"
 	"regexp"
+	"slices"
 	"sort"
 	"strconv"
 	"strings"
@@ -148,7 +149,7 @@ func (in *WorkloadService) isWorkloadValid(workloadType string) bool {
 }
 
 // @TODO do validations per cluster
-func (in *WorkloadService) getWorkloadValidations(authpolicies []*security_v1.AuthorizationPolicy, workloadsPerNamespace map[string]models.WorkloadList) models.IstioValidations {
+func (in *WorkloadService) getWorkloadValidations(authpolicies []*security_v1.AuthorizationPolicy, workloadsPerNamespace map[string]models.Workloads) models.IstioValidations {
 	validations := checkers.WorkloadChecker{
 		AuthorizationPolicies: authpolicies,
 		WorkloadsPerNamespace: workloadsPerNamespace,
@@ -283,7 +284,7 @@ func (in *WorkloadService) GetWorkloadList(ctx context.Context, criteria Workloa
 
 	for _, w := range ws {
 		wItem := &models.WorkloadListItem{Health: *models.EmptyWorkloadHealth()}
-		wItem.ParseWorkload(w)
+		wItem.ParseWorkload(w, in.config)
 		if istioConfigList, ok := istioConfigMap[cluster]; ok && criteria.IncludeIstioResources {
 			wItem.IstioReferences = FilterUniqueIstioReferences(FilterWorkloadReferences(in.config, wItem.Labels, istioConfigList, cluster))
 		}
@@ -301,8 +302,8 @@ func (in *WorkloadService) GetWorkloadList(ctx context.Context, criteria Workloa
 	for _, istioConfigList := range istioConfigMap {
 		// @TODO multi cluster validations
 		authpolicies := istioConfigList.AuthorizationPolicies
-		allWorkloads := map[string]models.WorkloadList{}
-		allWorkloads[namespace] = *workloadList
+		allWorkloads := map[string]models.Workloads{}
+		allWorkloads[namespace] = ws
 		validations := in.getWorkloadValidations(authpolicies, allWorkloads)
 		validations.StripIgnoredChecks()
 		workloadList.Validations = workloadList.Validations.MergeValidations(validations)
@@ -1426,19 +1427,26 @@ func (in *WorkloadService) fetchWorkloadsFromCluster(ctx context.Context, cluste
 			w.SetPods(cPods)
 		}
 
-		// Add the Proxy Status to the workload
-		for _, pod := range w.Pods {
-			isWaypoint := w.IsWaypoint()
-			if config.Get().ExternalServices.Istio.IstioAPIEnabled && (pod.HasIstioSidecar() || isWaypoint) {
-				pod.ProxyStatus = in.businessLayer.ProxyStatus.GetPodProxyStatus(cluster, namespace, pod.Name, !isWaypoint)
-			}
+		if cnFound {
 			// Add the Proxy Status to the workload
-			if pod.AmbientEnabled() {
-				w.WaypointWorkloads = in.GetWaypointsForWorkload(ctx, *w, false)
+			for _, pod := range w.Pods {
+				isWaypoint := w.IsWaypoint()
+				if in.config.ExternalServices.Istio.IstioAPIEnabled && (pod.HasIstioSidecar() || isWaypoint) {
+					pod.ProxyStatus = in.businessLayer.ProxyStatus.GetPodProxyStatus(cluster, namespace, pod.Name, !isWaypoint)
+				}
+				// Add the Proxy Status to the workload
+				if pod.AmbientEnabled() {
+					w.WaypointWorkloads = in.GetWaypointsForWorkload(ctx, *w, false)
+				}
 			}
-		}
 
-		if cnFound {
+			// Add some precalculated fields useful for validation
+			w.ValidationKey = fmt.Sprintf("%s:%s:%s", w.Cluster, w.Namespace, w.Name)
+
+			w.ServiceAccountNames = w.Pods.ServiceAccounts()
+			slices.Sort(w.ServiceAccountNames)
+			w.ValidationVersion = fmt.Sprintf("%v:%v", w.Labels, w.ServiceAccountNames)
+
 			ws = append(ws, w)
 		}
 	}
@@ -2113,7 +2121,7 @@ func (in *WorkloadService) fetchWorkload(ctx context.Context, criteria WorkloadC
 
 		// Add the Proxy Status to the workload
 		for _, pod := range w.Pods {
-			if config.Get().ExternalServices.Istio.IstioAPIEnabled && (pod.HasIstioSidecar() || isWaypoint) {
+			if in.config.ExternalServices.Istio.IstioAPIEnabled && (pod.HasIstioSidecar() || isWaypoint) {
 				pod.ProxyStatus = in.businessLayer.ProxyStatus.GetPodProxyStatus(criteria.Cluster, criteria.Namespace, pod.Name, !isWaypoint)
 			}
 			// If Ambient is enabled for pod, check if has any Waypoint proxy
@@ -2170,7 +2178,7 @@ func (in *WorkloadService) GetWaypoints(ctx context.Context) models.Workloads {
 		return in.cache.GetWaypointList()
 	}
 
-	waypoints := []*models.Workload{}
+	waypoints := models.Workloads{}
 
 	for cluster := range in.userClients {
 		gateways, err := in.GetAllWorkloads(ctx, cluster, config.GatewayLabel)
@@ -2506,11 +2514,11 @@ var controllerOrder = map[string]int{
 func controllerPriority(type1, type2 string) string {
 	w1, e1 := controllerOrder[type1]
 	if !e1 {
-		log.Errorf("This controller %s is assigned in a Pod and it's not properly managed", type1)
+		log.Debugf("This controller %s is assigned in a Pod and it's not properly managed", type1)
 	}
 	w2, e2 := controllerOrder[type2]
 	if !e2 {
-		log.Errorf("This controller %s is assigned in a Pod and it's not properly managed", type2)
+		log.Debugf("This controller %s is assigned in a Pod and it's not properly managed", type2)
 	}
 	if w1 >= w2 {
 		return type1
diff --git a/config/config.go b/config/config.go
index 53d8b4f4b..0a5232987 100644
--- a/config/config.go
+++ b/config/config.go
@@ -321,10 +321,11 @@ type IstioConfig struct {
 	IstiodPodMonitoringPort           int               `yaml:"istiod_pod_monitoring_port,omitempty"`
 	// IstiodPollingIntervalSeconds is how often in seconds Kiali will poll istiod(s) for
 	// proxy status and registry services. Polling is not performed if IstioAPIEnabled is false.
-	IstiodPollingIntervalSeconds int             `yaml:"istiod_polling_interval_seconds,omitempty"`
-	Registry                     *RegistryConfig `yaml:"registry,omitempty"`
-	RootNamespace                string          `yaml:"root_namespace,omitempty"`
-	UrlServiceVersion            string          `yaml:"url_service_version"`
+	IstiodPollingIntervalSeconds     int             `yaml:"istiod_polling_interval_seconds,omitempty"`
+	Registry                         *RegistryConfig `yaml:"registry,omitempty"`
+	RootNamespace                    string          `yaml:"root_namespace,omitempty"`
+	UrlServiceVersion                string          `yaml:"url_service_version"`
+	ValidationChangeDetectionEnabled bool            `yaml:"validation_change_detection_enabled,omitempty"`
 	// ValidationReconcileInterval sets how often Kiali will validate Istio configuration.
 	// Validations cannot be disabled at the moment but you can set this to a long period of time.
 	ValidationReconcileInterval *time.Duration `yaml:"validation_reconcile_interval,omitempty"`
@@ -758,6 +759,7 @@ func NewConfig() (c *Config) {
 				IstiodPollingIntervalSeconds:      20,
 				RootNamespace:                     "istio-system",
 				UrlServiceVersion:                 "",
+				ValidationChangeDetectionEnabled:  true,
 				ValidationReconcileInterval:       util.AsPtr(time.Minute),
 				GatewayAPIClasses:                 []GatewayAPIClass{},
 			},
diff --git a/controller/validations.go b/controller/validations.go
index 374fc524e..007e58944 100644
--- a/controller/validations.go
+++ b/controller/validations.go
@@ -14,6 +14,7 @@ import (
 	ctrlsource "sigs.k8s.io/controller-runtime/pkg/source"
 
 	"github.com/kiali/kiali/business"
+	"github.com/kiali/kiali/config"
 	"github.com/kiali/kiali/kubernetes/cache"
 	"github.com/kiali/kiali/log"
 	"github.com/kiali/kiali/models"
@@ -114,30 +115,48 @@ func (r *ValidationsReconciler) Reconcile(ctx context.Context, req ctrl.Request)
 
 	// Check version before performing replace.
 	version := r.kialiCache.Validations().Version()
-	allClusterValidations := make(models.IstioValidations)
+	newValidations := make(models.IstioValidations)
+	prevValidations := r.kialiCache.Validations().Items()
+
+	// If enabled, the same changeMap is used on each Reconcile. It holds the "resource version" of
+	// each object used in the validation, and is then used to look for version changes (or a change in
+	// the number of objects).  We keep it in the cache for sane access.
+	var changeMap business.ValidationChangeMap
+	if config.Get().ExternalServices.Istio.ValidationChangeDetectionEnabled {
+		changeMap = r.kialiCache.ValidationConfig().Items()
+	}
 
 	// validation requires cross-cluster service account information.
-	vInfo, err := r.validationsService.NewValidationInfo(ctx, r.clusters)
+	vInfo, err := r.validationsService.NewValidationInfo(ctx, r.clusters, changeMap)
 	if err != nil {
 		log.Errorf("[ValidationsReconciler] Error creating validation info: %s", err)
 		return ctrl.Result{}, err
 	}
 
 	for _, cluster := range r.clusters {
-		clusterValidations, err := r.validationsService.Validate(ctx, cluster, vInfo)
+		validationPerformed, clusterValidations, err := r.validationsService.Validate(ctx, cluster, vInfo)
 		if err != nil {
-			log.Errorf("[ValidationsReconciler] Error creating validations for cluster %s: %s", cluster, err)
+			log.Errorf("[ValidationsReconciler] Error performing validation for cluster %s: %s", cluster, err)
 			return ctrl.Result{}, err
 		}
 
-		allClusterValidations = allClusterValidations.MergeValidations(clusterValidations)
+		// if there have been no config changes for the cluster, just re-use the prior validations
+		if !validationPerformed {
+			log.Tracef("validations: no changes for cluster [%s], re-using", cluster)
+			clusterValidations = models.IstioValidations(prevValidations).FilterByCluster(cluster)
+		} else {
+			log.Tracef("validations: config changes found for cluster [%s], updating", cluster)
+		}
+
+		newValidations = newValidations.MergeValidations(clusterValidations)
 	}
 
 	if r.kialiCache.Validations().Version() != version {
 		return ctrl.Result{}, fmt.Errorf("validations have been updated since reconciling started. Requeuing validation")
 	}
 
-	r.kialiCache.Validations().Replace(allClusterValidations)
+	r.kialiCache.Validations().Replace(newValidations)
+	r.kialiCache.ValidationConfig().Replace(changeMap)
 
 	return ctrl.Result{}, nil
 }
diff --git a/frontend/src/types/IstioConfigList.ts b/frontend/src/types/IstioConfigList.ts
index ce81538d8..6bd3015bf 100644
--- a/frontend/src/types/IstioConfigList.ts
+++ b/frontend/src/types/IstioConfigList.ts
@@ -286,8 +286,8 @@ export const vsToIstioItems = (
   cluster?: string
 ): IstioConfigItem[] => {
   const istioItems: IstioConfigItem[] = [];
-  const hasValidations = (vKey: string): ObjectValidation =>
-    validations.virtualservice && validations.virtualservice[vKey];
+  const objectGVK = getGVKTypeString(gvkType.VirtualService);
+  const hasValidations = (vKey: string): ObjectValidation => validations[objectGVK] && validations[objectGVK][vKey];
 
   vss.forEach(vs => {
     const vKey = validationKey(vs.metadata.name, vs.metadata.namespace);
@@ -301,7 +301,7 @@ export const vsToIstioItems = (
       creationTimestamp: vs.metadata.creationTimestamp,
       resource: vs,
       resourceVersion: vs.metadata.resourceVersion,
-      validation: hasValidations(vKey) ? validations.virtualservice[vKey] : undefined
+      validation: hasValidations(vKey) ? validations[objectGVK][vKey] : undefined
     };
 
     istioItems.push(item);
@@ -316,8 +316,8 @@ export const drToIstioItems = (
   cluster?: string
 ): IstioConfigItem[] => {
   const istioItems: IstioConfigItem[] = [];
-  const hasValidations = (vKey: string): ObjectValidation =>
-    validations.destinationrule && validations.destinationrule[vKey];
+  const objectGVK = getGVKTypeString(gvkType.DestinationRule);
+  const hasValidations = (vKey: string): ObjectValidation => validations[objectGVK] && validations[objectGVK][vKey];
 
   drs.forEach(dr => {
     const vKey = validationKey(dr.metadata.name, dr.metadata.namespace);
@@ -331,7 +331,7 @@ export const drToIstioItems = (
       creationTimestamp: dr.metadata.creationTimestamp,
       resource: dr,
       resourceVersion: dr.metadata.resourceVersion,
-      validation: hasValidations(vKey) ? validations.destinationrule[vKey] : undefined
+      validation: hasValidations(vKey) ? validations[objectGVK][vKey] : undefined
     };
 
     istioItems.push(item);
@@ -347,7 +347,8 @@ export const gwToIstioItems = (
   cluster?: string
 ): IstioConfigItem[] => {
   const istioItems: IstioConfigItem[] = [];
-  const hasValidations = (vKey: string): ObjectValidation => validations.gateway && validations.gateway[vKey];
+  const objectGVK = getGVKTypeString(gvkType.Gateway);
+  const hasValidations = (vKey: string): ObjectValidation => validations[objectGVK] && validations[objectGVK][vKey];
   const vsGateways = new Set();
 
   vss.forEach(vs => {
@@ -373,7 +374,7 @@ export const gwToIstioItems = (
         creationTimestamp: gw.metadata.creationTimestamp,
         resource: gw,
         resourceVersion: gw.metadata.resourceVersion,
-        validation: hasValidations(vKey) ? validations.gateway[vKey] : undefined
+        validation: hasValidations(vKey) ? validations[objectGVK][vKey] : undefined
       };
 
       istioItems.push(item);
@@ -392,7 +393,8 @@ export const k8sGwToIstioItems = (
   gatewayLabel?: string
 ): IstioConfigItem[] => {
   const istioItems: IstioConfigItem[] = [];
-  const hasValidations = (vKey: string): ObjectValidation => validations.k8sgateway && validations.k8sgateway[vKey];
+  const objectGVK = getGVKTypeString(gvkType.K8sGateway);
+  const hasValidations = (vKey: string): ObjectValidation => validations[objectGVK] && validations[objectGVK][vKey];
   const k8sGateways = new Set();
 
   k8srs.forEach(k8sr => {
@@ -430,7 +432,7 @@ export const k8sGwToIstioItems = (
         creationTimestamp: gw.metadata.creationTimestamp,
         resource: gw,
         resourceVersion: gw.metadata.resourceVersion,
-        validation: hasValidations(vKey) ? validations.k8sgateway[vKey] : undefined
+        validation: hasValidations(vKey) ? validations[objectGVK][vKey] : undefined
       };
 
       istioItems.push(item);
@@ -442,7 +444,8 @@ export const k8sGwToIstioItems = (
 
 export const seToIstioItems = (see: ServiceEntry[], validations: Validations, cluster?: string): IstioConfigItem[] => {
   const istioItems: IstioConfigItem[] = [];
-  const hasValidations = (vKey: string): ObjectValidation => validations.serviceentry && validations.serviceentry[vKey];
+  const objectGVK = getGVKTypeString(gvkType.ServiceEntry);
+  const hasValidations = (vKey: string): ObjectValidation => validations[objectGVK] && validations[objectGVK][vKey];
 
   see.forEach(se => {
     const vKey = validationKey(se.metadata.name, se.metadata.namespace);
@@ -456,7 +459,7 @@ export const seToIstioItems = (see: ServiceEntry[], validations: Validations, cl
       creationTimestamp: se.metadata.creationTimestamp,
       resource: se,
       resourceVersion: se.metadata.resourceVersion,
-      validation: hasValidations(vKey) ? validations.serviceentry[vKey] : undefined
+      validation: hasValidations(vKey) ? validations[objectGVK][vKey] : undefined
     };
 
     istioItems.push(item);
@@ -471,7 +474,8 @@ export const k8sHTTPRouteToIstioItems = (
   cluster?: string
 ): IstioConfigItem[] => {
   const istioItems: IstioConfigItem[] = [];
-  const hasValidations = (vKey: string): ObjectValidation => validations.k8shttproute && validations.k8shttproute[vKey];
+  const objectGVK = getGVKTypeString(gvkType.K8sHTTPRoute);
+  const hasValidations = (vKey: string): ObjectValidation => validations[objectGVK] && validations[objectGVK][vKey];
 
   routes.forEach(route => {
     const vKey = validationKey(route.metadata.name, route.metadata.namespace);
@@ -485,7 +489,7 @@ export const k8sHTTPRouteToIstioItems = (
       creationTimestamp: route.metadata.creationTimestamp,
       resource: route,
       resourceVersion: route.metadata.resourceVersion,
-      validation: hasValidations(vKey) ? validations.k8shttproute[vKey] : undefined
+      validation: hasValidations(vKey) ? validations[objectGVK][vKey] : undefined
     };
 
     istioItems.push(item);
@@ -500,7 +504,8 @@ export const k8sGRPCRouteToIstioItems = (
   cluster?: string
 ): IstioConfigItem[] => {
   const istioItems: IstioConfigItem[] = [];
-  const hasValidations = (vKey: string): ObjectValidation => validations.k8sgrpcroute && validations.k8sgrpcroute[vKey];
+  const objectGVK = getGVKTypeString(gvkType.K8sGRPCRoute);
+  const hasValidations = (vKey: string): ObjectValidation => validations[objectGVK] && validations[objectGVK][vKey];
 
   grpcRoutes.forEach(route => {
     const vKey = validationKey(route.metadata.name, route.metadata.namespace);
@@ -514,7 +519,7 @@ export const k8sGRPCRouteToIstioItems = (
       creationTimestamp: route.metadata.creationTimestamp,
       resource: route,
       resourceVersion: route.metadata.resourceVersion,
-      validation: hasValidations(vKey) ? validations.k8sgrpcroute[vKey] : undefined
+      validation: hasValidations(vKey) ? validations[objectGVK][vKey] : undefined
     };
 
     istioItems.push(item);
diff --git a/go.mod b/go.mod
index 7fa298cc0..ee1916998 100644
--- a/go.mod
+++ b/go.mod
@@ -12,8 +12,8 @@ require (
 	github.com/gorilla/mux v1.8.1
 	github.com/mitchellh/mapstructure v1.4.3
 	github.com/nitishm/engarde v0.1.1
-	github.com/onsi/ginkgo/v2 v2.19.0
-	github.com/onsi/gomega v1.33.1
+	github.com/onsi/ginkgo/v2 v2.21.0
+	github.com/onsi/gomega v1.35.1
 	github.com/openshift/api v0.0.0-20240109042830-44756aa36879
 	github.com/openshift/client-go v0.0.0-20240109161853-2425b4b6d3b3
 	github.com/prometheus/client_golang v1.19.1
@@ -21,25 +21,25 @@ require (
 	github.com/rs/zerolog v1.20.0
 	github.com/stretchr/testify v1.9.0
 	go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux v0.47.0
-	go.opentelemetry.io/otel v1.28.0
+	go.opentelemetry.io/otel v1.31.0
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.22.0
-	go.opentelemetry.io/otel/sdk v1.28.0
-	go.opentelemetry.io/otel/trace v1.28.0
+	go.opentelemetry.io/otel/sdk v1.31.0
+	go.opentelemetry.io/otel/trace v1.31.0
 	go.uber.org/automaxprocs v1.5.3
 	golang.org/x/exp v0.0.0-20240416160154-fe59bbe5cc7f
-	golang.org/x/oauth2 v0.21.0
+	golang.org/x/oauth2 v0.23.0
 	golang.org/x/sync v0.10.0
-	google.golang.org/genproto/googleapis/api v0.0.0-20240604185151-ef581f913117
-	google.golang.org/grpc v1.66.2
-	google.golang.org/protobuf v1.34.2
+	google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576
+	google.golang.org/grpc v1.69.0
+	google.golang.org/protobuf v1.36.0
 	gopkg.in/yaml.v2 v2.4.0
-	istio.io/api v1.24.3
-	istio.io/client-go v1.24.3
-	k8s.io/api v0.31.1
-	k8s.io/apimachinery v0.31.1
-	k8s.io/client-go v0.31.1
+	istio.io/api v1.25.0
+	istio.io/client-go v1.25.0
+	k8s.io/api v0.32.1
+	k8s.io/apimachinery v0.32.1
+	k8s.io/client-go v0.32.1
 	sigs.k8s.io/controller-runtime v0.19.1
 	sigs.k8s.io/gateway-api v1.2.1
 )
@@ -61,18 +61,16 @@ require (
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
-	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/google/gnostic-models v0.6.8 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af // indirect
+	github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/websocket v1.5.1 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 // indirect
-	github.com/imdario/mergo v0.3.16 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/moby/spdystream v0.4.0 // indirect
+	github.com/moby/spdystream v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
@@ -85,7 +83,7 @@ require (
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/vjeantet/grok v1.0.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	go.opentelemetry.io/otel/metric v1.28.0 // indirect
+	go.opentelemetry.io/otel/metric v1.31.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.26.0 // indirect
@@ -94,20 +92,20 @@ require (
 	golang.org/x/sys v0.28.0 // indirect
 	golang.org/x/term v0.27.0 // indirect
 	golang.org/x/text v0.21.0 // indirect
-	golang.org/x/time v0.5.0 // indirect
-	golang.org/x/tools v0.24.0 // indirect
+	golang.org/x/time v0.7.0 // indirect
+	golang.org/x/tools v0.26.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/go-jose/go-jose.v2 v2.6.3 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/apiextensions-apiserver v0.31.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20240423202451-8948a665c108 // indirect
-	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
-	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f // indirect
+	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
+	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.5.0 // indirect
 	sigs.k8s.io/yaml v1.4.0 // indirect
 )
 
diff --git a/go.sum b/go.sum
index 672565d83..8cba35f8b 100644
--- a/go.sum
+++ b/go.sum
@@ -46,8 +46,6 @@ github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1v
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
@@ -58,8 +56,8 @@ github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af h1:kmjWCqn2qkEml422C2Rrd27c3VGxi6a/6HNq8QmHRKM=
-github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
@@ -68,8 +66,6 @@ github.com/gorilla/websocket v1.5.1 h1:gmztn0JnHVt9JZquRuzLw3g4wouNVzKL15iLr/zn/
 github.com/gorilla/websocket v1.5.1/go.mod h1:x3kM2JMyaluk02fnUJpQuwD2dCS5NDG2ZHL0uE0tcaY=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 h1:bkypFPDjIYGfCYD5mRBvpqxfYX1YCS1PXdKYWi8FsN0=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0/go.mod h1:P+Lt/0by1T8bfcF3z737NnSbmxQAppXMRziHUxPOC8k=
-github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
-github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/jpillora/backoff v1.0.0 h1:uvFg412JmmHBHw7iwprIxkPMI+sGQ4kzOWsMeHnm2EA=
@@ -87,8 +83,8 @@ github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJ
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.4.3 h1:OVowDSCllw/YjdLkam3/sm7wEtOy59d8ndGgCcyj8cs=
 github.com/mitchellh/mapstructure v1.4.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/moby/spdystream v0.4.0 h1:Vy79D6mHeJJjiPdFEL2yku1kl0chZpJfZcPpb16BRl8=
-github.com/moby/spdystream v0.4.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
+github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU=
+github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -102,10 +98,10 @@ github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
 github.com/nitishm/engarde v0.1.1 h1:+hT7EGP64L1wKnIv64xzu94oSR3n+SFqcsDHiGDcTVQ=
 github.com/nitishm/engarde v0.1.1/go.mod h1:nlzhv5c2J4WL9e/Y8sebkZ2PJBY790US8d+Z/vS/qqY=
-github.com/onsi/ginkgo/v2 v2.19.0 h1:9Cnnf7UHo57Hy3k6/m5k3dRfGTMXGvxhHFvkDTCTpvA=
-github.com/onsi/ginkgo/v2 v2.19.0/go.mod h1:rlwLi9PilAFJ8jCg9UE1QP6VBpd6/xj3SRC0d6TU0To=
-github.com/onsi/gomega v1.33.1 h1:dsYjIxxSR755MDmKVsaFQTE22ChNBcuuTWgkUDSubOk=
-github.com/onsi/gomega v1.33.1/go.mod h1:U4R44UsT+9eLIaYRB2a5qajjtQYn0hauxvRm16AVYg0=
+github.com/onsi/ginkgo/v2 v2.21.0 h1:7rg/4f3rB88pb5obDgNZrNHrQ4e6WpjonchcpuBRnZM=
+github.com/onsi/ginkgo/v2 v2.21.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
+github.com/onsi/gomega v1.35.1 h1:Cwbd75ZBPxFSuZ6T+rN/WCb/gOc6YgFBXLlZLhC7Ds4=
+github.com/onsi/gomega v1.35.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
 github.com/openshift/api v0.0.0-20240109042830-44756aa36879 h1:9JfgDtOi0be+p2HsXwIahS8rXlt4MQRj6Vlpmx1DDg8=
 github.com/openshift/api v0.0.0-20240109042830-44756aa36879/go.mod h1:qNtV0315F+f8ld52TLtPvrfivZpdimOzTi3kn9IVbtU=
 github.com/openshift/client-go v0.0.0-20240109161853-2425b4b6d3b3 h1:XQv/z/1tedDGPeplmowftfUUrR3BtglN6Hv5kLzy1CU=
@@ -147,20 +143,22 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux v0.47.0 h1:yPWywmjyhn5C64Z7OLdIfjnbwOQF/Xz89HNqSVquC2E=
 go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux v0.47.0/go.mod h1:jk2INQzOTr9e27FwMs2JVXXttZc/3bucJX/7l3YVfbw=
-go.opentelemetry.io/otel v1.28.0 h1:/SqNcYk+idO0CxKEUOtKQClMK/MimZihKYMruSMViUo=
-go.opentelemetry.io/otel v1.28.0/go.mod h1:q68ijF8Fc8CnMHKyzqL6akLO46ePnjkgfIMIjUIX9z4=
+go.opentelemetry.io/otel v1.31.0 h1:NsJcKPIW0D0H3NgzPDHmo0WW6SptzPdqg/L1zsIm2hY=
+go.opentelemetry.io/otel v1.31.0/go.mod h1:O0C14Yl9FgkjqcCZAsE053C13OaddMYr/hz6clDkEJE=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 h1:3Q/xZUyC1BBkualc9ROb4G8qkH90LXEIICcs5zv1OYY=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0/go.mod h1:s75jGIWA9OfCMzF0xr+ZgfrB5FEbbV7UuYo32ahUiFI=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 h1:qFffATk0X+HD+f1Z8lswGiOQYKHRlzfmdJm0wEaVrFA=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0/go.mod h1:MOiCmryaYtc+V0Ei+Tx9o5S1ZjA7kzLucuVuyzBZloQ=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.22.0 h1:FyjCyI9jVEfqhUh2MoSkmolPjfh5fp2hnV0b0irxH4Q=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.22.0/go.mod h1:hYwym2nDEeZfG/motx0p7L7J1N1vyzIThemQsb4g2qY=
-go.opentelemetry.io/otel/metric v1.28.0 h1:f0HGvSl1KRAU1DLgLGFjrwVyismPlnuU6JD6bOeuA5Q=
-go.opentelemetry.io/otel/metric v1.28.0/go.mod h1:Fb1eVBFZmLVTMb6PPohq3TO9IIhUisDsbJoL/+uQW4s=
-go.opentelemetry.io/otel/sdk v1.28.0 h1:b9d7hIry8yZsgtbmM0DKyPWMMUMlK9NEKuIG4aBqWyE=
-go.opentelemetry.io/otel/sdk v1.28.0/go.mod h1:oYj7ClPUA7Iw3m+r7GeEjz0qckQRJK2B8zjcZEfu7Pg=
-go.opentelemetry.io/otel/trace v1.28.0 h1:GhQ9cUuQGmNDd5BTCP2dAvv75RdMxEfTmYejp+lkx9g=
-go.opentelemetry.io/otel/trace v1.28.0/go.mod h1:jPyXzNPg6da9+38HEwElrQiHlVMTnVfM3/yv2OlIHaI=
+go.opentelemetry.io/otel/metric v1.31.0 h1:FSErL0ATQAmYHUIzSezZibnyVlft1ybhy4ozRPcF2fE=
+go.opentelemetry.io/otel/metric v1.31.0/go.mod h1:C3dEloVbLuYoX41KpmAhOqNriGbA+qqH6PQ5E5mUfnY=
+go.opentelemetry.io/otel/sdk v1.31.0 h1:xLY3abVHYZ5HSfOg3l2E5LUj2Cwva5Y7yGxnSW9H5Gk=
+go.opentelemetry.io/otel/sdk v1.31.0/go.mod h1:TfRbMdhvxIIr/B2N2LQW2S5v9m3gOQ/08KsbbO5BPT0=
+go.opentelemetry.io/otel/sdk/metric v1.31.0 h1:i9hxxLJF/9kkvfHppyLL55aW7iIJz4JjxTeYusH7zMc=
+go.opentelemetry.io/otel/sdk/metric v1.31.0/go.mod h1:CRInTMVvNhUKgSAMbKyTMxqOBC0zgyxzW55lZzX43Y8=
+go.opentelemetry.io/otel/trace v1.31.0 h1:ffjsj1aRouKewfr85U2aGagJ46+MvodynlQ1HYdmJys=
+go.opentelemetry.io/otel/trace v1.31.0/go.mod h1:TXZkRk7SM2ZQLtR6eoAWQFIHPvzQ06FJAsO1tJg480A=
 go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
 go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
 go.uber.org/automaxprocs v1.5.3 h1:kWazyxZUrS3Gs4qUpbwo5kEIMGe/DAvi5Z4tl2NW4j8=
@@ -186,8 +184,8 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs=
-golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/oauth2 v0.23.0 h1:PbgcYx2W7i4LvjJWEbf0ngHV6qJYr86PkAV3bXdLEbs=
+golang.org/x/oauth2 v0.23.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -204,29 +202,29 @@ golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
-golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.7.0 h1:ntUhktv3OPE6TgYxXWv9vKvUSJyIFJlyohwbkEwPrKQ=
+golang.org/x/time v0.7.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190828213141-aed303cbaa74/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.24.0 h1:J1shsA93PJUEVaUSaay7UXAyE8aimq3GW0pjlolpa24=
-golang.org/x/tools v0.24.0/go.mod h1:YhNqVBIfWHdzvTLs0d8LCuMhkKUgSUKldakyV7W/WDQ=
+golang.org/x/tools v0.26.0 h1:v/60pFQmzmT9ExmjDv2gGIfi3OqfKoEP6I5+umXlbnQ=
+golang.org/x/tools v0.26.0/go.mod h1:TPVVj70c7JJ3WCazhD8OdXcZg/og+b9+tH/KxylGwH0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
 gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
-google.golang.org/genproto/googleapis/api v0.0.0-20240604185151-ef581f913117 h1:+rdxYoE3E5htTEWIe15GlN6IfvbURM//Jt0mmkmm6ZU=
-google.golang.org/genproto/googleapis/api v0.0.0-20240604185151-ef581f913117/go.mod h1:OimBR/bc1wPO9iV4NC2bpyjy3VnAwZh5EBPQdtaE5oo=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 h1:BwIjyKYGsK9dMCBOorzRri8MQwmi7mT9rGHsCEinZkA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
-google.golang.org/grpc v1.66.2 h1:3QdXkuq3Bkh7w+ywLdLvM56cmGvQHUMZpiCzt6Rqaoo=
-google.golang.org/grpc v1.66.2/go.mod h1:s3/l6xSSCURdVfAnL+TqCNMyTDAGN6+lZeVxnZR128Y=
-google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
-google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
+google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 h1:CkkIfIt50+lT6NHAVoRYEyAvQGFM7xEwXUUywFvEb3Q=
+google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576/go.mod h1:1R3kvZ1dtP3+4p4d3G8uJ8rFk/fWlScl38vanWACI08=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 h1:8ZmaLZE4XWrtU3MyClkYqqtl6Oegr3235h7jxsDyqCY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576/go.mod h1:5uTbfoYQed2U9p3KIj2/Zzm02PYhndfdmML0qC3q3FU=
+google.golang.org/grpc v1.69.0 h1:quSiOM1GJPmPH5XtU+BCoVXcDVJJAzNcoyfC2cCjGkI=
+google.golang.org/grpc v1.69.0/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
+google.golang.org/protobuf v1.36.0 h1:mjIs9gYtt56AzC4ZaffQuh88TZurBGhIJMBZGSxNerQ=
+google.golang.org/protobuf v1.36.0/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -236,36 +234,35 @@ gopkg.in/go-jose/go-jose.v2 v2.6.3 h1:nt80fvSDlhKWQgSWyHyy5CfmlQr+asih51R8PTWNKK
 gopkg.in/go-jose/go-jose.v2 v2.6.3/go.mod h1:zzZDPkNNw/c9IE7Z9jr11mBZQhKQTMzoEEIoEdZlFBI=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-istio.io/api v1.24.3 h1:iwWWPM0uEQ+oxRHvIWoB8MQ4bjF3dRQj+M5IDVczg0M=
-istio.io/api v1.24.3/go.mod h1:MQnRok7RZ20/PE56v0LxmoWH0xVxnCQPNuf9O7PAN1I=
-istio.io/client-go v1.24.3 h1:TB8IcM3yyMCDzKRJo0YfFOUGNQmkhwH/JE/Yr3lzVAk=
-istio.io/client-go v1.24.3/go.mod h1:zSyw/c4luKQKosFIHQaWAQOA0c3bODu4SahQCAMlKA4=
-k8s.io/api v0.31.1 h1:Xe1hX/fPW3PXYYv8BlozYqw63ytA92snr96zMW9gWTU=
-k8s.io/api v0.31.1/go.mod h1:sbN1g6eY6XVLeqNsZGLnI5FwVseTrZX7Fv3O26rhAaI=
+istio.io/api v1.25.0 h1:UVQNFUAz4R06NagA+QpEzLmi4sw+m+UuMgD6sIyXawA=
+istio.io/api v1.25.0/go.mod h1:QFzEXv/IT582T0FHZVp1QoolvE4ws0zz/vVO55blmlE=
+istio.io/client-go v1.25.0 h1:MMG8r1g+o2yEzVwi0AGSdB6EQyLEhYz8YMYQQIw8IZw=
+istio.io/client-go v1.25.0/go.mod h1:Y4qIjNIVCkpZMiq/e3C7tMjOm7aYUbxT6ebtmai1TRY=
+k8s.io/api v0.32.1 h1:f562zw9cy+GvXzXf0CKlVQ7yHJVYzLfL6JAS4kOAaOc=
+k8s.io/api v0.32.1/go.mod h1:/Yi/BqkuueW1BgpoePYBRdDYfjPF5sgTr5+YqDZra5k=
 k8s.io/apiextensions-apiserver v0.31.1 h1:L+hwULvXx+nvTYX/MKM3kKMZyei+UiSXQWciX/N6E40=
 k8s.io/apiextensions-apiserver v0.31.1/go.mod h1:tWMPR3sgW+jsl2xm9v7lAyRF1rYEK71i9G5dRtkknoQ=
-k8s.io/apimachinery v0.31.1 h1:mhcUBbj7KUjaVhyXILglcVjuS4nYXiwC+KKFBgIVy7U=
-k8s.io/apimachinery v0.31.1/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
-k8s.io/client-go v0.31.1 h1:f0ugtWSbWpxHR7sjVpQwuvw9a3ZKLXX0u0itkFXufb0=
-k8s.io/client-go v0.31.1/go.mod h1:sKI8871MJN2OyeqRlmA4W4KM9KBdBUpDLu/43eGemCg=
+k8s.io/apimachinery v0.32.1 h1:683ENpaCBjma4CYqsmZyhEzrGz6cjn1MY/X2jB2hkZs=
+k8s.io/apimachinery v0.32.1/go.mod h1:GpHVgxoKlTxClKcteaeuF1Ul/lDVb74KpZcxcmLDElE=
+k8s.io/client-go v0.32.1 h1:otM0AxdhdBIaQh7l1Q0jQpmo7WOFIk5FFa4bg6YMdUU=
+k8s.io/client-go v0.32.1/go.mod h1:aTTKZY7MdxUaJ/KiUs8D+GssR9zJZi77ZqtzcGXIiDg=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20240423202451-8948a665c108 h1:Q8Z7VlGhcJgBHJHYugJ/K/7iB8a2eSxCyxdVjJp+lLY=
-k8s.io/kube-openapi v0.0.0-20240423202451-8948a665c108/go.mod h1:yD4MZYeKMBwQKVht279WycxKyM84kkAx2DPrTXaeb98=
-k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A=
-k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f h1:GA7//TjRY9yWGy1poLzYYJJ4JRdzg3+O6e8I+e+8T5Y=
+k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f/go.mod h1:R/HEjbvWI0qdfb8viZUeVZm0X6IZnxAydC7YU42CMw4=
+k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
+k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/controller-runtime v0.19.1 h1:Son+Q40+Be3QWb+niBXAg2vFiYWolDjjRfO8hn/cxOk=
 sigs.k8s.io/controller-runtime v0.19.1/go.mod h1:iRmWllt8IlaLjvTTDLhRBXIEtkCK6hwVBJJsYS9Ajf4=
 sigs.k8s.io/gateway-api v1.2.1 h1:fZZ/+RyRb+Y5tGkwxFKuYuSRQHu9dZtbjenblleOLHM=
 sigs.k8s.io/gateway-api v1.2.1/go.mod h1:EpNfEXNjiYfUJypf0eZ0P5iXA9ekSGWaS1WgPaM42X0=
-sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
-sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
-sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
+sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
+sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
+sigs.k8s.io/structured-merge-diff/v4 v4.5.0 h1:nbCitCK2hfnhyiKo6uf2HxUPTCodY6Qaf85SbDIaMBk=
+sigs.k8s.io/structured-merge-diff/v4 v4.5.0/go.mod h1:N8f93tFZh9U6vpxwRArLiikrE5/2tiu1w1AGfACIGE4=
 sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
 sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
diff --git a/hack/istio/install-istio-via-sail.sh b/hack/istio/install-istio-via-sail.sh
index b2a659dce..e8b3bfb48 100755
--- a/hack/istio/install-istio-via-sail.sh
+++ b/hack/istio/install-istio-via-sail.sh
@@ -108,7 +108,7 @@ fi
 
 ISTIO_YAML=$(
 cat <<EOF
-apiVersion: sailoperator.io/v1alpha1
+apiVersion: sailoperator.io/v1
 kind: Istio
 metadata:
   name: default
@@ -171,7 +171,8 @@ for addon in ${ADDONS}; do
 
     kubectl apply -f https://github.com/open-telemetry/opentelemetry-operator/releases/latest/download/opentelemetry-operator.yaml
     kubectl wait pods --all -n opentelemetry-operator-system --for=condition=Ready --timeout=5m
-
+    # Wait 10 seconds until https://github.com/open-telemetry/opentelemetry-operator/issues/3194 is fixed.
+    sleep 10
     kubectl apply -f ${SCRIPT_DIR}/tempo/otel-collector.yaml
   else
     istio_version=$(kubectl get istios default -o jsonpath='{.spec.version}')
diff --git a/hack/istio/sail/func-sm.sh b/hack/istio/sail/func-sm.sh
index 6364ad36d..d233f5d79 100755
--- a/hack/istio/sail/func-sm.sh
+++ b/hack/istio/sail/func-sm.sh
@@ -145,7 +145,7 @@ install_istio() {
       fi
       infomsg "Installing IstioCNI CR"
       cat <<EOMCNI > ${istiocni_yaml_file}
-apiVersion: sailoperator.io/v1alpha1
+apiVersion: sailoperator.io/v1
 kind: IstioCNI
 metadata:
   name: ${istiocni_name}
@@ -184,7 +184,7 @@ EOMCNI
 
     local istio_yaml_file="/tmp/istio-cr.yaml"
     cat <<EOM > ${istio_yaml_file}
-apiVersion: sailoperator.io/v1alpha1
+apiVersion: sailoperator.io/v1
 kind: Istio
 metadata:
   name: default
diff --git a/kubernetes/cache/cache.go b/kubernetes/cache/cache.go
index 5a62ffd90..edac8e69b 100644
--- a/kubernetes/cache/cache.go
+++ b/kubernetes/cache/cache.go
@@ -79,9 +79,12 @@ type KialiCache interface {
 	ProxyStatusCache
 	ZtunnelDumpCache
 
-	// SetValidations caches validations for a cluster/namespace.
+	// Validations caches validations for a cluster/namespace.
 	Validations() store.Store[models.IstioValidationKey, *models.IstioValidation]
 
+	// ValidationWatcher stores values used for detecting changes in config used for validation
+	ValidationConfig() store.Store[string, string]
+
 	// SetClusters sets the list of clusters that the cache knows about.
 	SetClusters([]models.KubeCluster)
 
@@ -131,7 +134,8 @@ type kialiCacheImpl struct {
 
 	waypointList models.WaypointStore
 	// validations key'd by the validation key
-	validations store.Store[models.IstioValidationKey, *models.IstioValidation]
+	validations      store.Store[models.IstioValidationKey, *models.IstioValidation]
+	validationConfig store.Store[string, string]
 
 	// Info about the kube clusters that the cache knows about.
 	clusters    []models.KubeCluster
@@ -148,6 +152,7 @@ func NewKialiCache(kialiSAClients map[string]kubernetes.ClientInterface, cfg con
 		conf:                    cfg,
 		kubeCache:               make(map[string]KubeCache),
 		validations:             store.New[models.IstioValidationKey, *models.IstioValidation](),
+		validationConfig:        store.New[string, string](),
 		meshStore:               store.NewExpirationStore(ctx, store.New[string, *models.Mesh](), util.AsPtr(meshExpirationTime), nil),
 		namespaceStore:          store.NewExpirationStore(ctx, store.New[namespacesKey, map[string]models.Namespace](), &namespaceKeyTTL, nil),
 		refreshDuration:         time.Duration(cfg.KubernetesConfig.CacheDuration) * time.Second,
@@ -256,6 +261,10 @@ func (c *kialiCacheImpl) Validations() store.Store[models.IstioValidationKey, *m
 	return c.validations
 }
 
+func (c *kialiCacheImpl) ValidationConfig() store.Store[string, string] {
+	return c.validationConfig
+}
+
 // IsAmbientEnabled checks if the istio Ambient profile was enabled
 // by checking if the ztunnel daemonset exists on the cluster.
 func (in *kialiCacheImpl) IsAmbientEnabled(cluster string) bool {
diff --git a/kubernetes/types.go b/kubernetes/types.go
index ebd0ac3ff..b8f0daeed 100644
--- a/kubernetes/types.go
+++ b/kubernetes/types.go
@@ -252,7 +252,8 @@ type IstioService struct {
 		Port     int    `json:"port"`
 		Protocol string `json:"protocol,omitempty"`
 	} `json:"ports"`
-	Hostname string `json:"hostname"`
+	Hostname        string `json:"hostname"`
+	ResourceVersion string `json:"ResourceVersion"`
 	// ClusterVIPs defined in Istio 1.11.x
 	ClusterVIPs11 map[string]string `json:"cluster-vips,omitempty"`
 	// ClusterVIPs defined in Istio 1.12.x
diff --git a/models/istio_validation.go b/models/istio_validation.go
index f72e24fbe..5467c0252 100644
--- a/models/istio_validation.go
+++ b/models/istio_validation.go
@@ -415,6 +415,17 @@ func (iv IstioValidations) FilterByKey(objectGVK schema.GroupVersionKind, name s
 	return fiv
 }
 
+func (iv IstioValidations) FilterByCluster(cluster string) IstioValidations {
+	fiv := IstioValidations{}
+	for k, v := range iv {
+		if v.Cluster == cluster {
+			fiv[k] = v
+		}
+	}
+
+	return fiv
+}
+
 // FilterByTypes takes an input as ObjectTypes, transforms to singular types and filters the validations
 func (iv IstioValidations) FilterByTypes(objectTypes []string) IstioValidations {
 	types := make(map[string]bool, len(objectTypes))
diff --git a/models/workload.go b/models/workload.go
index 4be65342c..971ff5ead 100644
--- a/models/workload.go
+++ b/models/workload.go
@@ -172,6 +172,13 @@ type WorkloadListItem struct {
 
 	// Names of the waypoint proxy workloads, if any
 	WaypointWorkloads []string `json:"waypointWorkloads"`
+
+	// ValidationKey is a pre-calculated key string: "cluster:namespace:name"
+	ValidationKey string
+
+	// ValidationVersion is a pre-calculated string representing the workload "version", basically
+	// the workload information that, if changed, requires re-validation.
+	ValidationVersion string
 }
 
 type WorkloadOverviews []*WorkloadListItem
@@ -278,8 +285,7 @@ type Workloads []*Workload
 
 type WorkloadEntries []*WorkloadEntry
 
-func (workload *WorkloadListItem) ParseWorkload(w *Workload) {
-	conf := config.Get()
+func (workload *WorkloadListItem) ParseWorkload(w *Workload, conf *config.Config) {
 	workload.Name = w.Name
 	workload.Namespace = w.Namespace
 	workload.WorkloadGVK = w.WorkloadGVK
@@ -717,9 +723,9 @@ func (workloads WorkloadOverviews) HasIstioSidecar() bool {
 	return false
 }
 
-func (wl WorkloadList) GetLabels() []labels.Set {
-	wLabels := make([]labels.Set, 0, len(wl.Workloads))
-	for _, w := range wl.Workloads {
+func GetLabels(workloads []*Workload) []labels.Set {
+	wLabels := make([]labels.Set, 0, len(workloads))
+	for _, w := range workloads {
 		wLabels = append(wLabels, labels.Set(w.Labels))
 	}
 	return wLabels
diff --git a/store/threadsafe_store.go b/store/threadsafe_store.go
index b33d2f92f..b488aa975 100644
--- a/store/threadsafe_store.go
+++ b/store/threadsafe_store.go
@@ -1,9 +1,9 @@
 package store
 
 import (
+	"maps"
+	"slices"
 	"sync"
-
-	"golang.org/x/exp/maps"
 )
 
 // threadSafeStore implements the Store interface and is safe for concurrent use.
@@ -25,10 +25,11 @@ func (s *threadSafeStore[K, V]) Get(key K) (V, bool) {
 	return v, found
 }
 
+// Items returns a copy of all items in the store.
 func (s *threadSafeStore[K, V]) Items() map[K]V {
 	s.lock.RLock()
 	defer s.lock.RUnlock()
-	return s.data
+	return maps.Clone(s.data)
 }
 
 // Replace replaces the contents of the store with the given map.
@@ -63,10 +64,12 @@ func (s *threadSafeStore[K, V]) Remove(key K) {
 func (s *threadSafeStore[K, V]) Keys() []K {
 	s.lock.RLock()
 	defer s.lock.RUnlock()
-	return maps.Keys(s.data)
+	return slices.Collect(maps.Keys(s.data))
 }
 
 func (s *threadSafeStore[K, V]) Version() uint {
+	s.lock.RLock()
+	defer s.lock.RUnlock()
 	return s.version
 }
 



Test patch:
diff --git a/business/checkers/common/multi_match_selector_checker_test.go b/business/checkers/common/multi_match_selector_checker_test.go
index a7d1e7776..4201b27d7 100644
--- a/business/checkers/common/multi_match_selector_checker_test.go
+++ b/business/checkers/common/multi_match_selector_checker_test.go
@@ -27,7 +27,7 @@ func TestTwoSidecarsWithSelector(t *testing.T) {
 				"app": "details",
 			}, data.CreateSidecar("sidecar2", "bookinfo")),
 		},
-		workloadList(),
+		workloads(),
 	).Check()
 
 	assert.Empty(validations)
@@ -42,7 +42,7 @@ func TestTwoSidecarsWithoutSelector(t *testing.T) {
 			data.CreateSidecar("sidecar2", "bookinfo"),
 			data.CreateSidecar("sidecar3", "bookinfo2"),
 		},
-		workloadList(),
+		workloads(),
 	).Check()
 
 	assertMultimatchFailure(t, "generic.multimatch.selectorless", validations, "sidecar1", []string{"sidecar2"})
@@ -59,7 +59,7 @@ func TestTwoSidecarsWithoutSelectorDifferentNamespaces(t *testing.T) {
 			data.CreateSidecar("sidecar1", "bookinfo"),
 			data.CreateSidecar("sidecar2", "bookinfo2"),
 		},
-		workloadList(),
+		workloads(),
 	).Check()
 
 	assert.Empty(validations)
@@ -86,7 +86,7 @@ func TestTwoSidecarsTargetingOneDeployment(t *testing.T) {
 		config.Get().KubernetesConfig.ClusterName,
 		kubernetes.Sidecars,
 		sidecars,
-		workloadList(),
+		workloads(),
 	).Check()
 
 	assertMultimatchFailure(t, "generic.multimatch.selector", validations, "sidecar1", []string{"sidecar3", "sidecar4"})
@@ -117,7 +117,7 @@ func TestSidecarsCrossNamespaces(t *testing.T) {
 		config.Get().KubernetesConfig.ClusterName,
 		kubernetes.Sidecars,
 		sidecars,
-		workloadList(),
+		workloads(),
 	).Check()
 
 	assertMultimatchFailure(t, "generic.multimatch.selector", validations, "sidecar1", []string{"sidecar2"})
@@ -149,7 +149,7 @@ func TestSidecarsDifferentNamespaces(t *testing.T) {
 		config.Get().KubernetesConfig.ClusterName,
 		kubernetes.Sidecars,
 		sidecars,
-		workloadList(),
+		workloads(),
 	).Check()
 
 	assert.Empty(validations)
@@ -179,12 +179,12 @@ func assertMultimatchFailure(t *testing.T, code string, vals models.IstioValidat
 	}
 }
 
-func workloadList() map[string]models.WorkloadList {
-	wli := []models.WorkloadListItem{
-		data.CreateWorkloadListItem("details-v1", map[string]string{"app": "details", "version": "v1"}),
-		data.CreateWorkloadListItem("details-v2", map[string]string{"app": "details", "version": "v2"}),
-		data.CreateWorkloadListItem("details-v3", map[string]string{"app": "details", "version": "v3"}),
+func workloads() map[string]models.Workloads {
+	workloads := models.Workloads{
+		data.CreateWorkload("details-v1", map[string]string{"app": "details", "version": "v1"}),
+		data.CreateWorkload("details-v2", map[string]string{"app": "details", "version": "v2"}),
+		data.CreateWorkload("details-v3", map[string]string{"app": "details", "version": "v3"}),
 	}
 
-	return data.CreateWorkloadsPerNamespace([]string{"bookinfo", "bookinfo2", "bookinfo3", "bookinfo4"}, wli...)
+	return data.CreateWorkloadsPerNamespace([]string{"bookinfo", "bookinfo2", "bookinfo3", "bookinfo4"}, workloads)
 }
diff --git a/business/checkers/common/workload_selector_checker_test.go b/business/checkers/common/workload_selector_checker_test.go
index 7e0beec03..fbfb8143d 100644
--- a/business/checkers/common/workload_selector_checker_test.go
+++ b/business/checkers/common/workload_selector_checker_test.go
@@ -20,7 +20,7 @@ func TestPresentWorkloads(t *testing.T) {
 			"app":     "details",
 			"version": "v1",
 		},
-		workloadList(),
+		workloads(),
 	).Check()
 
 	// Well configured object
@@ -32,7 +32,7 @@ func TestPresentWorkloads(t *testing.T) {
 		map[string]string{
 			"app": "details",
 		},
-		workloadList(),
+		workloads(),
 	).Check()
 
 	// Well configured object
@@ -51,14 +51,14 @@ func TestWorkloadNotFound(t *testing.T) {
 }
 
 func testFailureWithWorkloadList(assert *assert.Assertions, selector map[string]string) {
-	testFailure(assert, selector, workloadList(), "generic.selector.workloadnotfound")
+	testFailure(assert, selector, workloads(), "generic.selector.workloadnotfound")
 }
 
 func testFailureWithEmptyWorkloadList(assert *assert.Assertions, selector map[string]string) {
-	testFailure(assert, selector, data.CreateWorkloadsPerNamespace([]string{"test"}, models.WorkloadListItem{}), "generic.selector.workloadnotfound")
+	testFailure(assert, selector, data.CreateWorkloadsPerNamespace([]string{"test"}, models.Workloads{}), "generic.selector.workloadnotfound")
 }
 
-func testFailure(assert *assert.Assertions, selector map[string]string, wl map[string]models.WorkloadList, code string) {
+func testFailure(assert *assert.Assertions, selector map[string]string, wl map[string]models.Workloads, code string) {
 	vals, valid := WorkloadSelectorNoWorkloadFoundChecker(
 		kubernetes.Sidecars,
 		selector,
diff --git a/business/checkers/destinationrules/no_dest_checker_test.go b/business/checkers/destinationrules/no_dest_checker_test.go
index 1c5169951..2a636c53b 100644
--- a/business/checkers/destinationrules/no_dest_checker_test.go
+++ b/business/checkers/destinationrules/no_dest_checker_test.go
@@ -26,10 +26,10 @@ func TestValidHost(t *testing.T) {
 	assert := assert.New(t)
 
 	vals, valid := NoDestinationChecker{
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test-namespace": data.CreateWorkloadList("test-namespace",
-				data.CreateWorkloadListItem("reviewsv1", appVersionLabel("reviews", "v1")),
-				data.CreateWorkloadListItem("reviewsv2", appVersionLabel("reviews", "v2"))),
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test-namespace": {
+				data.CreateWorkload("reviewsv1", appVersionLabel("reviews", "v1")),
+				data.CreateWorkload("reviewsv2", appVersionLabel("reviews", "v2"))},
 		},
 		RegistryServices: data.CreateFakeRegistryServicesLabels("reviews", "test-namespace"),
 		DestinationRule:  data.CreateTestDestinationRule("test-namespace", "name", "reviews"),
@@ -43,10 +43,10 @@ func TestValidWildcardHost(t *testing.T) {
 	assert := assert.New(t)
 
 	vals, valid := NoDestinationChecker{
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test-namespace": data.CreateWorkloadList("test-namespace",
-				data.CreateWorkloadListItem("reviewsv1", appVersionLabel("reviews", "v1")),
-				data.CreateWorkloadListItem("reviewsv2", appVersionLabel("reviews", "v2"))),
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test-namespace": {
+				data.CreateWorkload("reviewsv1", appVersionLabel("reviews", "v1")),
+				data.CreateWorkload("reviewsv2", appVersionLabel("reviews", "v2"))},
 		},
 		RegistryServices: data.CreateFakeRegistryServicesLabels("reviews", "test-namespace"),
 		DestinationRule: data.CreateTestDestinationRule("test-namespace",
@@ -64,10 +64,10 @@ func TestValidMeshWideHost(t *testing.T) {
 	assert := assert.New(t)
 
 	vals, valid := NoDestinationChecker{
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test-namespace": data.CreateWorkloadList("test-namespace",
-				data.CreateWorkloadListItem("reviewsv1", appVersionLabel("reviews", "v1")),
-				data.CreateWorkloadListItem("reviewsv2", appVersionLabel("reviews", "v2"))),
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test-namespace": {
+				data.CreateWorkload("reviewsv1", appVersionLabel("reviews", "v1")),
+				data.CreateWorkload("reviewsv2", appVersionLabel("reviews", "v2"))},
 		},
 		RegistryServices: data.CreateFakeRegistryServicesLabels("reviews", "test-namespace"),
 		DestinationRule:  data.CreateTestDestinationRule("test-namespace", "name", "*.local"),
@@ -84,10 +84,10 @@ func TestValidShortSvcHost(t *testing.T) {
 	assert := assert.New(t)
 
 	vals, valid := NoDestinationChecker{
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test-namespace": data.CreateWorkloadList("test-namespace",
-				data.CreateWorkloadListItem("reviewsv1", appVersionLabel("reviews", "v1")),
-				data.CreateWorkloadListItem("reviewsv2", appVersionLabel("reviews", "v2"))),
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test-namespace": {
+				data.CreateWorkload("reviewsv1", appVersionLabel("reviews", "v1")),
+				data.CreateWorkload("reviewsv2", appVersionLabel("reviews", "v2"))},
 		},
 		RegistryServices: data.CreateFakeRegistryServicesLabels("reviews", "test-namespace"),
 		DestinationRule:  data.CreateTestDestinationRule("test-namespace", "name", "reviews.test-namespace.svc"),
@@ -104,10 +104,10 @@ func TestValidServiceNamespace(t *testing.T) {
 	assert := assert.New(t)
 
 	vals, valid := NoDestinationChecker{
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test-namespace": data.CreateWorkloadList("test-namespace",
-				data.CreateWorkloadListItem("reviewsv1", appVersionLabel("reviews", "v1")),
-				data.CreateWorkloadListItem("reviewsv2", appVersionLabel("reviews", "v2"))),
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test-namespace": {
+				data.CreateWorkload("reviewsv1", appVersionLabel("reviews", "v1")),
+				data.CreateWorkload("reviewsv2", appVersionLabel("reviews", "v2"))},
 		},
 		RegistryServices: data.CreateFakeRegistryServicesLabels("reviews", "test-namespace"),
 		DestinationRule:  data.CreateTestDestinationRule("test-namespace", "name", "reviews.test-namespace"),
@@ -128,10 +128,10 @@ func TestValidServiceNamespaceInvalid(t *testing.T) {
 			models.Namespace{Name: "test-namespace"},
 			models.Namespace{Name: "outside-ns"},
 		},
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test-namespace": data.CreateWorkloadList("test-namespace",
-				data.CreateWorkloadListItem("reviewsv1", appVersionLabel("reviews", "v1")),
-				data.CreateWorkloadListItem("reviewsv2", appVersionLabel("reviews", "v2"))),
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test-namespace": {
+				data.CreateWorkload("reviewsv1", appVersionLabel("reviews", "v1")),
+				data.CreateWorkload("reviewsv2", appVersionLabel("reviews", "v2"))},
 		},
 		RegistryServices: data.CreateFakeRegistryServicesLabels("reviews", "test-namespace"),
 		DestinationRule:  data.CreateTestDestinationRule("test-namespace", "name", "reviews.not-a-namespace"),
@@ -155,10 +155,10 @@ func TestValidServiceNamespaceCrossNamespace(t *testing.T) {
 			models.Namespace{Name: "test-namespace"},
 			models.Namespace{Name: "outside-ns"},
 		},
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"outside-ns": data.CreateWorkloadList("outside-ns",
-				data.CreateWorkloadListItem("reviewsv1", appVersionLabel("reviews", "v1")),
-				data.CreateWorkloadListItem("reviewsv2", appVersionLabel("reviews", "v2"))),
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"outside-ns": {
+				data.CreateWorkload("reviewsv1", appVersionLabel("reviews", "v1")),
+				data.CreateWorkload("reviewsv2", appVersionLabel("reviews", "v2"))},
 		},
 		// using outside-ns namespace in host where the workloads are created. this should not fail
 		DestinationRule: data.CreateTestDestinationRule("test-namespace", "name", "reviews.outside-ns.svc.cluster.local"),
@@ -178,10 +178,10 @@ func TestNoValidHost(t *testing.T) {
 
 	// reviews is not part of services
 	vals, valid := NoDestinationChecker{
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test-namespace": data.CreateWorkloadList("test-namespace",
-				data.CreateWorkloadListItem("detailsv1", appVersionLabel("details", "v1")),
-				data.CreateWorkloadListItem("otherv1", appVersionLabel("other", "v1"))),
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test-namespace": {
+				data.CreateWorkload("detailsv1", appVersionLabel("details", "v1")),
+				data.CreateWorkload("otherv1", appVersionLabel("other", "v1"))},
 		},
 		RegistryServices: []*kubernetes.RegistryService{{}},
 		DestinationRule:  data.CreateTestDestinationRule("test-namespace", "name", "reviews"),
@@ -207,10 +207,10 @@ func TestNoValidShortSvcHost(t *testing.T) {
 	// Not valid:
 	// reviews.test-namespace.svc.cluster
 	vals, valid := NoDestinationChecker{
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test-namespace": data.CreateWorkloadList("test-namespace",
-				data.CreateWorkloadListItem("detailsv1", appVersionLabel("details", "v1")),
-				data.CreateWorkloadListItem("otherv1", appVersionLabel("other", "v1"))),
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test-namespace": {
+				data.CreateWorkload("detailsv1", appVersionLabel("details", "v1")),
+				data.CreateWorkload("otherv1", appVersionLabel("other", "v1"))},
 		},
 		RegistryServices: data.CreateFakeRegistryServicesLabels("reviews", "test-namespace"),
 		DestinationRule:  data.CreateTestDestinationRule("test-namespace", "name", "reviews.test-namespace.svc.cluster"),
@@ -231,9 +231,9 @@ func TestNoMatchingSubset(t *testing.T) {
 
 	// reviews does not have v2 in known services
 	vals, valid := NoDestinationChecker{
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test-namespace": data.CreateWorkloadList("test-namespace",
-				data.CreateWorkloadListItem("reviews", appVersionLabel("reviews", "v1"))),
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test-namespace": {
+				data.CreateWorkload("reviews", appVersionLabel("reviews", "v1"))},
 		},
 		RegistryServices: data.CreateFakeRegistryServicesLabels("reviews", "test-namespace"),
 		DestinationRule:  data.CreateTestDestinationRule("test-namespace", "name", "reviews"),
@@ -274,10 +274,10 @@ func TestNoMatchingSubsetWithMoreLabels(t *testing.T) {
 		data.AddSubsetToDestinationRule(s2, data.CreateEmptyDestinationRule("test-namespace", "name", "reviews")))
 
 	vals, valid := NoDestinationChecker{
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test-namespace": data.CreateWorkloadList("test-namespace",
-				data.CreateWorkloadListItem("reviews", appVersionLabel("reviews", "v1")),
-				data.CreateWorkloadListItem("reviews", appVersionLabel("reviews", "v2"))),
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test-namespace": {
+				data.CreateWorkload("reviews", appVersionLabel("reviews", "v1")),
+				data.CreateWorkload("reviews", appVersionLabel("reviews", "v2"))},
 		},
 		RegistryServices: data.CreateFakeRegistryServicesLabels("reviews", "test-namespace"),
 		DestinationRule:  dr,
@@ -308,10 +308,10 @@ func TestSubsetNotReferenced(t *testing.T) {
 
 	vals, valid := NoDestinationChecker{
 		Namespaces: models.Namespaces{models.Namespace{Name: "bookinfo2"}, models.Namespace{Name: "bookinfo"}},
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"bookinfo": data.CreateWorkloadList("bookinfo",
-				data.CreateWorkloadListItem("reviews", appVersionLabel("reviews", "v1")),
-				data.CreateWorkloadListItem("reviews", appVersionLabel("reviews", "v2"))),
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"bookinfo": {
+				data.CreateWorkload("reviews", appVersionLabel("reviews", "v1")),
+				data.CreateWorkload("reviews", appVersionLabel("reviews", "v2"))},
 		},
 		RegistryServices: data.CreateFakeRegistryServicesLabels("reviews", "test-namespace"),
 		DestinationRule:  dr,
@@ -340,10 +340,10 @@ func TestSubsetReferenced(t *testing.T) {
 
 	vals, valid := NoDestinationChecker{
 		Namespaces: models.Namespaces{models.Namespace{Name: "bookinfo2"}, models.Namespace{Name: "bookinfo"}},
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"bookinfo": data.CreateWorkloadList("bookinfo",
-				data.CreateWorkloadListItem("reviews", appVersionLabel("reviews", "v1")),
-				data.CreateWorkloadListItem("reviews", appVersionLabel("reviews", "v2"))),
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"bookinfo": {
+				data.CreateWorkload("reviews", appVersionLabel("reviews", "v1")),
+				data.CreateWorkload("reviews", appVersionLabel("reviews", "v2"))},
 		},
 		RegistryServices: data.CreateFakeRegistryServicesLabels("reviews", "test-namespace"),
 		DestinationRule:  dr,
@@ -376,10 +376,10 @@ func TestSubsetPresentMatchingNotReferenced(t *testing.T) {
 
 	vals, valid := NoDestinationChecker{
 		Namespaces: models.Namespaces{models.Namespace{Name: "bookinfo"}},
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"bookinfo": data.CreateWorkloadList("bookinfo",
-				data.CreateWorkloadListItem("reviews", appVersionLabel("reviews", "v1")),
-				data.CreateWorkloadListItem("reviews", appVersionLabel("reviews", "v2"))),
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"bookinfo": {
+				data.CreateWorkload("reviews", appVersionLabel("reviews", "v1")),
+				data.CreateWorkload("reviews", appVersionLabel("reviews", "v2"))},
 		},
 		RegistryServices: data.CreateFakeRegistryServicesLabels("reviews", "bookinfo"),
 		DestinationRule:  dr,
@@ -405,10 +405,10 @@ func TestWronglyReferenced(t *testing.T) {
 
 	vals, valid := NoDestinationChecker{
 		Namespaces: models.Namespaces{models.Namespace{Name: "bookinfo2"}, models.Namespace{Name: "bookinfo"}},
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"bookinfo": data.CreateWorkloadList("bookinfo",
-				data.CreateWorkloadListItem("reviews", appVersionLabel("reviews", "v1")),
-				data.CreateWorkloadListItem("reviews", appVersionLabel("reviews", "v2"))),
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"bookinfo": {
+				data.CreateWorkload("reviews", appVersionLabel("reviews", "v1")),
+				data.CreateWorkload("reviews", appVersionLabel("reviews", "v2"))},
 		},
 		RegistryServices: data.CreateFakeRegistryServicesLabels("reviews", "test-namespace"),
 		DestinationRule:  dr,
@@ -426,10 +426,10 @@ func TestFailCrossNamespaceHost(t *testing.T) {
 	assert := assert.New(t)
 
 	vals, valid := NoDestinationChecker{
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test-namespace": data.CreateWorkloadList("test-namespace",
-				data.CreateWorkloadListItem("reviewsv1", appVersionLabel("reviews", "v1")),
-				data.CreateWorkloadListItem("reviewsv2", appVersionLabel("reviews", "v2"))),
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test-namespace": {
+				data.CreateWorkload("reviewsv1", appVersionLabel("reviews", "v1")),
+				data.CreateWorkload("reviewsv2", appVersionLabel("reviews", "v2"))},
 		},
 		// Intentionally using the same serviceName, but different NS. This SHOULD fail to match the above workloads which are created in test-namespace
 		DestinationRule: data.CreateTestDestinationRule("test-namespace", "name", "reviews.different-ns.svc.cluster.local"),
@@ -644,10 +644,10 @@ func TestNoLabelsInSubset(t *testing.T) {
 	assert := assert.New(t)
 
 	vals, valid := NoDestinationChecker{
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test-namespace": data.CreateWorkloadList("test-namespace",
-				data.CreateWorkloadListItem("reviewsv1", appVersionLabel("reviews", "v1")),
-				data.CreateWorkloadListItem("reviewsv2", appVersionLabel("reviews", "v2"))),
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test-namespace": {
+				data.CreateWorkload("reviewsv1", appVersionLabel("reviews", "v1")),
+				data.CreateWorkload("reviewsv2", appVersionLabel("reviews", "v2"))},
 		},
 		RegistryServices: data.CreateFakeRegistryServicesLabels("reviews", "test-namespace"),
 		DestinationRule:  data.CreateNoLabelsDestinationRule("test-namespace", "name", "reviews"),
@@ -664,10 +664,10 @@ func TestSubsetWithoutLabels(t *testing.T) {
 	assert := assert.New(t)
 
 	vals, valid := NoDestinationChecker{
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test-namespace": data.CreateWorkloadList("test-namespace",
-				data.CreateWorkloadListItem("reviewsv1", appVersionLabel("reviews", "v1")),
-				data.CreateWorkloadListItem("reviewsv2", appVersionLabel("reviews", "v2"))),
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test-namespace": {
+				data.CreateWorkload("reviewsv1", appVersionLabel("reviews", "v1")),
+				data.CreateWorkload("reviewsv2", appVersionLabel("reviews", "v2"))},
 		},
 		RegistryServices: data.CreateFakeRegistryServicesLabels("reviews", "test-namespace"),
 		DestinationRule:  data.CreateNoSubsetLabelsDestinationRule("test-namespace", "name", "reviews"),
diff --git a/business/checkers/gateways/selector_checker_test.go b/business/checkers/gateways/selector_checker_test.go
index 53e945df7..e2f94341a 100644
--- a/business/checkers/gateways/selector_checker_test.go
+++ b/business/checkers/gateways/selector_checker_test.go
@@ -22,10 +22,10 @@ func TestValidInternalSelector(t *testing.T) {
 
 	vals, valid := SelectorChecker{
 		Gateway: ingress,
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test": data.CreateWorkloadList("istio-system",
-				data.CreateWorkloadListItem("istio-ingressgateway", map[string]string{"istio": "ingressgateway"})),
-		},
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test": {
+				data.CreateWorkload("istio-ingressgateway", map[string]string{"istio": "ingressgateway"}),
+			}},
 		IsGatewayToNamespace: false,
 	}.Check()
 
@@ -34,10 +34,10 @@ func TestValidInternalSelector(t *testing.T) {
 
 	vals, valid = SelectorChecker{
 		Gateway: egress,
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test": data.CreateWorkloadList("istio-system",
-				data.CreateWorkloadListItem("istio-egressgateway", map[string]string{"istio": "egressgateway"})),
-		},
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test": {
+				data.CreateWorkload("istio-egressgateway", map[string]string{"istio": "egressgateway"}),
+			}},
 		IsGatewayToNamespace: false,
 	}.Check()
 
@@ -55,10 +55,10 @@ func TestValidNamespaceSelector(t *testing.T) {
 
 	vals, valid := SelectorChecker{
 		Gateway: gw,
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test": data.CreateWorkloadList("test",
-				data.CreateWorkloadListItem("testproxy", map[string]string{"app": "proxy"})),
-		},
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test": {
+				data.CreateWorkload("testproxy", map[string]string{"app": "proxy"}),
+			}},
 		IsGatewayToNamespace: false,
 	}.Check()
 
@@ -77,10 +77,10 @@ func TestLocalNamespaceSelector(t *testing.T) {
 
 	vals, valid := SelectorChecker{
 		Gateway: gw,
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test": data.CreateWorkloadList("test",
-				data.CreateWorkloadListItem("testproxy", map[string]string{"app": "proxy"})),
-		},
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test": {
+				data.CreateWorkload("testproxy", map[string]string{"app": "proxy"}),
+			}},
 		IsGatewayToNamespace: true,
 	}.Check()
 
@@ -92,10 +92,10 @@ func TestLocalNamespaceSelector(t *testing.T) {
 
 	vals, valid = SelectorChecker{
 		Gateway: gw,
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test": data.CreateWorkloadList("test",
-				data.CreateWorkloadListItem("testproxy", map[string]string{"app": "proxy"})),
-		},
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test": {
+				data.CreateWorkload("testproxy", map[string]string{"app": "proxy"}),
+			}},
 		IsGatewayToNamespace: false,
 	}.Check()
 
@@ -107,10 +107,10 @@ func TestLocalNamespaceSelector(t *testing.T) {
 
 	vals, valid = SelectorChecker{
 		Gateway: gw,
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test": data.CreateWorkloadList("test",
-				data.CreateWorkloadListItem("testproxy", map[string]string{"app": "proxy"})),
-		},
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test": {
+				data.CreateWorkload("testproxy", map[string]string{"app": "proxy"}),
+			}},
 		IsGatewayToNamespace: true,
 	}.Check()
 
@@ -122,10 +122,10 @@ func TestLocalNamespaceSelector(t *testing.T) {
 
 	vals, valid = SelectorChecker{
 		Gateway: gw,
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test": data.CreateWorkloadList("test",
-				data.CreateWorkloadListItem("testproxy", map[string]string{"app": "proxy"})),
-		},
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test": {
+				data.CreateWorkload("testproxy", map[string]string{"app": "proxy"}),
+			}},
 		IsGatewayToNamespace: false,
 	}.Check()
 
@@ -143,10 +143,10 @@ func TestValidIstioNamespaceSelector(t *testing.T) {
 
 	vals, valid := SelectorChecker{
 		Gateway: gw,
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"testproxy": data.CreateWorkloadList(conf.IstioNamespace,
-				data.CreateWorkloadListItem("testproxy", map[string]string{"app": "proxy"})),
-		},
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"testproxy": {
+				data.CreateWorkload("testproxy", map[string]string{"app": "proxy"}),
+			}},
 		IsGatewayToNamespace: false,
 	}.Check()
 
@@ -155,11 +155,8 @@ func TestValidIstioNamespaceSelector(t *testing.T) {
 
 	vals, valid = SelectorChecker{
 		Gateway: gw,
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test": {
-				Namespace: "test",
-				Workloads: []models.WorkloadListItem{},
-			},
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test": {},
 		},
 		IsGatewayToNamespace: false,
 	}.Check()
@@ -178,8 +175,8 @@ func TestMissingSelectorTarget(t *testing.T) {
 
 	vals, valid := SelectorChecker{
 		Gateway: gw,
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test": data.CreateWorkloadList("test"),
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test": {},
 		},
 		IsGatewayToNamespace: false,
 	}.Check()
diff --git a/business/checkers/no_service_checker_test.go b/business/checkers/no_service_checker_test.go
index fa38a13d8..caf6f279f 100644
--- a/business/checkers/no_service_checker_test.go
+++ b/business/checkers/no_service_checker_test.go
@@ -31,17 +31,17 @@ func TestAllIstioObjectWithServices(t *testing.T) {
 	assert := assert.New(t)
 
 	vals := NoServiceChecker{
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test": data.CreateWorkloadList("test",
-				data.CreateWorkloadListItem("reviewsv1", appVersionLabel("reviews", "v1")),
-				data.CreateWorkloadListItem("reviewsv2", appVersionLabel("reviews", "v2")),
-				data.CreateWorkloadListItem("detailsv1", appVersionLabel("details", "v1")),
-				data.CreateWorkloadListItem("detailsv2", appVersionLabel("details", "v2")),
-				data.CreateWorkloadListItem("productv1", appVersionLabel("product", "v1")),
-				data.CreateWorkloadListItem("productv2", appVersionLabel("product", "v2")),
-				data.CreateWorkloadListItem("customerv1", appVersionLabel("customer", "v1")),
-				data.CreateWorkloadListItem("customerv2", appVersionLabel("customer", "v2"))),
-		},
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test": {
+				data.CreateWorkload("reviewsv1", appVersionLabel("reviews", "v1")),
+				data.CreateWorkload("reviewsv2", appVersionLabel("reviews", "v2")),
+				data.CreateWorkload("detailsv1", appVersionLabel("details", "v1")),
+				data.CreateWorkload("detailsv2", appVersionLabel("details", "v2")),
+				data.CreateWorkload("productv1", appVersionLabel("product", "v1")),
+				data.CreateWorkload("productv2", appVersionLabel("product", "v2")),
+				data.CreateWorkload("customerv1", appVersionLabel("customer", "v1")),
+				data.CreateWorkload("customerv2", appVersionLabel("customer", "v2")),
+			}},
 		IstioConfigList:      fakeIstioConfigList(),
 		AuthorizationDetails: &kubernetes.RBACDetails{},
 		RegistryServices: append(data.CreateFakeRegistryServices("product.test.svc.cluster.local", "test", "test"),
@@ -63,15 +63,15 @@ func TestDetectObjectWithoutService(t *testing.T) {
 
 	vals := NoServiceChecker{
 		IstioConfigList: fakeIstioConfigList(),
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test": data.CreateWorkloadList("test",
-				data.CreateWorkloadListItem("reviewsv1", appVersionLabel("reviews", "v1")),
-				data.CreateWorkloadListItem("reviewsv2", appVersionLabel("reviews", "v2")),
-				data.CreateWorkloadListItem("detailsv1", appVersionLabel("details", "v1")),
-				data.CreateWorkloadListItem("detailsv2", appVersionLabel("details", "v2")),
-				data.CreateWorkloadListItem("productv1", appVersionLabel("product", "v1")),
-				data.CreateWorkloadListItem("productv2", appVersionLabel("product", "v2"))),
-		},
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test": {
+				data.CreateWorkload("reviewsv1", appVersionLabel("reviews", "v1")),
+				data.CreateWorkload("reviewsv2", appVersionLabel("reviews", "v2")),
+				data.CreateWorkload("detailsv1", appVersionLabel("details", "v1")),
+				data.CreateWorkload("detailsv2", appVersionLabel("details", "v2")),
+				data.CreateWorkload("productv1", appVersionLabel("product", "v1")),
+				data.CreateWorkload("productv2", appVersionLabel("product", "v2")),
+			}},
 		AuthorizationDetails: &kubernetes.RBACDetails{},
 		RegistryServices: append(data.CreateFakeRegistryServices("product.test.svc.cluster.local", "test", "."),
 			data.CreateFakeMultiRegistryServices([]string{"reviews.test.svc.cluster.local", "details.test.svc.cluster.local"}, "test", "*")...),
@@ -86,15 +86,15 @@ func TestDetectObjectWithoutService(t *testing.T) {
 	assert.NoError(validations.ConfirmIstioCheckMessage("destinationrules.nodest.matchingregistry", customerDr.Checks[0]))
 
 	vals = NoServiceChecker{
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test": data.CreateWorkloadList("test",
-				data.CreateWorkloadListItem("reviewsv1", appVersionLabel("reviews", "v1")),
-				data.CreateWorkloadListItem("reviewsv2", appVersionLabel("reviews", "v2")),
-				data.CreateWorkloadListItem("detailsv1", appVersionLabel("details", "v1")),
-				data.CreateWorkloadListItem("detailsv2", appVersionLabel("details", "v2")),
-				data.CreateWorkloadListItem("customerv1", appVersionLabel("customer", "v1")),
-				data.CreateWorkloadListItem("customerv2", appVersionLabel("customer", "v2"))),
-		},
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test": {
+				data.CreateWorkload("reviewsv1", appVersionLabel("reviews", "v1")),
+				data.CreateWorkload("reviewsv2", appVersionLabel("reviews", "v2")),
+				data.CreateWorkload("detailsv1", appVersionLabel("details", "v1")),
+				data.CreateWorkload("detailsv2", appVersionLabel("details", "v2")),
+				data.CreateWorkload("customerv1", appVersionLabel("customer", "v1")),
+				data.CreateWorkload("customerv2", appVersionLabel("customer", "v2")),
+			}},
 		IstioConfigList:      fakeIstioConfigList(),
 		RegistryServices:     data.CreateFakeMultiRegistryServices([]string{"reviews.test.svc.cluster.local", "details.test.svc.cluster.local", "customer.test.svc.cluster.local"}, "test", "*"),
 		AuthorizationDetails: &kubernetes.RBACDetails{},
@@ -111,15 +111,15 @@ func TestDetectObjectWithoutService(t *testing.T) {
 	assert.NoError(validations.ConfirmIstioCheckMessage("virtualservices.nohost.hostnotfound", productVs.Checks[1]))
 
 	vals = NoServiceChecker{
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test": data.CreateWorkloadList("test",
-				data.CreateWorkloadListItem("reviewsv1", appVersionLabel("reviews", "v1")),
-				data.CreateWorkloadListItem("reviewsv2", appVersionLabel("reviews", "v2")),
-				data.CreateWorkloadListItem("productv1", appVersionLabel("product", "v1")),
-				data.CreateWorkloadListItem("productv2", appVersionLabel("product", "v2")),
-				data.CreateWorkloadListItem("customerv1", appVersionLabel("customer", "v1")),
-				data.CreateWorkloadListItem("customerv2", appVersionLabel("customer", "v2"))),
-		},
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test": {
+				data.CreateWorkload("reviewsv1", appVersionLabel("reviews", "v1")),
+				data.CreateWorkload("reviewsv2", appVersionLabel("reviews", "v2")),
+				data.CreateWorkload("productv1", appVersionLabel("product", "v1")),
+				data.CreateWorkload("productv2", appVersionLabel("product", "v2")),
+				data.CreateWorkload("customerv1", appVersionLabel("customer", "v1")),
+				data.CreateWorkload("customerv2", appVersionLabel("customer", "v2")),
+			}},
 		IstioConfigList:      fakeIstioConfigList(),
 		RegistryServices:     data.CreateFakeMultiRegistryServices([]string{"reviews.test.svc.cluster.local", "product.test.svc.cluster.local", "customer.test.svc.cluster.local"}, "test", "*"),
 		AuthorizationDetails: &kubernetes.RBACDetails{},
@@ -129,15 +129,15 @@ func TestDetectObjectWithoutService(t *testing.T) {
 	assert.True(vals[models.IstioValidationKey{ObjectGVK: kubernetes.DestinationRules, Namespace: "test", Name: "customer-dr"}].Valid)
 
 	vals = NoServiceChecker{
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test": data.CreateWorkloadList("test",
-				data.CreateWorkloadListItem("productv1", appVersionLabel("product", "v1")),
-				data.CreateWorkloadListItem("productv2", appVersionLabel("product", "v2")),
-				data.CreateWorkloadListItem("detailsv1", appVersionLabel("details", "v1")),
-				data.CreateWorkloadListItem("detailsv2", appVersionLabel("details", "v2")),
-				data.CreateWorkloadListItem("customerv1", appVersionLabel("customer", "v1")),
-				data.CreateWorkloadListItem("customerv2", appVersionLabel("customer", "v2"))),
-		},
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test": {
+				data.CreateWorkload("productv1", appVersionLabel("product", "v1")),
+				data.CreateWorkload("productv2", appVersionLabel("product", "v2")),
+				data.CreateWorkload("detailsv1", appVersionLabel("details", "v1")),
+				data.CreateWorkload("detailsv2", appVersionLabel("details", "v2")),
+				data.CreateWorkload("customerv1", appVersionLabel("customer", "v1")),
+				data.CreateWorkload("customerv2", appVersionLabel("customer", "v2")),
+			}},
 		IstioConfigList:      fakeIstioConfigList(),
 		RegistryServices:     data.CreateFakeMultiRegistryServices([]string{"details.test.svc.cluster.local", "product.test.svc.cluster.local", "customer.test.svc.cluster.local"}, "test", "*"),
 		AuthorizationDetails: &kubernetes.RBACDetails{},
diff --git a/business/checkers/workloads/uncovered_workload_checker_test.go b/business/checkers/workloads/uncovered_workload_checker_test.go
index 210d38eea..8a07e42c4 100644
--- a/business/checkers/workloads/uncovered_workload_checker_test.go
+++ b/business/checkers/workloads/uncovered_workload_checker_test.go
@@ -25,7 +25,7 @@ func TestCoveredworkloads(t *testing.T) {
 	var vals []*models.IstioCheck
 	var valid bool
 
-	for _, wl := range workloadListNS2().Workloads {
+	for _, wl := range workloadsNS2() {
 		//firstCase - one authorization policy namespace is wide mesh and has no selector (covers all workloads including current workload),
 		// while other auths has diffrenet namespaces than current workload
 		vals, valid = UncoveredWorkloadChecker{
@@ -51,8 +51,9 @@ func TestCoveredworkloads(t *testing.T) {
 	}
 
 	// third case - curr workload in the same namespace and has a matching authorization policy (same ns and labels)
+	workloadsNS1 := workloadsNS1()
 	vals, valid = UncoveredWorkloadChecker{
-		Workload:              workloadListNS1().Workloads[1],
+		Workload:              workloadsNS1[1],
 		Namespace:             ns1,
 		AuthorizationPolicies: authorizationPoliciesNS1(),
 	}.Check()
@@ -65,25 +66,28 @@ func TestUnCoveredWorkloads(t *testing.T) {
 	conf := config.NewConfig()
 	config.Set(conf)
 
+	workloadsNS1 := workloadsNS1()
+	workloadsNS2 := workloadsNS2()
+
 	assert := assert.New(t)
 	//case 1 - authpolicy in root ns with unmatching selector, other auths from another ns
 	testFailure(assert, ns2,
 		variedAuthPolicies3(),
-		workloadListNS2().Workloads[0])
+		workloadsNS2[0])
 
 	// case 2 - curr workload has different namespace than of all authpolicies
-	testFailure(assert, ns2, authorizationPoliciesNS1(), workloadListNS2().Workloads[1])
+	testFailure(assert, ns2, authorizationPoliciesNS1(), workloadsNS2[1])
 
 	//case3 - workload and authpolicies have same namespace but all auth policies have unmatching labels
 	testFailure(assert, ns1,
 		authorizationPoliciesNS1(),
-		workloadListNS1().Workloads[3])
+		workloadsNS1[3])
 
 	//case4 - no authorization policy found
-	testFailure(assert, ns2, []*security_v1.AuthorizationPolicy{}, workloadListNS2().Workloads[0])
+	testFailure(assert, ns2, []*security_v1.AuthorizationPolicy{}, workloadsNS2[0])
 }
 
-func testFailure(assert *assert.Assertions, ns string, authpolicies []*security_v1.AuthorizationPolicy, workload models.WorkloadListItem) {
+func testFailure(assert *assert.Assertions, ns string, authpolicies []*security_v1.AuthorizationPolicy, workload *models.Workload) {
 	vals, valid := UncoveredWorkloadChecker{
 		Workload:              workload,
 		Namespace:             ns,
@@ -96,23 +100,23 @@ func testFailure(assert *assert.Assertions, ns string, authpolicies []*security_
 
 }
 
-func workloadListNS1() models.WorkloadList {
-	wlitems := []models.WorkloadListItem{
-		data.CreateWorkloadListItem("covered-workload1", map[string]string{"app": "ratings", "version": "v1"}),
-		data.CreateWorkloadListItem("covered-workload2", map[string]string{"app": "productpage", "version": "v1"}),
-		data.CreateWorkloadListItem("covered-workload3", map[string]string{"app": "details", "version": "v3"}),
-		data.CreateWorkloadListItem("uncovered-workload", map[string]string{"app": "wrong", "version": "v5"}),
+func workloadsNS1() models.Workloads {
+	workloads := models.Workloads{
+		data.CreateWorkload("covered-workload1", map[string]string{"app": "ratings", "version": "v1"}),
+		data.CreateWorkload("covered-workload2", map[string]string{"app": "productpage", "version": "v1"}),
+		data.CreateWorkload("covered-workload3", map[string]string{"app": "details", "version": "v3"}),
+		data.CreateWorkload("uncovered-workload", map[string]string{"app": "wrong", "version": "v5"}),
 	}
 
-	return data.CreateWorkloadList(ns1, wlitems...)
+	return workloads
 }
 
-func workloadListNS2() models.WorkloadList {
-	wlitems := []models.WorkloadListItem{
-		data.CreateWorkloadListItem("uncovered-workload1", map[string]string{"app": "ratings", "version": "v1"}),
-		data.CreateWorkloadListItem("uncovered-workload2", map[string]string{"app": "details", "version": "v2"}),
+func workloadsNS2() models.Workloads {
+	workloads := models.Workloads{
+		data.CreateWorkload("uncovered-workload1", map[string]string{"app": "ratings", "version": "v1"}),
+		data.CreateWorkload("uncovered-workload2", map[string]string{"app": "details", "version": "v2"}),
 	}
-	return data.CreateWorkloadList(ns2, wlitems...)
+	return workloads
 }
 
 func authorizationPoliciesNS1() []*security_v1.AuthorizationPolicy {
diff --git a/business/istio_validations_perf_test.go b/business/istio_validations_perf_test.go
index 5649820db..a78d57222 100644
--- a/business/istio_validations_perf_test.go
+++ b/business/istio_validations_perf_test.go
@@ -2,6 +2,7 @@ package business
 
 import (
 	"context"
+	"flag"
 	"fmt"
 	"os"
 	"strconv"
@@ -10,13 +11,30 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	core_v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
 
 	"github.com/kiali/kiali/config"
+	"github.com/kiali/kiali/istio/istiotest"
+	"github.com/kiali/kiali/kubernetes"
+	"github.com/kiali/kiali/kubernetes/kubetest"
 	"github.com/kiali/kiali/log"
 	"github.com/kiali/kiali/models"
 	"github.com/kiali/kiali/tests/data"
 )
 
+var numberOfObjectsFlag int
+
+func init() {
+	flag.IntVar(&numberOfObjectsFlag, "num-objects", 10, "Number of objects to create of various kinds in the benchmark setup.")
+}
+
+func parseFlags(t testing.TB) {
+	t.Helper()
+	flag.Parse()
+}
+
 func TestGetValidationsPerf(t *testing.T) {
 	assert := assert.New(t)
 	require := require.New(t)
@@ -50,11 +68,12 @@ func TestGetValidationsPerf(t *testing.T) {
 		[]string{"details.test.svc.cluster.local", "product.test.svc.cluster.local", "product2.test.svc.cluster.local", "customer.test.svc.cluster.local"})
 
 	now := time.Now()
-	vInfo, err := vs.NewValidationInfo(context.TODO(), []string{conf.KubernetesConfig.ClusterName})
+	vInfo, err := vs.NewValidationInfo(context.TODO(), []string{conf.KubernetesConfig.ClusterName}, nil)
 	require.NoError(err)
-	validations, err := vs.Validate(context.TODO(), conf.KubernetesConfig.ClusterName, vInfo)
+	validationPerformed, validations, err := vs.Validate(context.TODO(), conf.KubernetesConfig.ClusterName, vInfo)
 	require.NoError(err)
 	log.Debugf("Validation Performance test took %f seconds for %d namespaces", time.Since(now).Seconds(), numNs)
+	assert.True(validationPerformed)
 	assert.NotEmpty(validations)
 }
 
@@ -87,3 +106,86 @@ func fakeIstioConfigListPerf(numNs, numDr, numVs, numGw int) *models.IstioConfig
 	}
 	return &istioConfigList
 }
+
+func BenchmarkValidate(b *testing.B) {
+	parseFlags(b)
+	services := []string{"details.test.svc.cluster.local", "product.test.svc.cluster.local", "product2.test.svc.cluster.local", "customer.test.svc.cluster.local"}
+	conf := config.NewConfig()
+	config.Set(conf)
+	istioConfigList := fakeIstioConfigListPerf(numberOfObjectsFlag, numberOfObjectsFlag, numberOfObjectsFlag, numberOfObjectsFlag)
+	fakeIstioObjects := []runtime.Object{
+		&core_v1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: "istio", Namespace: "istio-system"}},
+		kubetest.FakeNamespace("wrong"),
+		kubetest.FakeNamespace("istio-system"),
+	}
+	for _, p := range fakeMeshPolicies() {
+		fakeIstioObjects = append(fakeIstioObjects, p.DeepCopyObject())
+	}
+	for _, p := range fakePolicies() {
+		fakeIstioObjects = append(fakeIstioObjects, p.DeepCopyObject())
+	}
+	for _, p := range fakeCombinedServices(services, "test") {
+		fakeIstioObjects = append(fakeIstioObjects, p.DeepCopyObject())
+	}
+	for _, p := range FakeDepSyncedWithRS(conf) {
+		fakeIstioObjects = append(fakeIstioObjects, p.DeepCopyObject())
+	}
+	for _, p := range fakeNamespaces() {
+		fakeIstioObjects = append(fakeIstioObjects, p.DeepCopyObject())
+	}
+	for _, p := range FakeRSSyncedWithPods(conf) {
+		fakeIstioObjects = append(fakeIstioObjects, p.DeepCopyObject())
+	}
+	for _, p := range fakePods().Items {
+		fakeIstioObjects = append(fakeIstioObjects, p.DeepCopyObject())
+	}
+	fakeIstioObjects = append(fakeIstioObjects, kubernetes.ToRuntimeObjects(istioConfigList.Gateways)...)
+	fakeIstioObjects = append(fakeIstioObjects, kubernetes.ToRuntimeObjects(istioConfigList.DestinationRules)...)
+	fakeIstioObjects = append(fakeIstioObjects, kubernetes.ToRuntimeObjects(istioConfigList.VirtualServices)...)
+	fakeIstioObjects = append(fakeIstioObjects, kubernetes.ToRuntimeObjects(istioConfigList.ServiceEntries)...)
+	fakeIstioObjects = append(fakeIstioObjects, kubernetes.ToRuntimeObjects(istioConfigList.Sidecars)...)
+	fakeIstioObjects = append(fakeIstioObjects, kubernetes.ToRuntimeObjects(istioConfigList.WorkloadEntries)...)
+	fakeIstioObjects = append(fakeIstioObjects, kubernetes.ToRuntimeObjects(istioConfigList.RequestAuthentications)...)
+	for i := 0; i < numberOfObjectsFlag; i++ {
+		fakeIstioObjects = append(fakeIstioObjects, data.CreateAuthorizationPolicyWithPrincipals(fmt.Sprintf("name-%d", i), fmt.Sprintf("ns-%d", i), []string{"principal1", "principal2", "principal2"}))
+	}
+	for i := 0; i < numberOfObjectsFlag; i++ {
+		ns := &core_v1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: fmt.Sprintf("ns-%d", i)}}
+		fakeIstioObjects = append(fakeIstioObjects, ns)
+	}
+	k8s := kubetest.NewFakeK8sClient(fakeIstioObjects...)
+	cache := SetupBusinessLayer(b, k8s, *conf)
+	cache.SetRegistryStatus(map[string]*kubernetes.RegistryStatus{
+		conf.KubernetesConfig.ClusterName: {
+			Services: data.CreateFakeMultiRegistryServices(services, "test", "*"),
+		},
+	})
+
+	k8sclients := make(map[string]kubernetes.ClientInterface)
+	k8sclients[conf.KubernetesConfig.ClusterName] = k8s
+	discovery := &istiotest.FakeDiscovery{
+		MeshReturn: models.Mesh{ControlPlanes: []models.ControlPlane{{Cluster: &models.KubeCluster{IsKialiHome: true}, Config: models.ControlPlaneConfiguration{}}}},
+	}
+	namespace := NewNamespaceService(k8sclients, k8sclients, cache, conf, discovery)
+	mesh := NewMeshService(k8sclients, discovery)
+	layer := NewWithBackends(k8sclients, k8sclients, nil, nil)
+	vs := NewValidationsService(&layer.IstioConfig, cache, &mesh, &namespace, &layer.Svc, k8sclients, &layer.Workload)
+
+	var changeMap ValidationChangeMap
+	if conf.ExternalServices.Istio.ValidationChangeDetectionEnabled {
+		changeMap = ValidationChangeMap{}
+	}
+
+	vInfo, err := vs.NewValidationInfo(context.TODO(), []string{conf.KubernetesConfig.ClusterName}, changeMap)
+	if err != nil {
+		b.Fatal(err)
+	}
+
+	b.ResetTimer()
+	for n := 0; n < b.N; n++ {
+		_, _, err = vs.Validate(context.TODO(), conf.KubernetesConfig.ClusterName, vInfo)
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
diff --git a/business/istio_validations_test.go b/business/istio_validations_test.go
index fb1a58711..bec16c8f9 100644
--- a/business/istio_validations_test.go
+++ b/business/istio_validations_test.go
@@ -16,6 +16,7 @@ import (
 
 	"github.com/kiali/kiali/config"
 	"github.com/kiali/kiali/istio"
+	"github.com/kiali/kiali/istio/istiotest"
 	"github.com/kiali/kiali/kubernetes"
 	"github.com/kiali/kiali/kubernetes/kubetest"
 	"github.com/kiali/kiali/models"
@@ -61,16 +62,36 @@ func TestGetNamespaceValidations(t *testing.T) {
 	vs := mockCombinedValidationService(t, conf, fakeIstioConfigList(),
 		[]string{"details.test.svc.cluster.local", "product.test.svc.cluster.local", "product2.test.svc.cluster.local", "customer.test.svc.cluster.local"})
 
-	vInfo, err := vs.NewValidationInfo(context.Background(), []string{conf.KubernetesConfig.ClusterName})
+	var changeMap = map[string]string{}
+	vInfo, err := vs.NewValidationInfo(context.Background(), []string{conf.KubernetesConfig.ClusterName}, changeMap)
 	require.NoError(err)
-	validations, err := vs.Validate(context.Background(), conf.KubernetesConfig.ClusterName, vInfo)
+	validationPerformed, validations, err := vs.Validate(context.Background(), conf.KubernetesConfig.ClusterName, vInfo)
 	require.NoError(err)
+	assert.True(validationPerformed)
 	vs.kialiCache.Validations().Replace(validations)
 
 	validations, err = vs.GetValidations(context.TODO(), conf.KubernetesConfig.ClusterName)
 	require.NoError(err)
 	require.NotEmpty(validations)
 	assert.True(validations[models.IstioValidationKey{ObjectGVK: kubernetes.VirtualServices, Namespace: "test", Name: "product-vs"}].Valid)
+
+	// simulate a reconcile w/o a config change should skip running the checkers (new vInfo but re-use the changemap)
+	vInfo, err = vs.NewValidationInfo(context.Background(), []string{conf.KubernetesConfig.ClusterName}, changeMap)
+	require.NoError(err)
+	validationPerformed, validations, err = vs.Validate(context.Background(), conf.KubernetesConfig.ClusterName, vInfo)
+	require.NoError(err)
+	assert.False(validationPerformed)
+	assert.Nil(validations)
+
+	// refresh the config but keep the changeMap, and we should see new validations. (note PeerAuthentication config updates its ResourceVersion)
+	vs = mockCombinedValidationService(t, conf, fakeIstioConfigList(),
+		[]string{"details.test.svc.cluster.local", "product.test.svc.cluster.local", "product2.test.svc.cluster.local", "customer.test.svc.cluster.local"})
+	vInfo, err = vs.NewValidationInfo(context.Background(), []string{conf.KubernetesConfig.ClusterName}, changeMap)
+	require.NoError(err)
+	validationPerformed, validations, err = vs.Validate(context.Background(), conf.KubernetesConfig.ClusterName, vInfo)
+	require.NoError(err)
+	assert.True(validationPerformed)
+	assert.NotNil(validations)
 }
 
 func TestGetIstioObjectValidations(t *testing.T) {
@@ -703,10 +724,11 @@ func TestValidatingSingleObjectUpdatesList(t *testing.T) {
 	v, err := vs.userClients[conf.KubernetesConfig.ClusterName].Istio().NetworkingV1().VirtualServices("test").Get(context.Background(), "product-vs", v1.GetOptions{})
 	require.NoError(err)
 
-	vInfo, err := vs.NewValidationInfo(context.Background(), []string{conf.KubernetesConfig.ClusterName})
+	vInfo, err := vs.NewValidationInfo(context.Background(), []string{conf.KubernetesConfig.ClusterName}, nil)
 	require.NoError(err)
-	validations, err := vs.Validate(context.Background(), conf.KubernetesConfig.ClusterName, vInfo)
+	validationPerformed, validations, err := vs.Validate(context.Background(), conf.KubernetesConfig.ClusterName, vInfo)
 	require.NoError(err)
+	assert.True(validationPerformed)
 	vs.kialiCache.Validations().Replace(validations)
 
 	currentValidations, err := vs.GetValidations(context.Background(), conf.KubernetesConfig.ClusterName)
@@ -720,10 +742,11 @@ func TestValidatingSingleObjectUpdatesList(t *testing.T) {
 	require.NoError(err)
 
 	// make sure validations are updated in a cache before retrieving them
-	vInfo, err = vs.NewValidationInfo(context.Background(), []string{conf.KubernetesConfig.ClusterName})
+	vInfo, err = vs.NewValidationInfo(context.Background(), []string{conf.KubernetesConfig.ClusterName}, nil)
 	require.NoError(err)
-	validations, err = vs.Validate(context.Background(), conf.KubernetesConfig.ClusterName, vInfo)
+	validationPerformed, validations, err = vs.Validate(context.Background(), conf.KubernetesConfig.ClusterName, vInfo)
 	require.NoError(err)
+	assert.True(validationPerformed)
 	vs.kialiCache.Validations().Replace(validations)
 
 	updatedValidations, _, err := vs.ValidateIstioObject(context.Background(), conf.KubernetesConfig.ClusterName, "test", kubernetes.VirtualServices, "product-vs")
@@ -761,7 +784,9 @@ func fakeValidationMeshServiceWithRegistryStatus(t *testing.T, cfg config.Config
 
 	k8sclients := make(map[string]kubernetes.ClientInterface)
 	k8sclients[cfg.KubernetesConfig.ClusterName] = k8s
-	discovery := istio.NewDiscovery(k8sclients, cache, conf)
+	discovery := &istiotest.FakeDiscovery{
+		MeshReturn: models.Mesh{ControlPlanes: []models.ControlPlane{{Cluster: &models.KubeCluster{IsKialiHome: true}, Config: models.ControlPlaneConfiguration{}}}},
+	}
 	namespace := NewNamespaceService(k8sclients, k8sclients, cache, conf, discovery)
 	mesh := NewMeshService(k8sclients, discovery)
 	layer := NewWithBackends(k8sclients, k8sclients, nil, nil)
diff --git a/business/references/auth_policy_references_test.go b/business/references/auth_policy_references_test.go
index 543555d90..2165b1f10 100644
--- a/business/references/auth_policy_references_test.go
+++ b/business/references/auth_policy_references_test.go
@@ -24,11 +24,10 @@ func prepareTestForAuthPolicy(ap *security_v1.AuthorizationPolicy, vs *networkin
 		AuthorizationPolicies: []*security_v1.AuthorizationPolicy{ap},
 		ServiceEntries:        []*networking_v1.ServiceEntry{se},
 		VirtualServices:       []*networking_v1.VirtualService{vs},
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"istio-system": data.CreateWorkloadList("istio-system",
-				data.CreateWorkloadListItem("istiod", map[string]string{"app": "istio-ingressgateway"}),
-			),
-		},
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"istio-system": {
+				data.CreateWorkload("istiod", map[string]string{"app": "istio-ingressgateway"}),
+			}},
 		RegistryServices: data.CreateFakeRegistryServicesLabels("foo-dev", "istio-system"),
 	}
 	return *drReferences.References()[models.IstioReferenceKey{ObjectGVK: kubernetes.AuthorizationPolicies, Namespace: ap.Namespace, Name: ap.Name}]
diff --git a/business/references/destination_rule_references_test.go b/business/references/destination_rule_references_test.go
index 888852894..e8dc5a194 100644
--- a/business/references/destination_rule_references_test.go
+++ b/business/references/destination_rule_references_test.go
@@ -22,13 +22,13 @@ func prepareTestForDestinationRule(dr *networking_v1.DestinationRule, vs *networ
 		},
 		DestinationRules: []*networking_v1.DestinationRule{dr},
 		VirtualServices:  []*networking_v1.VirtualService{vs},
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test-namespace": data.CreateWorkloadList("test-namespace",
-				data.CreateWorkloadListItem("reviewsv1", appVersionLabel("reviews", "v1")),
-				data.CreateWorkloadListItem("reviewsv2", appVersionLabel("reviews", "v2")),
-				data.CreateWorkloadListItem("reviewsv3", appVersionLabel("reviews", "v3")),
-				data.CreateWorkloadListItem("reviewsv4", appVersionLabel("reviews", "v4"))),
-		},
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"test-namespace": {
+				data.CreateWorkload("reviewsv1", appVersionLabel("reviews", "v1")),
+				data.CreateWorkload("reviewsv2", appVersionLabel("reviews", "v2")),
+				data.CreateWorkload("reviewsv3", appVersionLabel("reviews", "v3")),
+				data.CreateWorkload("reviewsv4", appVersionLabel("reviews", "v4")),
+			}},
 		ServiceEntries:   []*networking_v1.ServiceEntry{fakeServiceEntry()},
 		RegistryServices: data.CreateFakeRegistryServicesLabels("reviews", "test-namespace"),
 	}
diff --git a/business/references/gateway_references_test.go b/business/references/gateway_references_test.go
index d528499b3..53b5ef5c3 100644
--- a/business/references/gateway_references_test.go
+++ b/business/references/gateway_references_test.go
@@ -16,10 +16,10 @@ func prepareTestForGateway(gw *networking_v1.Gateway, vss []*networking_v1.Virtu
 	gwReferences := GatewayReferences{
 		Gateways:        []*networking_v1.Gateway{gw},
 		VirtualServices: vss,
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"test": data.CreateWorkloadList("istio-system",
-				data.CreateWorkloadListItem("istio-ingressgateway", map[string]string{"istio": "ingressgateway"})),
-		},
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"istio-system": {
+				data.CreateWorkload("istio-ingressgateway", map[string]string{"istio": "ingressgateway"}),
+			}},
 	}
 	return *gwReferences.References()[models.IstioReferenceKey{ObjectGVK: kubernetes.Gateways, Namespace: gw.Namespace, Name: gw.Name}]
 }
diff --git a/business/references/k8s_gateway_references_test.go b/business/references/k8s_gateway_references_test.go
index c239f570e..64dc43706 100644
--- a/business/references/k8s_gateway_references_test.go
+++ b/business/references/k8s_gateway_references_test.go
@@ -28,12 +28,13 @@ func TestK8sGatewayReferences(t *testing.T) {
 		K8sGateways:   []*k8s_networking_v1.Gateway{gw},
 		K8sHTTPRoutes: []*k8s_networking_v1.HTTPRoute{r1, r2},
 		K8sGRPCRoutes: []*k8s_networking_v1.GRPCRoute{r3, r4},
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"bookinfo": data.CreateWorkloadList("bookinfo",
-				data.CreateWorkloadListItem("bookinfo", map[string]string{conf.IstioLabels.AmbientWaypointGatewayLabel: "bookinfo"})),
-			"test": data.CreateWorkloadList("test",
-				data.CreateWorkloadListItem("test", map[string]string{conf.IstioLabels.AmbientWaypointGatewayLabel: "bookinfo"})),
-		},
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"bookinfo": {
+				data.CreateWorkload("bookinfo", map[string]string{conf.IstioLabels.AmbientWaypointGatewayLabel: "bookinfo"}),
+			},
+			"test": {
+				data.CreateWorkload("test", map[string]string{conf.IstioLabels.AmbientWaypointGatewayLabel: "bookinfo"}),
+			}},
 	}
 
 	references := gatewayReferences.References()
diff --git a/business/references/peer_auth_references_test.go b/business/references/peer_auth_references_test.go
index a62037f21..010f79151 100644
--- a/business/references/peer_auth_references_test.go
+++ b/business/references/peer_auth_references_test.go
@@ -20,11 +20,13 @@ func prepareTestForPeerAuth(pa *security_v1.PeerAuthentication, drs []*networkin
 			DestinationRules:    drs,
 			EnabledAutoMtls:     false,
 		},
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"istio-system": data.CreateWorkloadList("istio-system",
-				data.CreateWorkloadListItem("grafana", map[string]string{"app": "grafana"})),
-			"bookinfo": data.CreateWorkloadList("bookinfo",
-				data.CreateWorkloadListItem("details", map[string]string{"app": "details"})),
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"istio-system": {
+				data.CreateWorkload("grafana", map[string]string{"app": "grafana"}),
+			},
+			"bookinfo": {
+				data.CreateWorkload("details", map[string]string{"app": "details"}),
+			},
 		},
 	}
 	return *drReferences.References()[models.IstioReferenceKey{ObjectGVK: kubernetes.PeerAuthentications, Namespace: pa.Namespace, Name: pa.Name}]
diff --git a/business/references/sidecar_references_test.go b/business/references/sidecar_references_test.go
index 7fe8cfc61..409bec3a8 100644
--- a/business/references/sidecar_references_test.go
+++ b/business/references/sidecar_references_test.go
@@ -20,11 +20,10 @@ func prepareTestForSidecar(sc *networking_v1.Sidecar, vs *networking_v1.VirtualS
 		},
 		Sidecars:       []*networking_v1.Sidecar{sc},
 		ServiceEntries: []*networking_v1.ServiceEntry{se},
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"istio-system": data.CreateWorkloadList("istio-system",
-				data.CreateWorkloadListItem("istiod", map[string]string{"app": "istio-ingressgateway"}),
-			),
-		},
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"istio-system": {
+				data.CreateWorkload("istiod", map[string]string{"app": "istio-ingressgateway"}),
+			}},
 		RegistryServices: data.CreateFakeRegistryServicesLabels("foo-service", "istio-system"),
 	}
 	return *drReferences.References()[models.IstioReferenceKey{ObjectGVK: kubernetes.Sidecars, Namespace: sc.Namespace, Name: sc.Name}]
diff --git a/business/references/workloadgroup_references_test.go b/business/references/workloadgroup_references_test.go
index 0616264b4..049e9a1aa 100644
--- a/business/references/workloadgroup_references_test.go
+++ b/business/references/workloadgroup_references_test.go
@@ -15,13 +15,13 @@ func prepareTestForWorkloadGroup(name string) models.IstioReferences {
 	wgReferences := WorkloadGroupReferences{
 		WorkloadGroups:  data.CreateWorkloadGroups(*config.Get()),
 		WorkloadEntries: data.CreateWorkloadEntries(*config.Get()),
-		WorkloadsPerNamespace: map[string]models.WorkloadList{
-			"Namespace": data.CreateWorkloadList("Namespace",
-				data.CreateWorkloadListItem("ratings-vm", map[string]string{"app": "ratings-vm", "class": "vm", "version": "v3"}),
-				data.CreateWorkloadListItem("ratings-vm2", map[string]string{"app": "ratings-vm2", "class": "vm2", "version": "v4"}),
-				data.CreateWorkloadListItem("ratings-vm-no-entry", map[string]string{"app": "ratings-vm-no-entry", "class": "vm3"}),
-				data.CreateWorkloadListItem("ratings-vm-no-labels", map[string]string{})),
-		},
+		WorkloadsPerNamespace: map[string]models.Workloads{
+			"Namespace": {
+				data.CreateWorkload("ratings-vm", map[string]string{"app": "ratings-vm", "class": "vm", "version": "v3"}),
+				data.CreateWorkload("ratings-vm2", map[string]string{"app": "ratings-vm2", "class": "vm2", "version": "v4"}),
+				data.CreateWorkload("ratings-vm-no-entry", map[string]string{"app": "ratings-vm-no-entry", "class": "vm3"}),
+				data.CreateWorkload("ratings-vm-no-labels", map[string]string{}),
+			}},
 	}
 	return *wgReferences.References()[models.IstioReferenceKey{ObjectGVK: kubernetes.WorkloadGroups, Namespace: "Namespace", Name: name}]
 }
diff --git a/business/testing.go b/business/testing.go
index 57c766a21..d3f16763a 100644
--- a/business/testing.go
+++ b/business/testing.go
@@ -28,7 +28,7 @@ func setWithBackends(cf kubernetes.ClientFactory, prom prometheus.ClientInterfac
 
 // SetupBusinessLayer mocks out some global variables in the business package
 // such as the kiali cache and the prometheus client.
-func SetupBusinessLayer(t *testing.T, k8s kubernetes.ClientInterface, config config.Config) cache.KialiCache {
+func SetupBusinessLayer(t testing.TB, k8s kubernetes.ClientInterface, config config.Config) cache.KialiCache {
 	t.Helper()
 
 	originalClientFactory := clientFactory
diff --git a/kubernetes/cache/testing.go b/kubernetes/cache/testing.go
index 2cd3f9bf3..3d0e82705 100644
--- a/kubernetes/cache/testing.go
+++ b/kubernetes/cache/testing.go
@@ -12,7 +12,7 @@ import (
 	"github.com/kiali/kiali/kubernetes/kubetest"
 )
 
-func newTestingCache(t *testing.T, cf kubernetes.ClientFactory, conf config.Config) KialiCache {
+func newTestingCache(t testing.TB, cf kubernetes.ClientFactory, conf config.Config) KialiCache {
 	t.Helper()
 	// Disabling Istio API for tests. Otherwise the cache will try and poll the Istio endpoint
 	// when the cache is created.
@@ -36,7 +36,7 @@ func NewTestingCache(t *testing.T, k8s kubernetes.ClientInterface, conf config.C
 }
 
 // NewTestingCacheWithFactory allows you to pass in a custom client factory. Good for testing multicluster.
-func NewTestingCacheWithFactory(t *testing.T, cf kubernetes.ClientFactory, conf config.Config) KialiCache {
+func NewTestingCacheWithFactory(t testing.TB, cf kubernetes.ClientFactory, conf config.Config) KialiCache {
 	t.Helper()
 	return newTestingCache(t, cf, conf)
 }
diff --git a/mesh/api/testdata/test_mesh_graph.expected b/mesh/api/testdata/test_mesh_graph.expected
index 596abd954..bab5cad21 100644
--- a/mesh/api/testdata/test_mesh_graph.expected
+++ b/mesh/api/testdata/test_mesh_graph.expected
@@ -319,6 +319,7 @@
             "Registry": null,
             "RootNamespace": "istio-system",
             "UrlServiceVersion": "",
+            "ValidationChangeDetectionEnabled": true,
             "ValidationReconcileInterval": 60000000000
           }
         }
diff --git a/store/fifo_store_test.go b/store/fifo_store_test.go
index 0a88f5a0f..07348a2ad 100644
--- a/store/fifo_store_test.go
+++ b/store/fifo_store_test.go
@@ -6,15 +6,13 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/require"
-
-	"github.com/kiali/kiali/util"
 )
 
 func TestSetAndGet(t *testing.T) {
 	require := require.New(t)
 
 	s := New[string, string]()
-	fifoStore := NewFIFOStore[string, string](s, 3, "test")
+	fifoStore := NewFIFOStore(s, 3, "test")
 	fifoStore.Set("foo", "bar")
 	fifoStore.Set("foo2", "bar2")
 	fifoStore.Set("foo3", "bar3")
@@ -39,7 +37,7 @@ func TestUpdate(t *testing.T) {
 	require := require.New(t)
 
 	s := New[string, string]()
-	fifoStore := NewFIFOStore[string, string](s, 3, "test")
+	fifoStore := NewFIFOStore(s, 3, "test")
 	fifoStore.Set("foo", "bar")
 	fifoStore.Set("foo2", "bar2")
 	fifoStore.Set("foo3", "bar3")
@@ -71,49 +69,18 @@ func TestUpdate(t *testing.T) {
 
 func TestExpired(t *testing.T) {
 	require := require.New(t)
+	ms := 1 * time.Millisecond
 
 	store := New[string, string]()
-	fifoStore := NewFIFOStore[string, string](store, 3, "test")
-	expirationStore := NewExpirationStore[string, string](context.Background(), fifoStore, util.AsPtr(10*time.Second), util.AsPtr(10*time.Second))
-	expirationStore.Set("foo", "bar")
-	expirationStore.Set("foo2", "bar2")
-	expirationStore.Set("foo3", "bar3")
-
-	require.Equal(len(expirationStore.Store.Items()), 3)
-
-	time.Sleep(5 * time.Second)
-	elem, found := expirationStore.Get("foo")
-	require.True(found)
-	require.Equal(elem, "bar")
-
-	time.Sleep(15 * time.Second)
-
-	_, found1 := expirationStore.Get("foo")
-	require.False(found1)
-	_, found2 := expirationStore.Get("foo2")
-	require.False(found2)
-	_, found3 := expirationStore.Get("foo3")
-	require.False(found3)
-}
-
-func TestExpiredNoCleanup(t *testing.T) {
-	require := require.New(t)
-
-	store := New[string, string]()
-	fifoStore := NewFIFOStore[string, string](store, 3, "test")
-	expirationStore := NewExpirationStore[string, string](context.Background(), fifoStore, util.AsPtr(10*time.Second), util.AsPtr(10*time.Second))
+	fifoStore := NewFIFOStore(store, 3, "test")
+	expirationStore := NewExpirationStore(context.Background(), fifoStore, &ms, &ms)
 	expirationStore.Set("foo", "bar")
 	expirationStore.Set("foo2", "bar2")
 	expirationStore.Set("foo3", "bar3")
 
 	require.Equal(len(expirationStore.Store.Items()), 3)
 
-	time.Sleep(5 * time.Second)
-	elem, found := expirationStore.Get("foo")
-	require.True(found)
-	require.Equal(elem, "bar")
-
-	time.Sleep(15 * time.Second)
+	time.Sleep(30 * time.Millisecond)
 
 	_, found1 := expirationStore.Get("foo")
 	require.False(found1)
@@ -121,14 +88,13 @@ func TestExpiredNoCleanup(t *testing.T) {
 	require.False(found2)
 	_, found3 := expirationStore.Get("foo3")
 	require.False(found3)
-
 }
 
 func TestReplace(t *testing.T) {
 	require := require.New(t)
 
 	s := New[string, string]()
-	fifoStore := NewFIFOStore[string, string](s, 3, "test")
+	fifoStore := NewFIFOStore(s, 3, "test")
 	fifoStore.Set("foo", "bar")
 	fifoStore.Set("foo2", "bar2")
 	fifoStore.Set("foo3", "bar3")
diff --git a/store/store_test.go b/store/store_test.go
index dc9b83d42..0619c4888 100644
--- a/store/store_test.go
+++ b/store/store_test.go
@@ -1,7 +1,10 @@
 package store_test
 
 import (
+	"context"
+	"sync"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/require"
 
@@ -140,6 +143,18 @@ func TestItemsReturnsWholeMap(t *testing.T) {
 	require.Equal(99, contents["key2"])
 }
 
+func TestItemsReturnsCopy(t *testing.T) {
+	require := require.New(t)
+
+	testStore := store.New[string, int]()
+	testStore.Replace(map[string]int{"key1": 42, "key2": 99})
+
+	contents := testStore.Items()
+	contents["key1"] = 52
+
+	require.Equal(42, testStore.Items()["key1"])
+}
+
 func TestDeleteKey(t *testing.T) {
 	require := require.New(t)
 
@@ -154,3 +169,41 @@ func TestDeleteKey(t *testing.T) {
 
 	testStore.Remove("nonexistent")
 }
+
+func TestVersionIsThreadsafe(t *testing.T) {
+	duration := time.Millisecond * 100
+	ctx, cancel := context.WithTimeout(context.Background(), duration)
+	defer cancel()
+
+	testStore := store.New[string, int]()
+	testStore.Replace(map[string]int{"key": 0})
+
+	finished := &sync.WaitGroup{}
+	finished.Add(1)
+	go func(ctx context.Context) {
+		defer finished.Done()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			default:
+				testStore.Version()
+			}
+		}
+	}(ctx)
+	finished.Add(1)
+	go func(ctx context.Context) {
+		defer finished.Done()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			default:
+				prev, _ := testStore.Get("key")
+				testStore.Set("key", prev+1)
+			}
+		}
+	}(ctx)
+
+	finished.Wait()
+}
diff --git a/tests/data/policy_data.go b/tests/data/policy_data.go
index 37d9b8ec6..c5e082638 100644
--- a/tests/data/policy_data.go
+++ b/tests/data/policy_data.go
@@ -1,6 +1,9 @@
 package data
 
 import (
+	"fmt"
+	"math/rand/v2"
+
 	api_security_v1 "istio.io/api/security/v1"
 	api_security_v1beta1 "istio.io/api/security/v1beta1"
 	api_v1beta1 "istio.io/api/type/v1beta1"
@@ -11,6 +14,7 @@ func CreateEmptyPeerAuthentication(name, namespace string, mtls *api_security_v1
 	pa := security_v1.PeerAuthentication{}
 	pa.Name = name
 	pa.Namespace = namespace
+	pa.ResourceVersion = fmt.Sprintf("%d", rand.Int64())
 	pa.Spec.Mtls = mtls
 	return &pa
 }
diff --git a/tests/data/workload_data.go b/tests/data/workload_data.go
index 0de93446a..d4f8e3c81 100644
--- a/tests/data/workload_data.go
+++ b/tests/data/workload_data.go
@@ -12,10 +12,10 @@ import (
 	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
-func CreateWorkloadsPerNamespace(namespaces []string, items ...models.WorkloadListItem) map[string]models.WorkloadList {
-	allWorkloads := map[string]models.WorkloadList{}
+func CreateWorkloadsPerNamespace(namespaces []string, workloads models.Workloads) map[string]models.Workloads {
+	allWorkloads := map[string]models.Workloads{}
 	for _, namespace := range namespaces {
-		allWorkloads[namespace] = CreateWorkloadList(namespace, items...)
+		allWorkloads[namespace] = workloads
 	}
 	return allWorkloads
 }
@@ -27,6 +27,22 @@ func CreateWorkloadList(namespace string, items ...models.WorkloadListItem) mode
 	}
 }
 
+func CreateWorkload(name string, labels map[string]string) *models.Workload {
+	w := models.Workload{}
+	w.Name = name
+	w.Labels = labels
+
+	if _, found := labels["app"]; found {
+		w.AppLabel = true
+	}
+
+	if _, found := labels["version"]; found {
+		w.VersionLabel = true
+	}
+
+	return &w
+}
+
 func CreateWorkloadListItem(name string, labels map[string]string) models.WorkloadListItem {
 	wli := models.WorkloadListItem{
 		Name:   name,
diff --git a/tests/integration/controller/testdata/istio-crds/1.22.yaml b/tests/integration/controller/testdata/istio-crds/1.25.yaml
similarity index 73%
rename from tests/integration/controller/testdata/istio-crds/1.22.yaml
rename to tests/integration/controller/testdata/istio-crds/1.25.yaml
index 72f48eb3f..1151d33e2 100644
--- a/tests/integration/controller/testdata/istio-crds/1.22.yaml
+++ b/tests/integration/controller/testdata/istio-crds/1.25.yaml
@@ -1,16 +1,22 @@
----
-# Source: base/crds/crd-all.gen.yaml
-# DO NOT EDIT - Generated by Cue OpenAPI generator based on Istio APIs.
+# Source: base/templates/crds.yaml
+# TODO enableCRDTemplates is now defaulted to true as we
+# want to always self-manage CRD upgrades via plain templates,
+# so we should remove this flag after a few releases
+# If we are templating these CRDs, we want to wipe out the "static"/legacy
+# labels and replace them with the standard templated istio ones.
+# This allows the continued use of `kubectl apply -f crd-all.gen.yaml`
+# without any templating+the old labels, if desired.
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    "helm.sh/resource-policy": keep
+    helm.sh/resource-policy: keep
   labels:
-    app: istio-pilot
-    chart: istio
-    heritage: Tiller
-    release: istio
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: istio
+    app.kubernetes.io/version: 1.25.0
+    helm.sh/chart: base-1.25.0
   name: wasmplugins.extensions.istio.io
 spec:
   group: extensions.istio.io
@@ -122,9 +128,19 @@ spec:
                   properties:
                     matchLabels:
                       additionalProperties:
+                        maxLength: 63
                         type: string
+                        x-kubernetes-validations:
+                          - message: wildcard not allowed in label value match
+                            rule: '!self.contains("*")'
                       description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.
+                      maxProperties: 4096
                       type: object
+                      x-kubernetes-validations:
+                        - message: wildcard not allowed in label key match
+                          rule: self.all(key, !key.contains("*"))
+                        - message: key must not be empty
+                          rule: self.all(key, key.size() != 0)
                   type: object
                 sha256:
                   description: SHA256 checksum that will be used to verify Wasm module or OCI container.
@@ -134,16 +150,29 @@ spec:
                   properties:
                     group:
                       description: group is the group of the target resource.
+                      maxLength: 253
+                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                       type: string
                     kind:
                       description: kind is kind of the target resource.
+                      maxLength: 63
+                      minLength: 1
+                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
                       type: string
                     name:
                       description: name is the name of the target resource.
+                      maxLength: 253
+                      minLength: 1
                       type: string
                     namespace:
                       description: namespace is the namespace of the referent.
                       type: string
+                      x-kubernetes-validations:
+                        - message: cross namespace referencing is not currently supported
+                          rule: self.size() == 0
+                  required:
+                    - kind
+                    - name
                   type: object
                 targetRefs:
                   description: Optional.
@@ -151,17 +180,31 @@ spec:
                     properties:
                       group:
                         description: group is the group of the target resource.
+                        maxLength: 253
+                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
                       kind:
                         description: kind is kind of the target resource.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
                         type: string
                       name:
                         description: name is the name of the target resource.
+                        maxLength: 253
+                        minLength: 1
                         type: string
                       namespace:
                         description: namespace is the namespace of the referent.
                         type: string
+                        x-kubernetes-validations:
+                          - message: cross namespace referencing is not currently supported
+                            rule: self.size() == 0
+                    required:
+                      - kind
+                      - name
                     type: object
+                  maxItems: 16
                   type: array
                 type:
                   description: |-
@@ -179,7 +222,9 @@ spec:
                   type: string
                   x-kubernetes-validations:
                     - message: url must have schema one of [http, https, file, oci]
-                      rule: 'isURL(self) ? (url(self).getScheme() in ['''', ''http'', ''https'', ''oci'', ''file'']) : (isURL(''http://'' + self) && url(''http://'' +self).getScheme() in ['''', ''http'', ''https'', ''oci'', ''file''])'
+                      rule: |-
+                        isURL(self) ? (url(self).getScheme() in ["", "http", "https", "oci", "file"]) : (isURL("http://" + self) &&
+                        url("http://" + self).getScheme() in ["", "http", "https", "oci", "file"])
                 verificationKey:
                   type: string
                 vmConfig:
@@ -212,7 +257,7 @@ spec:
                         type: object
                         x-kubernetes-validations:
                           - message: value may only be set when valueFrom is INLINE
-                            rule: '(has(self.valueFrom) ? self.valueFrom : '''') != ''HOST'' || !has(self.value)'
+                            rule: '(has(self.valueFrom) ? self.valueFrom : "") != "HOST" || !has(self.value)'
                       maxItems: 256
                       type: array
                       x-kubernetes-list-map-keys:
@@ -222,7 +267,77 @@ spec:
               required:
                 - url
               type: object
+              x-kubernetes-validations:
+                - message: only one of targetRefs or selector can be set
+                  rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1'
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
           required:
@@ -233,16 +348,22 @@ spec:
       subresources:
         status: {}
 ---
+# Source: base/templates/crds.yaml
+# If we are templating these CRDs, we want to wipe out the "static"/legacy
+# labels and replace them with the standard templated istio ones.
+# This allows the continued use of `kubectl apply -f crd-all.gen.yaml`
+# without any templating+the old labels, if desired.
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    "helm.sh/resource-policy": keep
+    helm.sh/resource-policy: keep
   labels:
-    app: istio-pilot
-    chart: istio
-    heritage: Tiller
-    release: istio
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: istio
+    app.kubernetes.io/version: 1.25.0
+    helm.sh/chart: base-1.25.0
   name: destinationrules.networking.istio.io
 spec:
   group: networking.istio.io
@@ -323,6 +444,9 @@ spec:
                                   idleTimeout:
                                     description: The idle timeout for upstream connection pool connections.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   maxConcurrentStreams:
                                     description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
                                     format: int32
@@ -345,12 +469,21 @@ spec:
                                   connectTimeout:
                                     description: TCP connection timeout.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   idleTimeout:
                                     description: The idle timeout for TCP connections.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   maxConnectionDuration:
                                     description: The maximum duration of a connection.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   maxConnections:
                                     description: Maximum number of HTTP1 /TCP connections to a destination host.
                                     format: int32
@@ -361,6 +494,9 @@ spec:
                                       interval:
                                         description: The time duration between keep-alive probes.
                                         type: string
+                                        x-kubernetes-validations:
+                                          - message: must be a valid duration greater than 1ms
+                                            rule: duration(self) >= duration('1ms')
                                       probes:
                                         description: Maximum number of keepalive probes to send without response before deciding the connection is dead.
                                         maximum: 4294967295
@@ -369,6 +505,9 @@ spec:
                                       time:
                                         description: The time duration a connection needs to be idle before keep-alive probes start being sent.
                                         type: string
+                                        x-kubernetes-validations:
+                                          - message: must be a valid duration greater than 1ms
+                                            rule: duration(self) >= duration('1ms')
                                     type: object
                                 type: object
                             type: object
@@ -483,7 +622,7 @@ spec:
                                       type: object
                                     type: array
                                   enabled:
-                                    description: enable locality load balancing, this is DestinationRule-level and will override mesh wide settings in entirety.
+                                    description: Enable locality load balancing.
                                     nullable: true
                                     type: boolean
                                   failover:
@@ -516,15 +655,44 @@ spec:
                                   - ROUND_ROBIN
                                   - LEAST_REQUEST
                                 type: string
+                              warmup:
+                                description: Represents the warmup configuration of Service.
+                                properties:
+                                  aggression:
+                                    description: This parameter controls the speed of traffic increase over the warmup duration.
+                                    format: double
+                                    minimum: 1
+                                    nullable: true
+                                    type: number
+                                  duration:
+                                    type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
+                                  minimumPercent:
+                                    format: double
+                                    maximum: 100
+                                    minimum: 0
+                                    nullable: true
+                                    type: number
+                                required:
+                                  - duration
+                                type: object
                               warmupDurationSecs:
-                                description: Represents the warmup duration of Service.
+                                description: 'Deprecated: use `warmup` instead.'
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                             type: object
                           outlierDetection:
                             properties:
                               baseEjectionTime:
                                 description: Minimum ejection duration.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               consecutive5xxErrors:
                                 description: Number of 5xx errors before a host is ejected from the connection pool.
                                 maximum: 4294967295
@@ -549,12 +717,15 @@ spec:
                               interval:
                                 description: Time interval between ejection sweep analysis.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               maxEjectionPercent:
                                 description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
                                 format: int32
                                 type: integer
                               minHealthPercent:
-                                description: Outlier detection will be enabled as long as the associated load balancing pool has at least min_health_percent hosts in healthy mode.
+                                description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
                                 format: int32
                                 type: integer
                               splitExternalLocalOriginErrors:
@@ -591,6 +762,9 @@ spec:
                                         idleTimeout:
                                           description: The idle timeout for upstream connection pool connections.
                                           type: string
+                                          x-kubernetes-validations:
+                                            - message: must be a valid duration greater than 1ms
+                                              rule: duration(self) >= duration('1ms')
                                         maxConcurrentStreams:
                                           description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
                                           format: int32
@@ -613,12 +787,21 @@ spec:
                                         connectTimeout:
                                           description: TCP connection timeout.
                                           type: string
+                                          x-kubernetes-validations:
+                                            - message: must be a valid duration greater than 1ms
+                                              rule: duration(self) >= duration('1ms')
                                         idleTimeout:
                                           description: The idle timeout for TCP connections.
                                           type: string
+                                          x-kubernetes-validations:
+                                            - message: must be a valid duration greater than 1ms
+                                              rule: duration(self) >= duration('1ms')
                                         maxConnectionDuration:
                                           description: The maximum duration of a connection.
                                           type: string
+                                          x-kubernetes-validations:
+                                            - message: must be a valid duration greater than 1ms
+                                              rule: duration(self) >= duration('1ms')
                                         maxConnections:
                                           description: Maximum number of HTTP1 /TCP connections to a destination host.
                                           format: int32
@@ -629,6 +812,9 @@ spec:
                                             interval:
                                               description: The time duration between keep-alive probes.
                                               type: string
+                                              x-kubernetes-validations:
+                                                - message: must be a valid duration greater than 1ms
+                                                  rule: duration(self) >= duration('1ms')
                                             probes:
                                               description: Maximum number of keepalive probes to send without response before deciding the connection is dead.
                                               maximum: 4294967295
@@ -637,6 +823,9 @@ spec:
                                             time:
                                               description: The time duration a connection needs to be idle before keep-alive probes start being sent.
                                               type: string
+                                              x-kubernetes-validations:
+                                                - message: must be a valid duration greater than 1ms
+                                                  rule: duration(self) >= duration('1ms')
                                           type: object
                                       type: object
                                   type: object
@@ -751,7 +940,7 @@ spec:
                                             type: object
                                           type: array
                                         enabled:
-                                          description: enable locality load balancing, this is DestinationRule-level and will override mesh wide settings in entirety.
+                                          description: Enable locality load balancing.
                                           nullable: true
                                           type: boolean
                                         failover:
@@ -784,15 +973,44 @@ spec:
                                         - ROUND_ROBIN
                                         - LEAST_REQUEST
                                       type: string
+                                    warmup:
+                                      description: Represents the warmup configuration of Service.
+                                      properties:
+                                        aggression:
+                                          description: This parameter controls the speed of traffic increase over the warmup duration.
+                                          format: double
+                                          minimum: 1
+                                          nullable: true
+                                          type: number
+                                        duration:
+                                          type: string
+                                          x-kubernetes-validations:
+                                            - message: must be a valid duration greater than 1ms
+                                              rule: duration(self) >= duration('1ms')
+                                        minimumPercent:
+                                          format: double
+                                          maximum: 100
+                                          minimum: 0
+                                          nullable: true
+                                          type: number
+                                      required:
+                                        - duration
+                                      type: object
                                     warmupDurationSecs:
-                                      description: Represents the warmup duration of Service.
+                                      description: 'Deprecated: use `warmup` instead.'
                                       type: string
+                                      x-kubernetes-validations:
+                                        - message: must be a valid duration greater than 1ms
+                                          rule: duration(self) >= duration('1ms')
                                   type: object
                                 outlierDetection:
                                   properties:
                                     baseEjectionTime:
                                       description: Minimum ejection duration.
                                       type: string
+                                      x-kubernetes-validations:
+                                        - message: must be a valid duration greater than 1ms
+                                          rule: duration(self) >= duration('1ms')
                                     consecutive5xxErrors:
                                       description: Number of 5xx errors before a host is ejected from the connection pool.
                                       maximum: 4294967295
@@ -817,12 +1035,15 @@ spec:
                                     interval:
                                       description: Time interval between ejection sweep analysis.
                                       type: string
+                                      x-kubernetes-validations:
+                                        - message: must be a valid duration greater than 1ms
+                                          rule: duration(self) >= duration('1ms')
                                     maxEjectionPercent:
                                       description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
                                       format: int32
                                       type: integer
                                     minHealthPercent:
-                                      description: Outlier detection will be enabled as long as the associated load balancing pool has at least min_health_percent hosts in healthy mode.
+                                      description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
                                       format: int32
                                       type: integer
                                     splitExternalLocalOriginErrors:
@@ -880,6 +1101,7 @@ spec:
                                       type: array
                                   type: object
                               type: object
+                            maxItems: 4096
                             type: array
                           proxyProtocol:
                             description: The upstream PROXY protocol settings.
@@ -988,6 +1210,9 @@ spec:
                             idleTimeout:
                               description: The idle timeout for upstream connection pool connections.
                               type: string
+                              x-kubernetes-validations:
+                                - message: must be a valid duration greater than 1ms
+                                  rule: duration(self) >= duration('1ms')
                             maxConcurrentStreams:
                               description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
                               format: int32
@@ -1010,12 +1235,21 @@ spec:
                             connectTimeout:
                               description: TCP connection timeout.
                               type: string
+                              x-kubernetes-validations:
+                                - message: must be a valid duration greater than 1ms
+                                  rule: duration(self) >= duration('1ms')
                             idleTimeout:
                               description: The idle timeout for TCP connections.
                               type: string
+                              x-kubernetes-validations:
+                                - message: must be a valid duration greater than 1ms
+                                  rule: duration(self) >= duration('1ms')
                             maxConnectionDuration:
                               description: The maximum duration of a connection.
                               type: string
+                              x-kubernetes-validations:
+                                - message: must be a valid duration greater than 1ms
+                                  rule: duration(self) >= duration('1ms')
                             maxConnections:
                               description: Maximum number of HTTP1 /TCP connections to a destination host.
                               format: int32
@@ -1026,6 +1260,9 @@ spec:
                                 interval:
                                   description: The time duration between keep-alive probes.
                                   type: string
+                                  x-kubernetes-validations:
+                                    - message: must be a valid duration greater than 1ms
+                                      rule: duration(self) >= duration('1ms')
                                 probes:
                                   description: Maximum number of keepalive probes to send without response before deciding the connection is dead.
                                   maximum: 4294967295
@@ -1034,6 +1271,9 @@ spec:
                                 time:
                                   description: The time duration a connection needs to be idle before keep-alive probes start being sent.
                                   type: string
+                                  x-kubernetes-validations:
+                                    - message: must be a valid duration greater than 1ms
+                                      rule: duration(self) >= duration('1ms')
                               type: object
                           type: object
                       type: object
@@ -1148,7 +1388,7 @@ spec:
                                 type: object
                               type: array
                             enabled:
-                              description: enable locality load balancing, this is DestinationRule-level and will override mesh wide settings in entirety.
+                              description: Enable locality load balancing.
                               nullable: true
                               type: boolean
                             failover:
@@ -1181,15 +1421,44 @@ spec:
                             - ROUND_ROBIN
                             - LEAST_REQUEST
                           type: string
+                        warmup:
+                          description: Represents the warmup configuration of Service.
+                          properties:
+                            aggression:
+                              description: This parameter controls the speed of traffic increase over the warmup duration.
+                              format: double
+                              minimum: 1
+                              nullable: true
+                              type: number
+                            duration:
+                              type: string
+                              x-kubernetes-validations:
+                                - message: must be a valid duration greater than 1ms
+                                  rule: duration(self) >= duration('1ms')
+                            minimumPercent:
+                              format: double
+                              maximum: 100
+                              minimum: 0
+                              nullable: true
+                              type: number
+                          required:
+                            - duration
+                          type: object
                         warmupDurationSecs:
-                          description: Represents the warmup duration of Service.
+                          description: 'Deprecated: use `warmup` instead.'
                           type: string
+                          x-kubernetes-validations:
+                            - message: must be a valid duration greater than 1ms
+                              rule: duration(self) >= duration('1ms')
                       type: object
                     outlierDetection:
                       properties:
                         baseEjectionTime:
                           description: Minimum ejection duration.
                           type: string
+                          x-kubernetes-validations:
+                            - message: must be a valid duration greater than 1ms
+                              rule: duration(self) >= duration('1ms')
                         consecutive5xxErrors:
                           description: Number of 5xx errors before a host is ejected from the connection pool.
                           maximum: 4294967295
@@ -1214,12 +1483,15 @@ spec:
                         interval:
                           description: Time interval between ejection sweep analysis.
                           type: string
+                          x-kubernetes-validations:
+                            - message: must be a valid duration greater than 1ms
+                              rule: duration(self) >= duration('1ms')
                         maxEjectionPercent:
                           description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
                           format: int32
                           type: integer
                         minHealthPercent:
-                          description: Outlier detection will be enabled as long as the associated load balancing pool has at least min_health_percent hosts in healthy mode.
+                          description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
                           format: int32
                           type: integer
                         splitExternalLocalOriginErrors:
@@ -1256,6 +1528,9 @@ spec:
                                   idleTimeout:
                                     description: The idle timeout for upstream connection pool connections.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   maxConcurrentStreams:
                                     description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
                                     format: int32
@@ -1278,12 +1553,21 @@ spec:
                                   connectTimeout:
                                     description: TCP connection timeout.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   idleTimeout:
                                     description: The idle timeout for TCP connections.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   maxConnectionDuration:
                                     description: The maximum duration of a connection.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   maxConnections:
                                     description: Maximum number of HTTP1 /TCP connections to a destination host.
                                     format: int32
@@ -1294,6 +1578,9 @@ spec:
                                       interval:
                                         description: The time duration between keep-alive probes.
                                         type: string
+                                        x-kubernetes-validations:
+                                          - message: must be a valid duration greater than 1ms
+                                            rule: duration(self) >= duration('1ms')
                                       probes:
                                         description: Maximum number of keepalive probes to send without response before deciding the connection is dead.
                                         maximum: 4294967295
@@ -1302,6 +1589,9 @@ spec:
                                       time:
                                         description: The time duration a connection needs to be idle before keep-alive probes start being sent.
                                         type: string
+                                        x-kubernetes-validations:
+                                          - message: must be a valid duration greater than 1ms
+                                            rule: duration(self) >= duration('1ms')
                                     type: object
                                 type: object
                             type: object
@@ -1416,7 +1706,7 @@ spec:
                                       type: object
                                     type: array
                                   enabled:
-                                    description: enable locality load balancing, this is DestinationRule-level and will override mesh wide settings in entirety.
+                                    description: Enable locality load balancing.
                                     nullable: true
                                     type: boolean
                                   failover:
@@ -1449,15 +1739,44 @@ spec:
                                   - ROUND_ROBIN
                                   - LEAST_REQUEST
                                 type: string
+                              warmup:
+                                description: Represents the warmup configuration of Service.
+                                properties:
+                                  aggression:
+                                    description: This parameter controls the speed of traffic increase over the warmup duration.
+                                    format: double
+                                    minimum: 1
+                                    nullable: true
+                                    type: number
+                                  duration:
+                                    type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
+                                  minimumPercent:
+                                    format: double
+                                    maximum: 100
+                                    minimum: 0
+                                    nullable: true
+                                    type: number
+                                required:
+                                  - duration
+                                type: object
                               warmupDurationSecs:
-                                description: Represents the warmup duration of Service.
+                                description: 'Deprecated: use `warmup` instead.'
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                             type: object
                           outlierDetection:
                             properties:
                               baseEjectionTime:
                                 description: Minimum ejection duration.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               consecutive5xxErrors:
                                 description: Number of 5xx errors before a host is ejected from the connection pool.
                                 maximum: 4294967295
@@ -1482,12 +1801,15 @@ spec:
                               interval:
                                 description: Time interval between ejection sweep analysis.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               maxEjectionPercent:
                                 description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
                                 format: int32
                                 type: integer
                               minHealthPercent:
-                                description: Outlier detection will be enabled as long as the associated load balancing pool has at least min_health_percent hosts in healthy mode.
+                                description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
                                 format: int32
                                 type: integer
                               splitExternalLocalOriginErrors:
@@ -1545,6 +1867,7 @@ spec:
                                 type: array
                             type: object
                         type: object
+                      maxItems: 4096
                       type: array
                     proxyProtocol:
                       description: The upstream PROXY protocol settings.
@@ -1625,14 +1948,91 @@ spec:
                   properties:
                     matchLabels:
                       additionalProperties:
+                        maxLength: 63
                         type: string
+                        x-kubernetes-validations:
+                          - message: wildcard not allowed in label value match
+                            rule: '!self.contains("*")'
                       description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.
+                      maxProperties: 4096
                       type: object
+                      x-kubernetes-validations:
+                        - message: wildcard not allowed in label key match
+                          rule: self.all(key, !key.contains("*"))
+                        - message: key must not be empty
+                          rule: self.all(key, key.size() != 0)
                   type: object
               required:
                 - host
               type: object
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
           type: object
@@ -1705,6 +2105,9 @@ spec:
                                   idleTimeout:
                                     description: The idle timeout for upstream connection pool connections.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   maxConcurrentStreams:
                                     description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
                                     format: int32
@@ -1727,12 +2130,21 @@ spec:
                                   connectTimeout:
                                     description: TCP connection timeout.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   idleTimeout:
                                     description: The idle timeout for TCP connections.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   maxConnectionDuration:
                                     description: The maximum duration of a connection.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   maxConnections:
                                     description: Maximum number of HTTP1 /TCP connections to a destination host.
                                     format: int32
@@ -1743,6 +2155,9 @@ spec:
                                       interval:
                                         description: The time duration between keep-alive probes.
                                         type: string
+                                        x-kubernetes-validations:
+                                          - message: must be a valid duration greater than 1ms
+                                            rule: duration(self) >= duration('1ms')
                                       probes:
                                         description: Maximum number of keepalive probes to send without response before deciding the connection is dead.
                                         maximum: 4294967295
@@ -1751,6 +2166,9 @@ spec:
                                       time:
                                         description: The time duration a connection needs to be idle before keep-alive probes start being sent.
                                         type: string
+                                        x-kubernetes-validations:
+                                          - message: must be a valid duration greater than 1ms
+                                            rule: duration(self) >= duration('1ms')
                                     type: object
                                 type: object
                             type: object
@@ -1865,7 +2283,7 @@ spec:
                                       type: object
                                     type: array
                                   enabled:
-                                    description: enable locality load balancing, this is DestinationRule-level and will override mesh wide settings in entirety.
+                                    description: Enable locality load balancing.
                                     nullable: true
                                     type: boolean
                                   failover:
@@ -1898,15 +2316,44 @@ spec:
                                   - ROUND_ROBIN
                                   - LEAST_REQUEST
                                 type: string
+                              warmup:
+                                description: Represents the warmup configuration of Service.
+                                properties:
+                                  aggression:
+                                    description: This parameter controls the speed of traffic increase over the warmup duration.
+                                    format: double
+                                    minimum: 1
+                                    nullable: true
+                                    type: number
+                                  duration:
+                                    type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
+                                  minimumPercent:
+                                    format: double
+                                    maximum: 100
+                                    minimum: 0
+                                    nullable: true
+                                    type: number
+                                required:
+                                  - duration
+                                type: object
                               warmupDurationSecs:
-                                description: Represents the warmup duration of Service.
+                                description: 'Deprecated: use `warmup` instead.'
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                             type: object
                           outlierDetection:
                             properties:
                               baseEjectionTime:
                                 description: Minimum ejection duration.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               consecutive5xxErrors:
                                 description: Number of 5xx errors before a host is ejected from the connection pool.
                                 maximum: 4294967295
@@ -1931,12 +2378,15 @@ spec:
                               interval:
                                 description: Time interval between ejection sweep analysis.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               maxEjectionPercent:
                                 description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
                                 format: int32
                                 type: integer
                               minHealthPercent:
-                                description: Outlier detection will be enabled as long as the associated load balancing pool has at least min_health_percent hosts in healthy mode.
+                                description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
                                 format: int32
                                 type: integer
                               splitExternalLocalOriginErrors:
@@ -1973,6 +2423,9 @@ spec:
                                         idleTimeout:
                                           description: The idle timeout for upstream connection pool connections.
                                           type: string
+                                          x-kubernetes-validations:
+                                            - message: must be a valid duration greater than 1ms
+                                              rule: duration(self) >= duration('1ms')
                                         maxConcurrentStreams:
                                           description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
                                           format: int32
@@ -1995,12 +2448,21 @@ spec:
                                         connectTimeout:
                                           description: TCP connection timeout.
                                           type: string
+                                          x-kubernetes-validations:
+                                            - message: must be a valid duration greater than 1ms
+                                              rule: duration(self) >= duration('1ms')
                                         idleTimeout:
                                           description: The idle timeout for TCP connections.
                                           type: string
+                                          x-kubernetes-validations:
+                                            - message: must be a valid duration greater than 1ms
+                                              rule: duration(self) >= duration('1ms')
                                         maxConnectionDuration:
                                           description: The maximum duration of a connection.
                                           type: string
+                                          x-kubernetes-validations:
+                                            - message: must be a valid duration greater than 1ms
+                                              rule: duration(self) >= duration('1ms')
                                         maxConnections:
                                           description: Maximum number of HTTP1 /TCP connections to a destination host.
                                           format: int32
@@ -2011,6 +2473,9 @@ spec:
                                             interval:
                                               description: The time duration between keep-alive probes.
                                               type: string
+                                              x-kubernetes-validations:
+                                                - message: must be a valid duration greater than 1ms
+                                                  rule: duration(self) >= duration('1ms')
                                             probes:
                                               description: Maximum number of keepalive probes to send without response before deciding the connection is dead.
                                               maximum: 4294967295
@@ -2019,6 +2484,9 @@ spec:
                                             time:
                                               description: The time duration a connection needs to be idle before keep-alive probes start being sent.
                                               type: string
+                                              x-kubernetes-validations:
+                                                - message: must be a valid duration greater than 1ms
+                                                  rule: duration(self) >= duration('1ms')
                                           type: object
                                       type: object
                                   type: object
@@ -2133,7 +2601,7 @@ spec:
                                             type: object
                                           type: array
                                         enabled:
-                                          description: enable locality load balancing, this is DestinationRule-level and will override mesh wide settings in entirety.
+                                          description: Enable locality load balancing.
                                           nullable: true
                                           type: boolean
                                         failover:
@@ -2166,15 +2634,44 @@ spec:
                                         - ROUND_ROBIN
                                         - LEAST_REQUEST
                                       type: string
+                                    warmup:
+                                      description: Represents the warmup configuration of Service.
+                                      properties:
+                                        aggression:
+                                          description: This parameter controls the speed of traffic increase over the warmup duration.
+                                          format: double
+                                          minimum: 1
+                                          nullable: true
+                                          type: number
+                                        duration:
+                                          type: string
+                                          x-kubernetes-validations:
+                                            - message: must be a valid duration greater than 1ms
+                                              rule: duration(self) >= duration('1ms')
+                                        minimumPercent:
+                                          format: double
+                                          maximum: 100
+                                          minimum: 0
+                                          nullable: true
+                                          type: number
+                                      required:
+                                        - duration
+                                      type: object
                                     warmupDurationSecs:
-                                      description: Represents the warmup duration of Service.
+                                      description: 'Deprecated: use `warmup` instead.'
                                       type: string
+                                      x-kubernetes-validations:
+                                        - message: must be a valid duration greater than 1ms
+                                          rule: duration(self) >= duration('1ms')
                                   type: object
                                 outlierDetection:
                                   properties:
                                     baseEjectionTime:
                                       description: Minimum ejection duration.
                                       type: string
+                                      x-kubernetes-validations:
+                                        - message: must be a valid duration greater than 1ms
+                                          rule: duration(self) >= duration('1ms')
                                     consecutive5xxErrors:
                                       description: Number of 5xx errors before a host is ejected from the connection pool.
                                       maximum: 4294967295
@@ -2199,12 +2696,15 @@ spec:
                                     interval:
                                       description: Time interval between ejection sweep analysis.
                                       type: string
+                                      x-kubernetes-validations:
+                                        - message: must be a valid duration greater than 1ms
+                                          rule: duration(self) >= duration('1ms')
                                     maxEjectionPercent:
                                       description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
                                       format: int32
                                       type: integer
                                     minHealthPercent:
-                                      description: Outlier detection will be enabled as long as the associated load balancing pool has at least min_health_percent hosts in healthy mode.
+                                      description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
                                       format: int32
                                       type: integer
                                     splitExternalLocalOriginErrors:
@@ -2262,6 +2762,7 @@ spec:
                                       type: array
                                   type: object
                               type: object
+                            maxItems: 4096
                             type: array
                           proxyProtocol:
                             description: The upstream PROXY protocol settings.
@@ -2370,6 +2871,9 @@ spec:
                             idleTimeout:
                               description: The idle timeout for upstream connection pool connections.
                               type: string
+                              x-kubernetes-validations:
+                                - message: must be a valid duration greater than 1ms
+                                  rule: duration(self) >= duration('1ms')
                             maxConcurrentStreams:
                               description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
                               format: int32
@@ -2392,12 +2896,21 @@ spec:
                             connectTimeout:
                               description: TCP connection timeout.
                               type: string
+                              x-kubernetes-validations:
+                                - message: must be a valid duration greater than 1ms
+                                  rule: duration(self) >= duration('1ms')
                             idleTimeout:
                               description: The idle timeout for TCP connections.
                               type: string
+                              x-kubernetes-validations:
+                                - message: must be a valid duration greater than 1ms
+                                  rule: duration(self) >= duration('1ms')
                             maxConnectionDuration:
                               description: The maximum duration of a connection.
                               type: string
+                              x-kubernetes-validations:
+                                - message: must be a valid duration greater than 1ms
+                                  rule: duration(self) >= duration('1ms')
                             maxConnections:
                               description: Maximum number of HTTP1 /TCP connections to a destination host.
                               format: int32
@@ -2408,6 +2921,9 @@ spec:
                                 interval:
                                   description: The time duration between keep-alive probes.
                                   type: string
+                                  x-kubernetes-validations:
+                                    - message: must be a valid duration greater than 1ms
+                                      rule: duration(self) >= duration('1ms')
                                 probes:
                                   description: Maximum number of keepalive probes to send without response before deciding the connection is dead.
                                   maximum: 4294967295
@@ -2416,6 +2932,9 @@ spec:
                                 time:
                                   description: The time duration a connection needs to be idle before keep-alive probes start being sent.
                                   type: string
+                                  x-kubernetes-validations:
+                                    - message: must be a valid duration greater than 1ms
+                                      rule: duration(self) >= duration('1ms')
                               type: object
                           type: object
                       type: object
@@ -2530,7 +3049,7 @@ spec:
                                 type: object
                               type: array
                             enabled:
-                              description: enable locality load balancing, this is DestinationRule-level and will override mesh wide settings in entirety.
+                              description: Enable locality load balancing.
                               nullable: true
                               type: boolean
                             failover:
@@ -2563,15 +3082,44 @@ spec:
                             - ROUND_ROBIN
                             - LEAST_REQUEST
                           type: string
+                        warmup:
+                          description: Represents the warmup configuration of Service.
+                          properties:
+                            aggression:
+                              description: This parameter controls the speed of traffic increase over the warmup duration.
+                              format: double
+                              minimum: 1
+                              nullable: true
+                              type: number
+                            duration:
+                              type: string
+                              x-kubernetes-validations:
+                                - message: must be a valid duration greater than 1ms
+                                  rule: duration(self) >= duration('1ms')
+                            minimumPercent:
+                              format: double
+                              maximum: 100
+                              minimum: 0
+                              nullable: true
+                              type: number
+                          required:
+                            - duration
+                          type: object
                         warmupDurationSecs:
-                          description: Represents the warmup duration of Service.
+                          description: 'Deprecated: use `warmup` instead.'
                           type: string
+                          x-kubernetes-validations:
+                            - message: must be a valid duration greater than 1ms
+                              rule: duration(self) >= duration('1ms')
                       type: object
                     outlierDetection:
                       properties:
                         baseEjectionTime:
                           description: Minimum ejection duration.
                           type: string
+                          x-kubernetes-validations:
+                            - message: must be a valid duration greater than 1ms
+                              rule: duration(self) >= duration('1ms')
                         consecutive5xxErrors:
                           description: Number of 5xx errors before a host is ejected from the connection pool.
                           maximum: 4294967295
@@ -2596,12 +3144,15 @@ spec:
                         interval:
                           description: Time interval between ejection sweep analysis.
                           type: string
+                          x-kubernetes-validations:
+                            - message: must be a valid duration greater than 1ms
+                              rule: duration(self) >= duration('1ms')
                         maxEjectionPercent:
                           description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
                           format: int32
                           type: integer
                         minHealthPercent:
-                          description: Outlier detection will be enabled as long as the associated load balancing pool has at least min_health_percent hosts in healthy mode.
+                          description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
                           format: int32
                           type: integer
                         splitExternalLocalOriginErrors:
@@ -2638,6 +3189,9 @@ spec:
                                   idleTimeout:
                                     description: The idle timeout for upstream connection pool connections.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   maxConcurrentStreams:
                                     description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
                                     format: int32
@@ -2660,12 +3214,21 @@ spec:
                                   connectTimeout:
                                     description: TCP connection timeout.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   idleTimeout:
                                     description: The idle timeout for TCP connections.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   maxConnectionDuration:
                                     description: The maximum duration of a connection.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   maxConnections:
                                     description: Maximum number of HTTP1 /TCP connections to a destination host.
                                     format: int32
@@ -2676,6 +3239,9 @@ spec:
                                       interval:
                                         description: The time duration between keep-alive probes.
                                         type: string
+                                        x-kubernetes-validations:
+                                          - message: must be a valid duration greater than 1ms
+                                            rule: duration(self) >= duration('1ms')
                                       probes:
                                         description: Maximum number of keepalive probes to send without response before deciding the connection is dead.
                                         maximum: 4294967295
@@ -2684,6 +3250,9 @@ spec:
                                       time:
                                         description: The time duration a connection needs to be idle before keep-alive probes start being sent.
                                         type: string
+                                        x-kubernetes-validations:
+                                          - message: must be a valid duration greater than 1ms
+                                            rule: duration(self) >= duration('1ms')
                                     type: object
                                 type: object
                             type: object
@@ -2798,7 +3367,7 @@ spec:
                                       type: object
                                     type: array
                                   enabled:
-                                    description: enable locality load balancing, this is DestinationRule-level and will override mesh wide settings in entirety.
+                                    description: Enable locality load balancing.
                                     nullable: true
                                     type: boolean
                                   failover:
@@ -2831,15 +3400,44 @@ spec:
                                   - ROUND_ROBIN
                                   - LEAST_REQUEST
                                 type: string
+                              warmup:
+                                description: Represents the warmup configuration of Service.
+                                properties:
+                                  aggression:
+                                    description: This parameter controls the speed of traffic increase over the warmup duration.
+                                    format: double
+                                    minimum: 1
+                                    nullable: true
+                                    type: number
+                                  duration:
+                                    type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
+                                  minimumPercent:
+                                    format: double
+                                    maximum: 100
+                                    minimum: 0
+                                    nullable: true
+                                    type: number
+                                required:
+                                  - duration
+                                type: object
                               warmupDurationSecs:
-                                description: Represents the warmup duration of Service.
+                                description: 'Deprecated: use `warmup` instead.'
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                             type: object
                           outlierDetection:
                             properties:
                               baseEjectionTime:
                                 description: Minimum ejection duration.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               consecutive5xxErrors:
                                 description: Number of 5xx errors before a host is ejected from the connection pool.
                                 maximum: 4294967295
@@ -2864,12 +3462,15 @@ spec:
                               interval:
                                 description: Time interval between ejection sweep analysis.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               maxEjectionPercent:
                                 description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
                                 format: int32
                                 type: integer
                               minHealthPercent:
-                                description: Outlier detection will be enabled as long as the associated load balancing pool has at least min_health_percent hosts in healthy mode.
+                                description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
                                 format: int32
                                 type: integer
                               splitExternalLocalOriginErrors:
@@ -2927,6 +3528,7 @@ spec:
                                 type: array
                             type: object
                         type: object
+                      maxItems: 4096
                       type: array
                     proxyProtocol:
                       description: The upstream PROXY protocol settings.
@@ -3007,14 +3609,91 @@ spec:
                   properties:
                     matchLabels:
                       additionalProperties:
+                        maxLength: 63
                         type: string
+                        x-kubernetes-validations:
+                          - message: wildcard not allowed in label value match
+                            rule: '!self.contains("*")'
                       description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.
+                      maxProperties: 4096
                       type: object
+                      x-kubernetes-validations:
+                        - message: wildcard not allowed in label key match
+                          rule: self.all(key, !key.contains("*"))
+                        - message: key must not be empty
+                          rule: self.all(key, key.size() != 0)
                   type: object
               required:
                 - host
               type: object
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
           type: object
@@ -3087,6 +3766,9 @@ spec:
                                   idleTimeout:
                                     description: The idle timeout for upstream connection pool connections.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   maxConcurrentStreams:
                                     description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
                                     format: int32
@@ -3109,12 +3791,21 @@ spec:
                                   connectTimeout:
                                     description: TCP connection timeout.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   idleTimeout:
                                     description: The idle timeout for TCP connections.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   maxConnectionDuration:
                                     description: The maximum duration of a connection.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   maxConnections:
                                     description: Maximum number of HTTP1 /TCP connections to a destination host.
                                     format: int32
@@ -3125,6 +3816,9 @@ spec:
                                       interval:
                                         description: The time duration between keep-alive probes.
                                         type: string
+                                        x-kubernetes-validations:
+                                          - message: must be a valid duration greater than 1ms
+                                            rule: duration(self) >= duration('1ms')
                                       probes:
                                         description: Maximum number of keepalive probes to send without response before deciding the connection is dead.
                                         maximum: 4294967295
@@ -3133,6 +3827,9 @@ spec:
                                       time:
                                         description: The time duration a connection needs to be idle before keep-alive probes start being sent.
                                         type: string
+                                        x-kubernetes-validations:
+                                          - message: must be a valid duration greater than 1ms
+                                            rule: duration(self) >= duration('1ms')
                                     type: object
                                 type: object
                             type: object
@@ -3247,7 +3944,7 @@ spec:
                                       type: object
                                     type: array
                                   enabled:
-                                    description: enable locality load balancing, this is DestinationRule-level and will override mesh wide settings in entirety.
+                                    description: Enable locality load balancing.
                                     nullable: true
                                     type: boolean
                                   failover:
@@ -3280,15 +3977,44 @@ spec:
                                   - ROUND_ROBIN
                                   - LEAST_REQUEST
                                 type: string
+                              warmup:
+                                description: Represents the warmup configuration of Service.
+                                properties:
+                                  aggression:
+                                    description: This parameter controls the speed of traffic increase over the warmup duration.
+                                    format: double
+                                    minimum: 1
+                                    nullable: true
+                                    type: number
+                                  duration:
+                                    type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
+                                  minimumPercent:
+                                    format: double
+                                    maximum: 100
+                                    minimum: 0
+                                    nullable: true
+                                    type: number
+                                required:
+                                  - duration
+                                type: object
                               warmupDurationSecs:
-                                description: Represents the warmup duration of Service.
+                                description: 'Deprecated: use `warmup` instead.'
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                             type: object
                           outlierDetection:
                             properties:
                               baseEjectionTime:
                                 description: Minimum ejection duration.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               consecutive5xxErrors:
                                 description: Number of 5xx errors before a host is ejected from the connection pool.
                                 maximum: 4294967295
@@ -3313,12 +4039,15 @@ spec:
                               interval:
                                 description: Time interval between ejection sweep analysis.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               maxEjectionPercent:
                                 description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
                                 format: int32
                                 type: integer
                               minHealthPercent:
-                                description: Outlier detection will be enabled as long as the associated load balancing pool has at least min_health_percent hosts in healthy mode.
+                                description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
                                 format: int32
                                 type: integer
                               splitExternalLocalOriginErrors:
@@ -3355,6 +4084,9 @@ spec:
                                         idleTimeout:
                                           description: The idle timeout for upstream connection pool connections.
                                           type: string
+                                          x-kubernetes-validations:
+                                            - message: must be a valid duration greater than 1ms
+                                              rule: duration(self) >= duration('1ms')
                                         maxConcurrentStreams:
                                           description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
                                           format: int32
@@ -3377,12 +4109,21 @@ spec:
                                         connectTimeout:
                                           description: TCP connection timeout.
                                           type: string
+                                          x-kubernetes-validations:
+                                            - message: must be a valid duration greater than 1ms
+                                              rule: duration(self) >= duration('1ms')
                                         idleTimeout:
                                           description: The idle timeout for TCP connections.
                                           type: string
+                                          x-kubernetes-validations:
+                                            - message: must be a valid duration greater than 1ms
+                                              rule: duration(self) >= duration('1ms')
                                         maxConnectionDuration:
                                           description: The maximum duration of a connection.
                                           type: string
+                                          x-kubernetes-validations:
+                                            - message: must be a valid duration greater than 1ms
+                                              rule: duration(self) >= duration('1ms')
                                         maxConnections:
                                           description: Maximum number of HTTP1 /TCP connections to a destination host.
                                           format: int32
@@ -3393,6 +4134,9 @@ spec:
                                             interval:
                                               description: The time duration between keep-alive probes.
                                               type: string
+                                              x-kubernetes-validations:
+                                                - message: must be a valid duration greater than 1ms
+                                                  rule: duration(self) >= duration('1ms')
                                             probes:
                                               description: Maximum number of keepalive probes to send without response before deciding the connection is dead.
                                               maximum: 4294967295
@@ -3401,6 +4145,9 @@ spec:
                                             time:
                                               description: The time duration a connection needs to be idle before keep-alive probes start being sent.
                                               type: string
+                                              x-kubernetes-validations:
+                                                - message: must be a valid duration greater than 1ms
+                                                  rule: duration(self) >= duration('1ms')
                                           type: object
                                       type: object
                                   type: object
@@ -3515,7 +4262,7 @@ spec:
                                             type: object
                                           type: array
                                         enabled:
-                                          description: enable locality load balancing, this is DestinationRule-level and will override mesh wide settings in entirety.
+                                          description: Enable locality load balancing.
                                           nullable: true
                                           type: boolean
                                         failover:
@@ -3548,15 +4295,44 @@ spec:
                                         - ROUND_ROBIN
                                         - LEAST_REQUEST
                                       type: string
+                                    warmup:
+                                      description: Represents the warmup configuration of Service.
+                                      properties:
+                                        aggression:
+                                          description: This parameter controls the speed of traffic increase over the warmup duration.
+                                          format: double
+                                          minimum: 1
+                                          nullable: true
+                                          type: number
+                                        duration:
+                                          type: string
+                                          x-kubernetes-validations:
+                                            - message: must be a valid duration greater than 1ms
+                                              rule: duration(self) >= duration('1ms')
+                                        minimumPercent:
+                                          format: double
+                                          maximum: 100
+                                          minimum: 0
+                                          nullable: true
+                                          type: number
+                                      required:
+                                        - duration
+                                      type: object
                                     warmupDurationSecs:
-                                      description: Represents the warmup duration of Service.
+                                      description: 'Deprecated: use `warmup` instead.'
                                       type: string
+                                      x-kubernetes-validations:
+                                        - message: must be a valid duration greater than 1ms
+                                          rule: duration(self) >= duration('1ms')
                                   type: object
                                 outlierDetection:
                                   properties:
                                     baseEjectionTime:
                                       description: Minimum ejection duration.
                                       type: string
+                                      x-kubernetes-validations:
+                                        - message: must be a valid duration greater than 1ms
+                                          rule: duration(self) >= duration('1ms')
                                     consecutive5xxErrors:
                                       description: Number of 5xx errors before a host is ejected from the connection pool.
                                       maximum: 4294967295
@@ -3581,12 +4357,15 @@ spec:
                                     interval:
                                       description: Time interval between ejection sweep analysis.
                                       type: string
+                                      x-kubernetes-validations:
+                                        - message: must be a valid duration greater than 1ms
+                                          rule: duration(self) >= duration('1ms')
                                     maxEjectionPercent:
                                       description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
                                       format: int32
                                       type: integer
                                     minHealthPercent:
-                                      description: Outlier detection will be enabled as long as the associated load balancing pool has at least min_health_percent hosts in healthy mode.
+                                      description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
                                       format: int32
                                       type: integer
                                     splitExternalLocalOriginErrors:
@@ -3644,6 +4423,7 @@ spec:
                                       type: array
                                   type: object
                               type: object
+                            maxItems: 4096
                             type: array
                           proxyProtocol:
                             description: The upstream PROXY protocol settings.
@@ -3752,6 +4532,9 @@ spec:
                             idleTimeout:
                               description: The idle timeout for upstream connection pool connections.
                               type: string
+                              x-kubernetes-validations:
+                                - message: must be a valid duration greater than 1ms
+                                  rule: duration(self) >= duration('1ms')
                             maxConcurrentStreams:
                               description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
                               format: int32
@@ -3774,12 +4557,21 @@ spec:
                             connectTimeout:
                               description: TCP connection timeout.
                               type: string
+                              x-kubernetes-validations:
+                                - message: must be a valid duration greater than 1ms
+                                  rule: duration(self) >= duration('1ms')
                             idleTimeout:
                               description: The idle timeout for TCP connections.
                               type: string
+                              x-kubernetes-validations:
+                                - message: must be a valid duration greater than 1ms
+                                  rule: duration(self) >= duration('1ms')
                             maxConnectionDuration:
                               description: The maximum duration of a connection.
                               type: string
+                              x-kubernetes-validations:
+                                - message: must be a valid duration greater than 1ms
+                                  rule: duration(self) >= duration('1ms')
                             maxConnections:
                               description: Maximum number of HTTP1 /TCP connections to a destination host.
                               format: int32
@@ -3790,6 +4582,9 @@ spec:
                                 interval:
                                   description: The time duration between keep-alive probes.
                                   type: string
+                                  x-kubernetes-validations:
+                                    - message: must be a valid duration greater than 1ms
+                                      rule: duration(self) >= duration('1ms')
                                 probes:
                                   description: Maximum number of keepalive probes to send without response before deciding the connection is dead.
                                   maximum: 4294967295
@@ -3798,6 +4593,9 @@ spec:
                                 time:
                                   description: The time duration a connection needs to be idle before keep-alive probes start being sent.
                                   type: string
+                                  x-kubernetes-validations:
+                                    - message: must be a valid duration greater than 1ms
+                                      rule: duration(self) >= duration('1ms')
                               type: object
                           type: object
                       type: object
@@ -3912,7 +4710,7 @@ spec:
                                 type: object
                               type: array
                             enabled:
-                              description: enable locality load balancing, this is DestinationRule-level and will override mesh wide settings in entirety.
+                              description: Enable locality load balancing.
                               nullable: true
                               type: boolean
                             failover:
@@ -3945,15 +4743,44 @@ spec:
                             - ROUND_ROBIN
                             - LEAST_REQUEST
                           type: string
+                        warmup:
+                          description: Represents the warmup configuration of Service.
+                          properties:
+                            aggression:
+                              description: This parameter controls the speed of traffic increase over the warmup duration.
+                              format: double
+                              minimum: 1
+                              nullable: true
+                              type: number
+                            duration:
+                              type: string
+                              x-kubernetes-validations:
+                                - message: must be a valid duration greater than 1ms
+                                  rule: duration(self) >= duration('1ms')
+                            minimumPercent:
+                              format: double
+                              maximum: 100
+                              minimum: 0
+                              nullable: true
+                              type: number
+                          required:
+                            - duration
+                          type: object
                         warmupDurationSecs:
-                          description: Represents the warmup duration of Service.
+                          description: 'Deprecated: use `warmup` instead.'
                           type: string
+                          x-kubernetes-validations:
+                            - message: must be a valid duration greater than 1ms
+                              rule: duration(self) >= duration('1ms')
                       type: object
                     outlierDetection:
                       properties:
                         baseEjectionTime:
                           description: Minimum ejection duration.
                           type: string
+                          x-kubernetes-validations:
+                            - message: must be a valid duration greater than 1ms
+                              rule: duration(self) >= duration('1ms')
                         consecutive5xxErrors:
                           description: Number of 5xx errors before a host is ejected from the connection pool.
                           maximum: 4294967295
@@ -3978,12 +4805,15 @@ spec:
                         interval:
                           description: Time interval between ejection sweep analysis.
                           type: string
+                          x-kubernetes-validations:
+                            - message: must be a valid duration greater than 1ms
+                              rule: duration(self) >= duration('1ms')
                         maxEjectionPercent:
                           description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
                           format: int32
                           type: integer
                         minHealthPercent:
-                          description: Outlier detection will be enabled as long as the associated load balancing pool has at least min_health_percent hosts in healthy mode.
+                          description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
                           format: int32
                           type: integer
                         splitExternalLocalOriginErrors:
@@ -4020,6 +4850,9 @@ spec:
                                   idleTimeout:
                                     description: The idle timeout for upstream connection pool connections.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   maxConcurrentStreams:
                                     description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
                                     format: int32
@@ -4042,12 +4875,21 @@ spec:
                                   connectTimeout:
                                     description: TCP connection timeout.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   idleTimeout:
                                     description: The idle timeout for TCP connections.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   maxConnectionDuration:
                                     description: The maximum duration of a connection.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   maxConnections:
                                     description: Maximum number of HTTP1 /TCP connections to a destination host.
                                     format: int32
@@ -4058,6 +4900,9 @@ spec:
                                       interval:
                                         description: The time duration between keep-alive probes.
                                         type: string
+                                        x-kubernetes-validations:
+                                          - message: must be a valid duration greater than 1ms
+                                            rule: duration(self) >= duration('1ms')
                                       probes:
                                         description: Maximum number of keepalive probes to send without response before deciding the connection is dead.
                                         maximum: 4294967295
@@ -4066,6 +4911,9 @@ spec:
                                       time:
                                         description: The time duration a connection needs to be idle before keep-alive probes start being sent.
                                         type: string
+                                        x-kubernetes-validations:
+                                          - message: must be a valid duration greater than 1ms
+                                            rule: duration(self) >= duration('1ms')
                                     type: object
                                 type: object
                             type: object
@@ -4180,7 +5028,7 @@ spec:
                                       type: object
                                     type: array
                                   enabled:
-                                    description: enable locality load balancing, this is DestinationRule-level and will override mesh wide settings in entirety.
+                                    description: Enable locality load balancing.
                                     nullable: true
                                     type: boolean
                                   failover:
@@ -4213,15 +5061,44 @@ spec:
                                   - ROUND_ROBIN
                                   - LEAST_REQUEST
                                 type: string
+                              warmup:
+                                description: Represents the warmup configuration of Service.
+                                properties:
+                                  aggression:
+                                    description: This parameter controls the speed of traffic increase over the warmup duration.
+                                    format: double
+                                    minimum: 1
+                                    nullable: true
+                                    type: number
+                                  duration:
+                                    type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
+                                  minimumPercent:
+                                    format: double
+                                    maximum: 100
+                                    minimum: 0
+                                    nullable: true
+                                    type: number
+                                required:
+                                  - duration
+                                type: object
                               warmupDurationSecs:
-                                description: Represents the warmup duration of Service.
+                                description: 'Deprecated: use `warmup` instead.'
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                             type: object
                           outlierDetection:
                             properties:
                               baseEjectionTime:
                                 description: Minimum ejection duration.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               consecutive5xxErrors:
                                 description: Number of 5xx errors before a host is ejected from the connection pool.
                                 maximum: 4294967295
@@ -4246,12 +5123,15 @@ spec:
                               interval:
                                 description: Time interval between ejection sweep analysis.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               maxEjectionPercent:
                                 description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected.
                                 format: int32
                                 type: integer
                               minHealthPercent:
-                                description: Outlier detection will be enabled as long as the associated load balancing pool has at least min_health_percent hosts in healthy mode.
+                                description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode.
                                 format: int32
                                 type: integer
                               splitExternalLocalOriginErrors:
@@ -4309,6 +5189,7 @@ spec:
                                 type: array
                             type: object
                         type: object
+                      maxItems: 4096
                       type: array
                     proxyProtocol:
                       description: The upstream PROXY protocol settings.
@@ -4389,14 +5270,91 @@ spec:
                   properties:
                     matchLabels:
                       additionalProperties:
+                        maxLength: 63
                         type: string
+                        x-kubernetes-validations:
+                          - message: wildcard not allowed in label value match
+                            rule: '!self.contains("*")'
                       description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.
+                      maxProperties: 4096
                       type: object
+                      x-kubernetes-validations:
+                        - message: wildcard not allowed in label key match
+                          rule: self.all(key, !key.contains("*"))
+                        - message: key must not be empty
+                          rule: self.all(key, key.size() != 0)
                   type: object
               required:
                 - host
               type: object
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
           type: object
@@ -4405,16 +5363,22 @@ spec:
       subresources:
         status: {}
 ---
+# Source: base/templates/crds.yaml
+# If we are templating these CRDs, we want to wipe out the "static"/legacy
+# labels and replace them with the standard templated istio ones.
+# This allows the continued use of `kubectl apply -f crd-all.gen.yaml`
+# without any templating+the old labels, if desired.
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    "helm.sh/resource-policy": keep
+    helm.sh/resource-policy: keep
   labels:
-    app: istio-pilot
-    chart: istio
-    heritage: Tiller
-    release: istio
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: istio
+    app.kubernetes.io/version: 1.25.0
+    helm.sh/chart: base-1.25.0
   name: envoyfilters.networking.istio.io
 spec:
   group: networking.istio.io
@@ -4563,7 +5527,7 @@ spec:
                               metadata:
                                 additionalProperties:
                                   type: string
-                                description: Match on the node metadata supplied by a proxy when connecting to Istio Pilot.
+                                description: Match on the node metadata supplied by a proxy when connecting to istiod.
                                 type: object
                               proxyVersion:
                                 description: A regular expression in golang regex format (RE2) that can be used to select proxies using a specific version of istio proxy.
@@ -4589,6 +5553,9 @@ spec:
                               vhost:
                                 description: Match a specific virtual host in a route configuration and apply the patch to the virtual host.
                                 properties:
+                                  domainName:
+                                    description: Match a domain name in a virtual host.
+                                    type: string
                                   name:
                                     description: The VirtualHosts objects generated by Istio are named as host:port, where the host typically corresponds to the VirtualService's host field or the hostname of a service in the registry.
                                     type: string
@@ -4659,53 +5626,148 @@ spec:
                     properties:
                       group:
                         description: group is the group of the target resource.
+                        maxLength: 253
+                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
                       kind:
                         description: kind is kind of the target resource.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
                         type: string
                       name:
                         description: name is the name of the target resource.
+                        maxLength: 253
+                        minLength: 1
                         type: string
                       namespace:
                         description: namespace is the namespace of the referent.
                         type: string
+                        x-kubernetes-validations:
+                          - message: cross namespace referencing is not currently supported
+                            rule: self.size() == 0
+                    required:
+                      - kind
+                      - name
                     type: object
+                  maxItems: 16
                   type: array
                 workloadSelector:
                   description: Criteria used to select the specific set of pods/VMs on which this patch configuration should be applied.
                   properties:
                     labels:
                       additionalProperties:
+                        maxLength: 63
                         type: string
+                        x-kubernetes-validations:
+                          - message: wildcard is not supported in selector
+                            rule: '!self.contains("*")'
                       description: One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied.
+                      maxProperties: 256
                       type: object
                   type: object
               type: object
+              x-kubernetes-validations:
+                - message: only one of targetRefs or workloadSelector can be set
+                  rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1'
             status:
-              type: object
-              x-kubernetes-preserve-unknown-fields: true
-          type: object
-      served: true
-      storage: true
-      subresources:
-        status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  annotations:
-    "helm.sh/resource-policy": keep
-  labels:
-    app: istio-pilot
-    chart: istio
-    heritage: Tiller
-    release: istio
-  name: gateways.networking.istio.io
-spec:
-  group: networking.istio.io
-  names:
-    categories:
-      - istio-io
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
+              type: object
+              x-kubernetes-preserve-unknown-fields: true
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+---
+# Source: base/templates/crds.yaml
+# If we are templating these CRDs, we want to wipe out the "static"/legacy
+# labels and replace them with the standard templated istio ones.
+# This allows the continued use of `kubectl apply -f crd-all.gen.yaml`
+# without any templating+the old labels, if desired.
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    helm.sh/resource-policy: keep
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: istio
+    app.kubernetes.io/version: 1.25.0
+    helm.sh/chart: base-1.25.0
+  name: gateways.networking.istio.io
+spec:
+  group: networking.istio.io
+  names:
+    categories:
+      - istio-io
       - networking-istio-io
     kind: Gateway
     listKind: GatewayList
@@ -4853,6 +5915,73 @@ spec:
                   type: array
               type: object
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
           type: object
@@ -4998,6 +6127,73 @@ spec:
                   type: array
               type: object
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
           type: object
@@ -5143,6 +6339,73 @@ spec:
                   type: array
               type: object
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
           type: object
@@ -5151,16 +6414,22 @@ spec:
       subresources:
         status: {}
 ---
+# Source: base/templates/crds.yaml
+# If we are templating these CRDs, we want to wipe out the "static"/legacy
+# labels and replace them with the standard templated istio ones.
+# This allows the continued use of `kubectl apply -f crd-all.gen.yaml`
+# without any templating+the old labels, if desired.
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    "helm.sh/resource-policy": keep
+    helm.sh/resource-policy: keep
   labels:
-    app: istio-pilot
-    chart: istio
-    heritage: Tiller
-    release: istio
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: istio
+    app.kubernetes.io/version: 1.25.0
+    helm.sh/chart: base-1.25.0
   name: proxyconfigs.networking.istio.io
 spec:
   group: networking.istio.io
@@ -5184,10 +6453,12 @@ spec:
                 concurrency:
                   description: The number of worker threads to run.
                   format: int32
+                  minimum: 0
                   nullable: true
                   type: integer
                 environmentVariables:
                   additionalProperties:
+                    maxLength: 2048
                     type: string
                   description: Additional environment variables for the proxy.
                   type: object
@@ -5203,12 +6474,89 @@ spec:
                   properties:
                     matchLabels:
                       additionalProperties:
+                        maxLength: 63
                         type: string
+                        x-kubernetes-validations:
+                          - message: wildcard not allowed in label value match
+                            rule: '!self.contains("*")'
                       description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.
+                      maxProperties: 4096
                       type: object
+                      x-kubernetes-validations:
+                        - message: wildcard not allowed in label key match
+                          rule: self.all(key, !key.contains("*"))
+                        - message: key must not be empty
+                          rule: self.all(key, key.size() != 0)
                   type: object
               type: object
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
           type: object
@@ -5217,16 +6565,22 @@ spec:
       subresources:
         status: {}
 ---
+# Source: base/templates/crds.yaml
+# If we are templating these CRDs, we want to wipe out the "static"/legacy
+# labels and replace them with the standard templated istio ones.
+# This allows the continued use of `kubectl apply -f crd-all.gen.yaml`
+# without any templating+the old labels, if desired.
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    "helm.sh/resource-policy": keep
+    helm.sh/resource-policy: keep
   labels:
-    app: istio-pilot
-    chart: istio
-    heritage: Tiller
-    release: istio
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: istio
+    app.kubernetes.io/version: 1.25.0
+    helm.sh/chart: base-1.25.0
   name: serviceentries.networking.istio.io
 spec:
   group: networking.istio.io
@@ -5269,7 +6623,9 @@ spec:
                 addresses:
                   description: The virtual IP addresses associated with the service.
                   items:
+                    maxLength: 64
                     type: string
+                  maxItems: 256
                   type: array
                 endpoints:
                   description: One or more endpoints associated with the service.
@@ -5277,27 +6633,44 @@ spec:
                     properties:
                       address:
                         description: Address associated with the network endpoint without the port.
+                        maxLength: 256
                         type: string
+                        x-kubernetes-validations:
+                          - message: UDS must be an absolute path or abstract socket
+                            rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true'
+                          - message: UDS may not be a dir
+                            rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true'
                       labels:
                         additionalProperties:
                           type: string
                         description: One or more labels associated with the endpoint.
+                        maxProperties: 256
                         type: object
                       locality:
                         description: The locality associated with the endpoint.
+                        maxLength: 2048
                         type: string
                       network:
                         description: Network enables Istio to group endpoints resident in the same L3 domain/network.
+                        maxLength: 2048
                         type: string
                       ports:
                         additionalProperties:
                           maximum: 4294967295
                           minimum: 0
                           type: integer
+                          x-kubernetes-validations:
+                            - message: port must be between 1-65535
+                              rule: 0 < self && self <= 65535
                         description: Set of ports associated with the endpoint.
+                        maxProperties: 128
                         type: object
+                        x-kubernetes-validations:
+                          - message: port name must be valid
+                            rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$"))
                       serviceAccount:
                         description: The service account associated with the workload if a sidecar is present in the workload.
+                        maxLength: 253
                         type: string
                       weight:
                         description: The load balancing weight associated with the endpoint.
@@ -5305,6 +6678,12 @@ spec:
                         minimum: 0
                         type: integer
                     type: object
+                    x-kubernetes-validations:
+                      - message: Address is required
+                        rule: has(self.address) || has(self.network)
+                      - message: UDS may not include ports
+                        rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true'
+                  maxItems: 4096
                   type: array
                 exportTo:
                   description: A list of namespaces to which this service is exported.
@@ -5315,6 +6694,11 @@ spec:
                   description: The hosts associated with the ServiceEntry.
                   items:
                     type: string
+                    x-kubernetes-validations:
+                      - message: hostname cannot be wildcard
+                        rule: self != "*"
+                  maxItems: 256
+                  minItems: 1
                   type: array
                 location:
                   description: |-
@@ -5331,25 +6715,40 @@ spec:
                     properties:
                       name:
                         description: Label assigned to the port.
+                        maxLength: 256
                         type: string
                       number:
                         description: A valid non-negative integer port number.
                         maximum: 4294967295
                         minimum: 0
                         type: integer
+                        x-kubernetes-validations:
+                          - message: port must be between 1-65535
+                            rule: 0 < self && self <= 65535
                       protocol:
                         description: The protocol exposed on the port.
+                        maxLength: 256
                         type: string
                       targetPort:
                         description: The port number on the endpoint where the traffic will be received.
                         maximum: 4294967295
                         minimum: 0
                         type: integer
+                        x-kubernetes-validations:
+                          - message: port must be between 1-65535
+                            rule: 0 < self && self <= 65535
                     required:
                       - number
                       - name
                     type: object
+                  maxItems: 256
                   type: array
+                  x-kubernetes-list-map-keys:
+                    - name
+                  x-kubernetes-list-type: map
+                  x-kubernetes-validations:
+                    - message: port number cannot be duplicated
+                      rule: self.all(l1, self.exists_one(l2, l1.number == l2.number))
                 resolution:
                   description: |-
                     Service resolution mode for the hosts.
@@ -5371,16 +6770,99 @@ spec:
                   properties:
                     labels:
                       additionalProperties:
+                        maxLength: 63
                         type: string
+                        x-kubernetes-validations:
+                          - message: wildcard is not supported in selector
+                            rule: '!self.contains("*")'
                       description: One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied.
+                      maxProperties: 256
                       type: object
                   type: object
               required:
                 - hosts
               type: object
+              x-kubernetes-validations:
+                - message: only one of WorkloadSelector or Endpoints can be set
+                  rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.endpoints) ? 1 : 0) <= 1'
+                - message: CIDR addresses are allowed only for NONE/STATIC resolution types
+                  rule: '!((has(self.addresses) ? self.addresses : []).exists(k, k.contains("/")) && !((has(self.resolution) ? self.resolution : "NONE") in ["STATIC", "NONE"]))'
+                - message: NONE mode cannot set endpoints
+                  rule: '((has(self.resolution) ? self.resolution : "NONE") == "NONE") ? !has(self.endpoints) : true'
+                - message: DNS_ROUND_ROBIN mode cannot have multiple endpoints
+                  rule: '((has(self.resolution) ? self.resolution : "") == "DNS_ROUND_ROBIN") ? ((has(self.endpoints) ? self.endpoints : []).size() <= 1) : true'
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
+          required:
+            - spec
           type: object
       served: true
       storage: false
@@ -5413,7 +6895,9 @@ spec:
                 addresses:
                   description: The virtual IP addresses associated with the service.
                   items:
+                    maxLength: 64
                     type: string
+                  maxItems: 256
                   type: array
                 endpoints:
                   description: One or more endpoints associated with the service.
@@ -5421,27 +6905,44 @@ spec:
                     properties:
                       address:
                         description: Address associated with the network endpoint without the port.
+                        maxLength: 256
                         type: string
+                        x-kubernetes-validations:
+                          - message: UDS must be an absolute path or abstract socket
+                            rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true'
+                          - message: UDS may not be a dir
+                            rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true'
                       labels:
                         additionalProperties:
                           type: string
                         description: One or more labels associated with the endpoint.
+                        maxProperties: 256
                         type: object
                       locality:
                         description: The locality associated with the endpoint.
+                        maxLength: 2048
                         type: string
                       network:
                         description: Network enables Istio to group endpoints resident in the same L3 domain/network.
+                        maxLength: 2048
                         type: string
                       ports:
                         additionalProperties:
                           maximum: 4294967295
                           minimum: 0
                           type: integer
+                          x-kubernetes-validations:
+                            - message: port must be between 1-65535
+                              rule: 0 < self && self <= 65535
                         description: Set of ports associated with the endpoint.
+                        maxProperties: 128
                         type: object
+                        x-kubernetes-validations:
+                          - message: port name must be valid
+                            rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$"))
                       serviceAccount:
                         description: The service account associated with the workload if a sidecar is present in the workload.
+                        maxLength: 253
                         type: string
                       weight:
                         description: The load balancing weight associated with the endpoint.
@@ -5449,6 +6950,12 @@ spec:
                         minimum: 0
                         type: integer
                     type: object
+                    x-kubernetes-validations:
+                      - message: Address is required
+                        rule: has(self.address) || has(self.network)
+                      - message: UDS may not include ports
+                        rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true'
+                  maxItems: 4096
                   type: array
                 exportTo:
                   description: A list of namespaces to which this service is exported.
@@ -5459,6 +6966,11 @@ spec:
                   description: The hosts associated with the ServiceEntry.
                   items:
                     type: string
+                    x-kubernetes-validations:
+                      - message: hostname cannot be wildcard
+                        rule: self != "*"
+                  maxItems: 256
+                  minItems: 1
                   type: array
                 location:
                   description: |-
@@ -5475,25 +6987,40 @@ spec:
                     properties:
                       name:
                         description: Label assigned to the port.
+                        maxLength: 256
                         type: string
                       number:
                         description: A valid non-negative integer port number.
                         maximum: 4294967295
                         minimum: 0
                         type: integer
+                        x-kubernetes-validations:
+                          - message: port must be between 1-65535
+                            rule: 0 < self && self <= 65535
                       protocol:
                         description: The protocol exposed on the port.
+                        maxLength: 256
                         type: string
                       targetPort:
                         description: The port number on the endpoint where the traffic will be received.
                         maximum: 4294967295
                         minimum: 0
                         type: integer
+                        x-kubernetes-validations:
+                          - message: port must be between 1-65535
+                            rule: 0 < self && self <= 65535
                     required:
                       - number
                       - name
                     type: object
+                  maxItems: 256
                   type: array
+                  x-kubernetes-list-map-keys:
+                    - name
+                  x-kubernetes-list-type: map
+                  x-kubernetes-validations:
+                    - message: port number cannot be duplicated
+                      rule: self.all(l1, self.exists_one(l2, l1.number == l2.number))
                 resolution:
                   description: |-
                     Service resolution mode for the hosts.
@@ -5515,16 +7042,99 @@ spec:
                   properties:
                     labels:
                       additionalProperties:
+                        maxLength: 63
                         type: string
+                        x-kubernetes-validations:
+                          - message: wildcard is not supported in selector
+                            rule: '!self.contains("*")'
                       description: One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied.
+                      maxProperties: 256
                       type: object
                   type: object
               required:
                 - hosts
               type: object
+              x-kubernetes-validations:
+                - message: only one of WorkloadSelector or Endpoints can be set
+                  rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.endpoints) ? 1 : 0) <= 1'
+                - message: CIDR addresses are allowed only for NONE/STATIC resolution types
+                  rule: '!((has(self.addresses) ? self.addresses : []).exists(k, k.contains("/")) && !((has(self.resolution) ? self.resolution : "NONE") in ["STATIC", "NONE"]))'
+                - message: NONE mode cannot set endpoints
+                  rule: '((has(self.resolution) ? self.resolution : "NONE") == "NONE") ? !has(self.endpoints) : true'
+                - message: DNS_ROUND_ROBIN mode cannot have multiple endpoints
+                  rule: '((has(self.resolution) ? self.resolution : "") == "DNS_ROUND_ROBIN") ? ((has(self.endpoints) ? self.endpoints : []).size() <= 1) : true'
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
+          required:
+            - spec
           type: object
       served: true
       storage: false
@@ -5557,7 +7167,9 @@ spec:
                 addresses:
                   description: The virtual IP addresses associated with the service.
                   items:
+                    maxLength: 64
                     type: string
+                  maxItems: 256
                   type: array
                 endpoints:
                   description: One or more endpoints associated with the service.
@@ -5565,27 +7177,44 @@ spec:
                     properties:
                       address:
                         description: Address associated with the network endpoint without the port.
+                        maxLength: 256
                         type: string
+                        x-kubernetes-validations:
+                          - message: UDS must be an absolute path or abstract socket
+                            rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true'
+                          - message: UDS may not be a dir
+                            rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true'
                       labels:
                         additionalProperties:
                           type: string
                         description: One or more labels associated with the endpoint.
+                        maxProperties: 256
                         type: object
                       locality:
                         description: The locality associated with the endpoint.
+                        maxLength: 2048
                         type: string
                       network:
                         description: Network enables Istio to group endpoints resident in the same L3 domain/network.
+                        maxLength: 2048
                         type: string
                       ports:
                         additionalProperties:
                           maximum: 4294967295
                           minimum: 0
                           type: integer
+                          x-kubernetes-validations:
+                            - message: port must be between 1-65535
+                              rule: 0 < self && self <= 65535
                         description: Set of ports associated with the endpoint.
+                        maxProperties: 128
                         type: object
+                        x-kubernetes-validations:
+                          - message: port name must be valid
+                            rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$"))
                       serviceAccount:
                         description: The service account associated with the workload if a sidecar is present in the workload.
+                        maxLength: 253
                         type: string
                       weight:
                         description: The load balancing weight associated with the endpoint.
@@ -5593,6 +7222,12 @@ spec:
                         minimum: 0
                         type: integer
                     type: object
+                    x-kubernetes-validations:
+                      - message: Address is required
+                        rule: has(self.address) || has(self.network)
+                      - message: UDS may not include ports
+                        rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true'
+                  maxItems: 4096
                   type: array
                 exportTo:
                   description: A list of namespaces to which this service is exported.
@@ -5603,6 +7238,11 @@ spec:
                   description: The hosts associated with the ServiceEntry.
                   items:
                     type: string
+                    x-kubernetes-validations:
+                      - message: hostname cannot be wildcard
+                        rule: self != "*"
+                  maxItems: 256
+                  minItems: 1
                   type: array
                 location:
                   description: |-
@@ -5619,25 +7259,40 @@ spec:
                     properties:
                       name:
                         description: Label assigned to the port.
+                        maxLength: 256
                         type: string
                       number:
                         description: A valid non-negative integer port number.
                         maximum: 4294967295
                         minimum: 0
                         type: integer
+                        x-kubernetes-validations:
+                          - message: port must be between 1-65535
+                            rule: 0 < self && self <= 65535
                       protocol:
                         description: The protocol exposed on the port.
+                        maxLength: 256
                         type: string
                       targetPort:
                         description: The port number on the endpoint where the traffic will be received.
                         maximum: 4294967295
                         minimum: 0
                         type: integer
+                        x-kubernetes-validations:
+                          - message: port must be between 1-65535
+                            rule: 0 < self && self <= 65535
                     required:
                       - number
                       - name
                     type: object
+                  maxItems: 256
                   type: array
+                  x-kubernetes-list-map-keys:
+                    - name
+                  x-kubernetes-list-type: map
+                  x-kubernetes-validations:
+                    - message: port number cannot be duplicated
+                      rule: self.all(l1, self.exists_one(l2, l1.number == l2.number))
                 resolution:
                   description: |-
                     Service resolution mode for the hosts.
@@ -5659,32 +7314,121 @@ spec:
                   properties:
                     labels:
                       additionalProperties:
+                        maxLength: 63
                         type: string
+                        x-kubernetes-validations:
+                          - message: wildcard is not supported in selector
+                            rule: '!self.contains("*")'
                       description: One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied.
+                      maxProperties: 256
                       type: object
                   type: object
               required:
                 - hosts
               type: object
+              x-kubernetes-validations:
+                - message: only one of WorkloadSelector or Endpoints can be set
+                  rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.endpoints) ? 1 : 0) <= 1'
+                - message: CIDR addresses are allowed only for NONE/STATIC resolution types
+                  rule: '!((has(self.addresses) ? self.addresses : []).exists(k, k.contains("/")) && !((has(self.resolution) ? self.resolution : "NONE") in ["STATIC", "NONE"]))'
+                - message: NONE mode cannot set endpoints
+                  rule: '((has(self.resolution) ? self.resolution : "NONE") == "NONE") ? !has(self.endpoints) : true'
+                - message: DNS_ROUND_ROBIN mode cannot have multiple endpoints
+                  rule: '((has(self.resolution) ? self.resolution : "") == "DNS_ROUND_ROBIN") ? ((has(self.endpoints) ? self.endpoints : []).size() <= 1) : true'
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
+          required:
+            - spec
           type: object
       served: true
       storage: true
       subresources:
         status: {}
 ---
+# Source: base/templates/crds.yaml
+# If we are templating these CRDs, we want to wipe out the "static"/legacy
+# labels and replace them with the standard templated istio ones.
+# This allows the continued use of `kubectl apply -f crd-all.gen.yaml`
+# without any templating+the old labels, if desired.
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    "helm.sh/resource-policy": keep
+    helm.sh/resource-policy: keep
   labels:
-    app: istio-pilot
-    chart: istio
-    heritage: Tiller
-    release: istio
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: istio
+    app.kubernetes.io/version: 1.25.0
+    helm.sh/chart: base-1.25.0
   name: sidecars.networking.istio.io
 spec:
   group: networking.istio.io
@@ -5777,6 +7521,9 @@ spec:
                         idleTimeout:
                           description: The idle timeout for upstream connection pool connections.
                           type: string
+                          x-kubernetes-validations:
+                            - message: must be a valid duration greater than 1ms
+                              rule: duration(self) >= duration('1ms')
                         maxConcurrentStreams:
                           description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
                           format: int32
@@ -5799,12 +7546,21 @@ spec:
                         connectTimeout:
                           description: TCP connection timeout.
                           type: string
+                          x-kubernetes-validations:
+                            - message: must be a valid duration greater than 1ms
+                              rule: duration(self) >= duration('1ms')
                         idleTimeout:
                           description: The idle timeout for TCP connections.
                           type: string
+                          x-kubernetes-validations:
+                            - message: must be a valid duration greater than 1ms
+                              rule: duration(self) >= duration('1ms')
                         maxConnectionDuration:
                           description: The maximum duration of a connection.
                           type: string
+                          x-kubernetes-validations:
+                            - message: must be a valid duration greater than 1ms
+                              rule: duration(self) >= duration('1ms')
                         maxConnections:
                           description: Maximum number of HTTP1 /TCP connections to a destination host.
                           format: int32
@@ -5815,6 +7571,9 @@ spec:
                             interval:
                               description: The time duration between keep-alive probes.
                               type: string
+                              x-kubernetes-validations:
+                                - message: must be a valid duration greater than 1ms
+                                  rule: duration(self) >= duration('1ms')
                             probes:
                               description: Maximum number of keepalive probes to send without response before deciding the connection is dead.
                               maximum: 4294967295
@@ -5823,6 +7582,9 @@ spec:
                             time:
                               description: The time duration a connection needs to be idle before keep-alive probes start being sent.
                               type: string
+                              x-kubernetes-validations:
+                                - message: must be a valid duration greater than 1ms
+                                  rule: duration(self) >= duration('1ms')
                           type: object
                       type: object
                   type: object
@@ -5870,6 +7632,9 @@ spec:
                               idleTimeout:
                                 description: The idle timeout for upstream connection pool connections.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               maxConcurrentStreams:
                                 description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
                                 format: int32
@@ -5892,12 +7657,21 @@ spec:
                               connectTimeout:
                                 description: TCP connection timeout.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               idleTimeout:
                                 description: The idle timeout for TCP connections.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               maxConnectionDuration:
                                 description: The maximum duration of a connection.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               maxConnections:
                                 description: Maximum number of HTTP1 /TCP connections to a destination host.
                                 format: int32
@@ -5908,6 +7682,9 @@ spec:
                                   interval:
                                     description: The time duration between keep-alive probes.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   probes:
                                     description: Maximum number of keepalive probes to send without response before deciding the connection is dead.
                                     maximum: 4294967295
@@ -5916,6 +7693,9 @@ spec:
                                   time:
                                     description: The time duration a connection needs to be idle before keep-alive probes start being sent.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                 type: object
                             type: object
                         type: object
@@ -6025,7 +7805,7 @@ spec:
                     type: object
                   type: array
                 outboundTrafficPolicy:
-                  description: Configuration for the outbound traffic policy.
+                  description: Set the default behavior of the sidecar for handling outbound traffic from the application.
                   properties:
                     egressProxy:
                       properties:
@@ -6060,12 +7840,84 @@ spec:
                   properties:
                     labels:
                       additionalProperties:
+                        maxLength: 63
                         type: string
+                        x-kubernetes-validations:
+                          - message: wildcard is not supported in selector
+                            rule: '!self.contains("*")'
                       description: One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied.
+                      maxProperties: 256
                       type: object
                   type: object
               type: object
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
           type: object
@@ -6152,6 +8004,9 @@ spec:
                         idleTimeout:
                           description: The idle timeout for upstream connection pool connections.
                           type: string
+                          x-kubernetes-validations:
+                            - message: must be a valid duration greater than 1ms
+                              rule: duration(self) >= duration('1ms')
                         maxConcurrentStreams:
                           description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
                           format: int32
@@ -6174,12 +8029,21 @@ spec:
                         connectTimeout:
                           description: TCP connection timeout.
                           type: string
+                          x-kubernetes-validations:
+                            - message: must be a valid duration greater than 1ms
+                              rule: duration(self) >= duration('1ms')
                         idleTimeout:
                           description: The idle timeout for TCP connections.
                           type: string
+                          x-kubernetes-validations:
+                            - message: must be a valid duration greater than 1ms
+                              rule: duration(self) >= duration('1ms')
                         maxConnectionDuration:
                           description: The maximum duration of a connection.
                           type: string
+                          x-kubernetes-validations:
+                            - message: must be a valid duration greater than 1ms
+                              rule: duration(self) >= duration('1ms')
                         maxConnections:
                           description: Maximum number of HTTP1 /TCP connections to a destination host.
                           format: int32
@@ -6190,6 +8054,9 @@ spec:
                             interval:
                               description: The time duration between keep-alive probes.
                               type: string
+                              x-kubernetes-validations:
+                                - message: must be a valid duration greater than 1ms
+                                  rule: duration(self) >= duration('1ms')
                             probes:
                               description: Maximum number of keepalive probes to send without response before deciding the connection is dead.
                               maximum: 4294967295
@@ -6198,6 +8065,9 @@ spec:
                             time:
                               description: The time duration a connection needs to be idle before keep-alive probes start being sent.
                               type: string
+                              x-kubernetes-validations:
+                                - message: must be a valid duration greater than 1ms
+                                  rule: duration(self) >= duration('1ms')
                           type: object
                       type: object
                   type: object
@@ -6245,6 +8115,9 @@ spec:
                               idleTimeout:
                                 description: The idle timeout for upstream connection pool connections.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               maxConcurrentStreams:
                                 description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
                                 format: int32
@@ -6267,12 +8140,21 @@ spec:
                               connectTimeout:
                                 description: TCP connection timeout.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               idleTimeout:
                                 description: The idle timeout for TCP connections.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               maxConnectionDuration:
                                 description: The maximum duration of a connection.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               maxConnections:
                                 description: Maximum number of HTTP1 /TCP connections to a destination host.
                                 format: int32
@@ -6283,6 +8165,9 @@ spec:
                                   interval:
                                     description: The time duration between keep-alive probes.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   probes:
                                     description: Maximum number of keepalive probes to send without response before deciding the connection is dead.
                                     maximum: 4294967295
@@ -6291,6 +8176,9 @@ spec:
                                   time:
                                     description: The time duration a connection needs to be idle before keep-alive probes start being sent.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                 type: object
                             type: object
                         type: object
@@ -6400,7 +8288,7 @@ spec:
                     type: object
                   type: array
                 outboundTrafficPolicy:
-                  description: Configuration for the outbound traffic policy.
+                  description: Set the default behavior of the sidecar for handling outbound traffic from the application.
                   properties:
                     egressProxy:
                       properties:
@@ -6435,12 +8323,84 @@ spec:
                   properties:
                     labels:
                       additionalProperties:
+                        maxLength: 63
                         type: string
+                        x-kubernetes-validations:
+                          - message: wildcard is not supported in selector
+                            rule: '!self.contains("*")'
                       description: One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied.
+                      maxProperties: 256
                       type: object
                   type: object
               type: object
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
           type: object
@@ -6527,6 +8487,9 @@ spec:
                         idleTimeout:
                           description: The idle timeout for upstream connection pool connections.
                           type: string
+                          x-kubernetes-validations:
+                            - message: must be a valid duration greater than 1ms
+                              rule: duration(self) >= duration('1ms')
                         maxConcurrentStreams:
                           description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
                           format: int32
@@ -6549,12 +8512,21 @@ spec:
                         connectTimeout:
                           description: TCP connection timeout.
                           type: string
+                          x-kubernetes-validations:
+                            - message: must be a valid duration greater than 1ms
+                              rule: duration(self) >= duration('1ms')
                         idleTimeout:
                           description: The idle timeout for TCP connections.
                           type: string
+                          x-kubernetes-validations:
+                            - message: must be a valid duration greater than 1ms
+                              rule: duration(self) >= duration('1ms')
                         maxConnectionDuration:
                           description: The maximum duration of a connection.
                           type: string
+                          x-kubernetes-validations:
+                            - message: must be a valid duration greater than 1ms
+                              rule: duration(self) >= duration('1ms')
                         maxConnections:
                           description: Maximum number of HTTP1 /TCP connections to a destination host.
                           format: int32
@@ -6565,6 +8537,9 @@ spec:
                             interval:
                               description: The time duration between keep-alive probes.
                               type: string
+                              x-kubernetes-validations:
+                                - message: must be a valid duration greater than 1ms
+                                  rule: duration(self) >= duration('1ms')
                             probes:
                               description: Maximum number of keepalive probes to send without response before deciding the connection is dead.
                               maximum: 4294967295
@@ -6573,6 +8548,9 @@ spec:
                             time:
                               description: The time duration a connection needs to be idle before keep-alive probes start being sent.
                               type: string
+                              x-kubernetes-validations:
+                                - message: must be a valid duration greater than 1ms
+                                  rule: duration(self) >= duration('1ms')
                           type: object
                       type: object
                   type: object
@@ -6620,6 +8598,9 @@ spec:
                               idleTimeout:
                                 description: The idle timeout for upstream connection pool connections.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               maxConcurrentStreams:
                                 description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.
                                 format: int32
@@ -6642,12 +8623,21 @@ spec:
                               connectTimeout:
                                 description: TCP connection timeout.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               idleTimeout:
                                 description: The idle timeout for TCP connections.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               maxConnectionDuration:
                                 description: The maximum duration of a connection.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               maxConnections:
                                 description: Maximum number of HTTP1 /TCP connections to a destination host.
                                 format: int32
@@ -6658,6 +8648,9 @@ spec:
                                   interval:
                                     description: The time duration between keep-alive probes.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                   probes:
                                     description: Maximum number of keepalive probes to send without response before deciding the connection is dead.
                                     maximum: 4294967295
@@ -6666,6 +8659,9 @@ spec:
                                   time:
                                     description: The time duration a connection needs to be idle before keep-alive probes start being sent.
                                     type: string
+                                    x-kubernetes-validations:
+                                      - message: must be a valid duration greater than 1ms
+                                        rule: duration(self) >= duration('1ms')
                                 type: object
                             type: object
                         type: object
@@ -6775,7 +8771,7 @@ spec:
                     type: object
                   type: array
                 outboundTrafficPolicy:
-                  description: Configuration for the outbound traffic policy.
+                  description: Set the default behavior of the sidecar for handling outbound traffic from the application.
                   properties:
                     egressProxy:
                       properties:
@@ -6810,12 +8806,84 @@ spec:
                   properties:
                     labels:
                       additionalProperties:
+                        maxLength: 63
                         type: string
+                        x-kubernetes-validations:
+                          - message: wildcard is not supported in selector
+                            rule: '!self.contains("*")'
                       description: One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied.
+                      maxProperties: 256
                       type: object
                   type: object
               type: object
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
           type: object
@@ -6824,16 +8892,22 @@ spec:
       subresources:
         status: {}
 ---
+# Source: base/templates/crds.yaml
+# If we are templating these CRDs, we want to wipe out the "static"/legacy
+# labels and replace them with the standard templated istio ones.
+# This allows the continued use of `kubectl apply -f crd-all.gen.yaml`
+# without any templating+the old labels, if desired.
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    "helm.sh/resource-policy": keep
+    helm.sh/resource-policy: keep
   labels:
-    app: istio-pilot
-    chart: istio
-    heritage: Tiller
-    release: istio
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: istio
+    app.kubernetes.io/version: 1.25.0
+    helm.sh/chart: base-1.25.0
   name: virtualservices.networking.istio.io
 spec:
   group: networking.istio.io
@@ -6933,7 +9007,7 @@ spec:
                                 prefix:
                                   type: string
                                 regex:
-                                  description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                  description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                   type: string
                               type: object
                             type: array
@@ -6945,6 +9019,19 @@ spec:
                           maxAge:
                             description: Specifies how long the results of a preflight request can be cached.
                             type: string
+                            x-kubernetes-validations:
+                              - message: must be a valid duration greater than 1ms
+                                rule: duration(self) >= duration('1ms')
+                          unmatchedPreflights:
+                            description: |-
+                              Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream.
+
+                              Valid Options: FORWARD, IGNORE
+                            enum:
+                              - UNSPECIFIED
+                              - FORWARD
+                              - IGNORE
+                            type: string
                         type: object
                       delegate:
                         description: Delegate is used to specify the particular VirtualService which can be used to define delegate HTTPRoute.
@@ -7042,9 +9129,15 @@ spec:
                             properties:
                               exponentialDelay:
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               fixedDelay:
                                 description: Add a fixed delay before forwarding the request.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               percent:
                                 description: Percentage of requests on which the delay will be injected (0-100).
                                 format: int32
@@ -7096,7 +9189,7 @@ spec:
                         items:
                           properties:
                             authority:
-                              description: 'HTTP Authority values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+                              description: 'HTTP Authority values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                               oneOf:
                                 - not:
                                     anyOf:
@@ -7118,7 +9211,7 @@ spec:
                                 prefix:
                                   type: string
                                 regex:
-                                  description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                  description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                   type: string
                               type: object
                             gateways:
@@ -7149,7 +9242,7 @@ spec:
                                   prefix:
                                     type: string
                                   regex:
-                                    description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                    description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                     type: string
                                 type: object
                               description: The header keys must be lowercase and use hyphen as the separator, e.g.
@@ -7158,7 +9251,7 @@ spec:
                               description: Flag to specify whether the URI matching should be case-insensitive.
                               type: boolean
                             method:
-                              description: 'HTTP Method values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+                              description: 'HTTP Method values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                               oneOf:
                                 - not:
                                     anyOf:
@@ -7180,7 +9273,7 @@ spec:
                                 prefix:
                                   type: string
                                 regex:
-                                  description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                  description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                   type: string
                               type: object
                             name:
@@ -7214,13 +9307,13 @@ spec:
                                   prefix:
                                     type: string
                                   regex:
-                                    description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                    description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                     type: string
                                 type: object
                               description: Query parameters for matching.
                               type: object
                             scheme:
-                              description: 'URI Scheme values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+                              description: 'URI Scheme values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                               oneOf:
                                 - not:
                                     anyOf:
@@ -7242,7 +9335,7 @@ spec:
                                 prefix:
                                   type: string
                                 regex:
-                                  description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                  description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                   type: string
                               type: object
                             sourceLabels:
@@ -7257,7 +9350,7 @@ spec:
                               description: The human readable prefix to use when emitting statistics for this route.
                               type: string
                             uri:
-                              description: 'URI to match values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+                              description: 'URI to match values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                               oneOf:
                                 - not:
                                     anyOf:
@@ -7279,7 +9372,7 @@ spec:
                                 prefix:
                                   type: string
                                 regex:
-                                  description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                  description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                   type: string
                               type: object
                             withoutHeaders:
@@ -7305,7 +9398,7 @@ spec:
                                   prefix:
                                     type: string
                                   regex:
-                                    description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                    description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                     type: string
                                 type: object
                               description: withoutHeader has the same syntax with the header, but has opposite meaning.
@@ -7440,6 +9533,9 @@ spec:
                           perTryTimeout:
                             description: Timeout per attempt for a given request, including the initial call and any retries.
                             type: string
+                            x-kubernetes-validations:
+                              - message: must be a valid duration greater than 1ms
+                                rule: duration(self) >= duration('1ms')
                           retryOn:
                             description: Specifies the conditions under which retry takes place.
                             type: string
@@ -7461,7 +9557,7 @@ spec:
                             description: rewrite the path portion of the URI with the specified regex.
                             properties:
                               match:
-                                description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                 type: string
                               rewrite:
                                 description: The string that should replace into matching portions of original URI.
@@ -7536,6 +9632,9 @@ spec:
                       timeout:
                         description: Timeout for HTTP requests, default is disabled.
                         type: string
+                        x-kubernetes-validations:
+                          - message: must be a valid duration greater than 1ms
+                            rule: duration(self) >= duration('1ms')
                     type: object
                   type: array
                 tcp:
@@ -7685,6 +9784,73 @@ spec:
                   type: array
               type: object
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
           type: object
@@ -7776,7 +9942,7 @@ spec:
                                 prefix:
                                   type: string
                                 regex:
-                                  description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                  description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                   type: string
                               type: object
                             type: array
@@ -7788,6 +9954,19 @@ spec:
                           maxAge:
                             description: Specifies how long the results of a preflight request can be cached.
                             type: string
+                            x-kubernetes-validations:
+                              - message: must be a valid duration greater than 1ms
+                                rule: duration(self) >= duration('1ms')
+                          unmatchedPreflights:
+                            description: |-
+                              Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream.
+
+                              Valid Options: FORWARD, IGNORE
+                            enum:
+                              - UNSPECIFIED
+                              - FORWARD
+                              - IGNORE
+                            type: string
                         type: object
                       delegate:
                         description: Delegate is used to specify the particular VirtualService which can be used to define delegate HTTPRoute.
@@ -7885,9 +10064,15 @@ spec:
                             properties:
                               exponentialDelay:
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               fixedDelay:
                                 description: Add a fixed delay before forwarding the request.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               percent:
                                 description: Percentage of requests on which the delay will be injected (0-100).
                                 format: int32
@@ -7939,7 +10124,7 @@ spec:
                         items:
                           properties:
                             authority:
-                              description: 'HTTP Authority values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+                              description: 'HTTP Authority values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                               oneOf:
                                 - not:
                                     anyOf:
@@ -7961,7 +10146,7 @@ spec:
                                 prefix:
                                   type: string
                                 regex:
-                                  description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                  description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                   type: string
                               type: object
                             gateways:
@@ -7992,7 +10177,7 @@ spec:
                                   prefix:
                                     type: string
                                   regex:
-                                    description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                    description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                     type: string
                                 type: object
                               description: The header keys must be lowercase and use hyphen as the separator, e.g.
@@ -8001,7 +10186,7 @@ spec:
                               description: Flag to specify whether the URI matching should be case-insensitive.
                               type: boolean
                             method:
-                              description: 'HTTP Method values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+                              description: 'HTTP Method values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                               oneOf:
                                 - not:
                                     anyOf:
@@ -8023,7 +10208,7 @@ spec:
                                 prefix:
                                   type: string
                                 regex:
-                                  description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                  description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                   type: string
                               type: object
                             name:
@@ -8057,13 +10242,13 @@ spec:
                                   prefix:
                                     type: string
                                   regex:
-                                    description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                    description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                     type: string
                                 type: object
                               description: Query parameters for matching.
                               type: object
                             scheme:
-                              description: 'URI Scheme values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+                              description: 'URI Scheme values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                               oneOf:
                                 - not:
                                     anyOf:
@@ -8085,7 +10270,7 @@ spec:
                                 prefix:
                                   type: string
                                 regex:
-                                  description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                  description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                   type: string
                               type: object
                             sourceLabels:
@@ -8100,7 +10285,7 @@ spec:
                               description: The human readable prefix to use when emitting statistics for this route.
                               type: string
                             uri:
-                              description: 'URI to match values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+                              description: 'URI to match values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                               oneOf:
                                 - not:
                                     anyOf:
@@ -8122,7 +10307,7 @@ spec:
                                 prefix:
                                   type: string
                                 regex:
-                                  description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                  description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                   type: string
                               type: object
                             withoutHeaders:
@@ -8148,7 +10333,7 @@ spec:
                                   prefix:
                                     type: string
                                   regex:
-                                    description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                    description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                     type: string
                                 type: object
                               description: withoutHeader has the same syntax with the header, but has opposite meaning.
@@ -8283,6 +10468,9 @@ spec:
                           perTryTimeout:
                             description: Timeout per attempt for a given request, including the initial call and any retries.
                             type: string
+                            x-kubernetes-validations:
+                              - message: must be a valid duration greater than 1ms
+                                rule: duration(self) >= duration('1ms')
                           retryOn:
                             description: Specifies the conditions under which retry takes place.
                             type: string
@@ -8304,7 +10492,7 @@ spec:
                             description: rewrite the path portion of the URI with the specified regex.
                             properties:
                               match:
-                                description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                 type: string
                               rewrite:
                                 description: The string that should replace into matching portions of original URI.
@@ -8379,6 +10567,9 @@ spec:
                       timeout:
                         description: Timeout for HTTP requests, default is disabled.
                         type: string
+                        x-kubernetes-validations:
+                          - message: must be a valid duration greater than 1ms
+                            rule: duration(self) >= duration('1ms')
                     type: object
                   type: array
                 tcp:
@@ -8528,6 +10719,73 @@ spec:
                   type: array
               type: object
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
           type: object
@@ -8619,7 +10877,7 @@ spec:
                                 prefix:
                                   type: string
                                 regex:
-                                  description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                  description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                   type: string
                               type: object
                             type: array
@@ -8631,6 +10889,19 @@ spec:
                           maxAge:
                             description: Specifies how long the results of a preflight request can be cached.
                             type: string
+                            x-kubernetes-validations:
+                              - message: must be a valid duration greater than 1ms
+                                rule: duration(self) >= duration('1ms')
+                          unmatchedPreflights:
+                            description: |-
+                              Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream.
+
+                              Valid Options: FORWARD, IGNORE
+                            enum:
+                              - UNSPECIFIED
+                              - FORWARD
+                              - IGNORE
+                            type: string
                         type: object
                       delegate:
                         description: Delegate is used to specify the particular VirtualService which can be used to define delegate HTTPRoute.
@@ -8728,9 +10999,15 @@ spec:
                             properties:
                               exponentialDelay:
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               fixedDelay:
                                 description: Add a fixed delay before forwarding the request.
                                 type: string
+                                x-kubernetes-validations:
+                                  - message: must be a valid duration greater than 1ms
+                                    rule: duration(self) >= duration('1ms')
                               percent:
                                 description: Percentage of requests on which the delay will be injected (0-100).
                                 format: int32
@@ -8782,7 +11059,7 @@ spec:
                         items:
                           properties:
                             authority:
-                              description: 'HTTP Authority values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+                              description: 'HTTP Authority values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                               oneOf:
                                 - not:
                                     anyOf:
@@ -8804,7 +11081,7 @@ spec:
                                 prefix:
                                   type: string
                                 regex:
-                                  description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                  description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                   type: string
                               type: object
                             gateways:
@@ -8835,7 +11112,7 @@ spec:
                                   prefix:
                                     type: string
                                   regex:
-                                    description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                    description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                     type: string
                                 type: object
                               description: The header keys must be lowercase and use hyphen as the separator, e.g.
@@ -8844,7 +11121,7 @@ spec:
                               description: Flag to specify whether the URI matching should be case-insensitive.
                               type: boolean
                             method:
-                              description: 'HTTP Method values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+                              description: 'HTTP Method values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                               oneOf:
                                 - not:
                                     anyOf:
@@ -8866,7 +11143,7 @@ spec:
                                 prefix:
                                   type: string
                                 regex:
-                                  description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                  description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                   type: string
                               type: object
                             name:
@@ -8900,13 +11177,13 @@ spec:
                                   prefix:
                                     type: string
                                   regex:
-                                    description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                    description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                     type: string
                                 type: object
                               description: Query parameters for matching.
                               type: object
                             scheme:
-                              description: 'URI Scheme values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+                              description: 'URI Scheme values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                               oneOf:
                                 - not:
                                     anyOf:
@@ -8928,7 +11205,7 @@ spec:
                                 prefix:
                                   type: string
                                 regex:
-                                  description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                  description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                   type: string
                               type: object
                             sourceLabels:
@@ -8943,7 +11220,7 @@ spec:
                               description: The human readable prefix to use when emitting statistics for this route.
                               type: string
                             uri:
-                              description: 'URI to match values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).'
+                              description: 'URI to match values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                               oneOf:
                                 - not:
                                     anyOf:
@@ -8965,7 +11242,7 @@ spec:
                                 prefix:
                                   type: string
                                 regex:
-                                  description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                  description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                   type: string
                               type: object
                             withoutHeaders:
@@ -8991,7 +11268,7 @@ spec:
                                   prefix:
                                     type: string
                                   regex:
-                                    description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                    description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                     type: string
                                 type: object
                               description: withoutHeader has the same syntax with the header, but has opposite meaning.
@@ -9126,6 +11403,9 @@ spec:
                           perTryTimeout:
                             description: Timeout per attempt for a given request, including the initial call and any retries.
                             type: string
+                            x-kubernetes-validations:
+                              - message: must be a valid duration greater than 1ms
+                                rule: duration(self) >= duration('1ms')
                           retryOn:
                             description: Specifies the conditions under which retry takes place.
                             type: string
@@ -9147,7 +11427,7 @@ spec:
                             description: rewrite the path portion of the URI with the specified regex.
                             properties:
                               match:
-                                description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).
+                                description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
                                 type: string
                               rewrite:
                                 description: The string that should replace into matching portions of original URI.
@@ -9222,6 +11502,9 @@ spec:
                       timeout:
                         description: Timeout for HTTP requests, default is disabled.
                         type: string
+                        x-kubernetes-validations:
+                          - message: must be a valid duration greater than 1ms
+                            rule: duration(self) >= duration('1ms')
                     type: object
                   type: array
                 tcp:
@@ -9371,6 +11654,73 @@ spec:
                   type: array
               type: object
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
           type: object
@@ -9379,16 +11729,22 @@ spec:
       subresources:
         status: {}
 ---
+# Source: base/templates/crds.yaml
+# If we are templating these CRDs, we want to wipe out the "static"/legacy
+# labels and replace them with the standard templated istio ones.
+# This allows the continued use of `kubectl apply -f crd-all.gen.yaml`
+# without any templating+the old labels, if desired.
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    "helm.sh/resource-policy": keep
+    helm.sh/resource-policy: keep
   labels:
-    app: istio-pilot
-    chart: istio
-    heritage: Tiller
-    release: istio
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: istio
+    app.kubernetes.io/version: 1.25.0
+    helm.sh/chart: base-1.25.0
   name: workloadentries.networking.istio.io
 spec:
   group: networking.istio.io
@@ -9422,27 +11778,44 @@ spec:
               properties:
                 address:
                   description: Address associated with the network endpoint without the port.
+                  maxLength: 256
                   type: string
+                  x-kubernetes-validations:
+                    - message: UDS must be an absolute path or abstract socket
+                      rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true'
+                    - message: UDS may not be a dir
+                      rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true'
                 labels:
                   additionalProperties:
                     type: string
                   description: One or more labels associated with the endpoint.
+                  maxProperties: 256
                   type: object
                 locality:
                   description: The locality associated with the endpoint.
+                  maxLength: 2048
                   type: string
                 network:
                   description: Network enables Istio to group endpoints resident in the same L3 domain/network.
+                  maxLength: 2048
                   type: string
                 ports:
                   additionalProperties:
                     maximum: 4294967295
                     minimum: 0
                     type: integer
+                    x-kubernetes-validations:
+                      - message: port must be between 1-65535
+                        rule: 0 < self && self <= 65535
                   description: Set of ports associated with the endpoint.
+                  maxProperties: 128
                   type: object
+                  x-kubernetes-validations:
+                    - message: port name must be valid
+                      rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$"))
                 serviceAccount:
                   description: The service account associated with the workload if a sidecar is present in the workload.
+                  maxLength: 253
                   type: string
                 weight:
                   description: The load balancing weight associated with the endpoint.
@@ -9450,9 +11823,83 @@ spec:
                   minimum: 0
                   type: integer
               type: object
+              x-kubernetes-validations:
+                - message: Address is required
+                  rule: has(self.address) || has(self.network)
+                - message: UDS may not include ports
+                  rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true'
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
+          required:
+            - spec
           type: object
       served: true
       storage: false
@@ -9476,27 +11923,44 @@ spec:
               properties:
                 address:
                   description: Address associated with the network endpoint without the port.
+                  maxLength: 256
                   type: string
+                  x-kubernetes-validations:
+                    - message: UDS must be an absolute path or abstract socket
+                      rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true'
+                    - message: UDS may not be a dir
+                      rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true'
                 labels:
                   additionalProperties:
                     type: string
                   description: One or more labels associated with the endpoint.
+                  maxProperties: 256
                   type: object
                 locality:
                   description: The locality associated with the endpoint.
+                  maxLength: 2048
                   type: string
                 network:
                   description: Network enables Istio to group endpoints resident in the same L3 domain/network.
+                  maxLength: 2048
                   type: string
                 ports:
                   additionalProperties:
                     maximum: 4294967295
                     minimum: 0
                     type: integer
+                    x-kubernetes-validations:
+                      - message: port must be between 1-65535
+                        rule: 0 < self && self <= 65535
                   description: Set of ports associated with the endpoint.
+                  maxProperties: 128
                   type: object
+                  x-kubernetes-validations:
+                    - message: port name must be valid
+                      rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$"))
                 serviceAccount:
                   description: The service account associated with the workload if a sidecar is present in the workload.
+                  maxLength: 253
                   type: string
                 weight:
                   description: The load balancing weight associated with the endpoint.
@@ -9504,9 +11968,83 @@ spec:
                   minimum: 0
                   type: integer
               type: object
+              x-kubernetes-validations:
+                - message: Address is required
+                  rule: has(self.address) || has(self.network)
+                - message: UDS may not include ports
+                  rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true'
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
+          required:
+            - spec
           type: object
       served: true
       storage: false
@@ -9530,27 +12068,44 @@ spec:
               properties:
                 address:
                   description: Address associated with the network endpoint without the port.
+                  maxLength: 256
                   type: string
+                  x-kubernetes-validations:
+                    - message: UDS must be an absolute path or abstract socket
+                      rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true'
+                    - message: UDS may not be a dir
+                      rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true'
                 labels:
                   additionalProperties:
                     type: string
                   description: One or more labels associated with the endpoint.
+                  maxProperties: 256
                   type: object
                 locality:
                   description: The locality associated with the endpoint.
+                  maxLength: 2048
                   type: string
                 network:
                   description: Network enables Istio to group endpoints resident in the same L3 domain/network.
+                  maxLength: 2048
                   type: string
                 ports:
                   additionalProperties:
                     maximum: 4294967295
                     minimum: 0
                     type: integer
+                    x-kubernetes-validations:
+                      - message: port must be between 1-65535
+                        rule: 0 < self && self <= 65535
                   description: Set of ports associated with the endpoint.
+                  maxProperties: 128
                   type: object
+                  x-kubernetes-validations:
+                    - message: port name must be valid
+                      rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$"))
                 serviceAccount:
                   description: The service account associated with the workload if a sidecar is present in the workload.
+                  maxLength: 253
                   type: string
                 weight:
                   description: The load balancing weight associated with the endpoint.
@@ -9558,23 +12113,103 @@ spec:
                   minimum: 0
                   type: integer
               type: object
+              x-kubernetes-validations:
+                - message: Address is required
+                  rule: has(self.address) || has(self.network)
+                - message: UDS may not include ports
+                  rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true'
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
+          required:
+            - spec
           type: object
       served: true
       storage: true
       subresources:
         status: {}
 ---
+# Source: base/templates/crds.yaml
+# If we are templating these CRDs, we want to wipe out the "static"/legacy
+# labels and replace them with the standard templated istio ones.
+# This allows the continued use of `kubectl apply -f crd-all.gen.yaml`
+# without any templating+the old labels, if desired.
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   labels:
-    app: istio-pilot
-    chart: istio
-    heritage: Tiller
-    release: istio
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: istio
+    app.kubernetes.io/version: 1.25.0
+    helm.sh/chart: base-1.25.0
   name: workloadgroups.networking.istio.io
 spec:
   group: networking.istio.io
@@ -9600,7 +12235,7 @@ spec:
         openAPIV3Schema:
           properties:
             spec:
-              description: '`WorkloadGroup` enables specifying the properties of a single workload for bootstrap and provides a template for `WorkloadEntry`, similar to how `Deployment` specifies properties of workloads via `Pod` templates.'
+              description: 'Describes a collection of workload instances. See more details at: https://istio.io/docs/reference/config/networking/workload-group.html'
               properties:
                 metadata:
                   description: Metadata that will be used for all corresponding `WorkloadEntries`.
@@ -9608,10 +12243,12 @@ spec:
                     annotations:
                       additionalProperties:
                         type: string
+                      maxProperties: 256
                       type: object
                     labels:
                       additionalProperties:
                         type: string
+                      maxProperties: 256
                       type: object
                   type: object
                 probe:
@@ -9625,12 +12262,16 @@ spec:
                               - tcpSocket
                           - required:
                               - exec
+                          - required:
+                              - grpc
                     - required:
                         - httpGet
                     - required:
                         - tcpSocket
                     - required:
                         - exec
+                    - required:
+                        - grpc
                   properties:
                     exec:
                       description: Health is determined by how the command that is executed exited.
@@ -9638,13 +12279,31 @@ spec:
                         command:
                           description: Command to run.
                           items:
+                            minLength: 1
                             type: string
                           type: array
+                      required:
+                        - command
                       type: object
                     failureThreshold:
                       description: Minimum consecutive failures for the probe to be considered failed after having succeeded.
                       format: int32
+                      minimum: 0
                       type: integer
+                    grpc:
+                      description: GRPC call is made and response/error is used to determine health.
+                      properties:
+                        port:
+                          description: Port on which the endpoint lives.
+                          maximum: 4294967295
+                          minimum: 0
+                          type: integer
+                          x-kubernetes-validations:
+                            - message: port must be between 1-65535
+                              rule: 0 < self && self <= 65535
+                        service:
+                          type: string
+                      type: object
                     httpGet:
                       description: '`httpGet` is performed to a given endpoint and the status/able to connect determines health.'
                       properties:
@@ -9656,6 +12315,7 @@ spec:
                           items:
                             properties:
                               name:
+                                pattern: ^[-_A-Za-z0-9]+$
                                 type: string
                               value:
                                 type: string
@@ -9669,22 +12329,31 @@ spec:
                           maximum: 4294967295
                           minimum: 0
                           type: integer
+                          x-kubernetes-validations:
+                            - message: port must be between 1-65535
+                              rule: 0 < self && self <= 65535
                         scheme:
                           type: string
+                          x-kubernetes-validations:
+                            - message: scheme must be one of [HTTP, HTTPS]
+                              rule: self in ["", "HTTP", "HTTPS"]
                       required:
                         - port
                       type: object
                     initialDelaySeconds:
                       description: Number of seconds after the container has started before readiness probes are initiated.
                       format: int32
+                      minimum: 0
                       type: integer
                     periodSeconds:
                       description: How often (in seconds) to perform the probe.
                       format: int32
+                      minimum: 0
                       type: integer
                     successThreshold:
                       description: Minimum consecutive successes for the probe to be considered successful after having failed.
                       format: int32
+                      minimum: 0
                       type: integer
                     tcpSocket:
                       description: Health is determined by if the proxy is able to connect.
@@ -9695,12 +12364,16 @@ spec:
                           maximum: 4294967295
                           minimum: 0
                           type: integer
+                          x-kubernetes-validations:
+                            - message: port must be between 1-65535
+                              rule: 0 < self && self <= 65535
                       required:
                         - port
                       type: object
                     timeoutSeconds:
                       description: Number of seconds after which the probe times out.
                       format: int32
+                      minimum: 0
                       type: integer
                   type: object
                 template:
@@ -9708,27 +12381,44 @@ spec:
                   properties:
                     address:
                       description: Address associated with the network endpoint without the port.
+                      maxLength: 256
                       type: string
+                      x-kubernetes-validations:
+                        - message: UDS must be an absolute path or abstract socket
+                          rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true'
+                        - message: UDS may not be a dir
+                          rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true'
                     labels:
                       additionalProperties:
                         type: string
                       description: One or more labels associated with the endpoint.
+                      maxProperties: 256
                       type: object
                     locality:
                       description: The locality associated with the endpoint.
+                      maxLength: 2048
                       type: string
                     network:
                       description: Network enables Istio to group endpoints resident in the same L3 domain/network.
+                      maxLength: 2048
                       type: string
                     ports:
                       additionalProperties:
                         maximum: 4294967295
                         minimum: 0
                         type: integer
+                        x-kubernetes-validations:
+                          - message: port must be between 1-65535
+                            rule: 0 < self && self <= 65535
                       description: Set of ports associated with the endpoint.
+                      maxProperties: 128
                       type: object
+                      x-kubernetes-validations:
+                        - message: port name must be valid
+                          rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$"))
                     serviceAccount:
                       description: The service account associated with the workload if a sidecar is present in the workload.
+                      maxLength: 253
                       type: string
                     weight:
                       description: The load balancing weight associated with the endpoint.
@@ -9736,12 +12426,84 @@ spec:
                       minimum: 0
                       type: integer
                   type: object
+                  x-kubernetes-validations:
+                    - message: UDS may not include ports
+                      rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true'
               required:
                 - template
               type: object
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
+          required:
+            - spec
           type: object
       served: true
       storage: false
@@ -9765,10 +12527,12 @@ spec:
                     annotations:
                       additionalProperties:
                         type: string
+                      maxProperties: 256
                       type: object
                     labels:
                       additionalProperties:
                         type: string
+                      maxProperties: 256
                       type: object
                   type: object
                 probe:
@@ -9782,12 +12546,16 @@ spec:
                               - tcpSocket
                           - required:
                               - exec
+                          - required:
+                              - grpc
                     - required:
                         - httpGet
                     - required:
                         - tcpSocket
                     - required:
                         - exec
+                    - required:
+                        - grpc
                   properties:
                     exec:
                       description: Health is determined by how the command that is executed exited.
@@ -9795,13 +12563,31 @@ spec:
                         command:
                           description: Command to run.
                           items:
+                            minLength: 1
                             type: string
                           type: array
+                      required:
+                        - command
                       type: object
                     failureThreshold:
                       description: Minimum consecutive failures for the probe to be considered failed after having succeeded.
                       format: int32
+                      minimum: 0
                       type: integer
+                    grpc:
+                      description: GRPC call is made and response/error is used to determine health.
+                      properties:
+                        port:
+                          description: Port on which the endpoint lives.
+                          maximum: 4294967295
+                          minimum: 0
+                          type: integer
+                          x-kubernetes-validations:
+                            - message: port must be between 1-65535
+                              rule: 0 < self && self <= 65535
+                        service:
+                          type: string
+                      type: object
                     httpGet:
                       description: '`httpGet` is performed to a given endpoint and the status/able to connect determines health.'
                       properties:
@@ -9813,6 +12599,7 @@ spec:
                           items:
                             properties:
                               name:
+                                pattern: ^[-_A-Za-z0-9]+$
                                 type: string
                               value:
                                 type: string
@@ -9826,22 +12613,31 @@ spec:
                           maximum: 4294967295
                           minimum: 0
                           type: integer
+                          x-kubernetes-validations:
+                            - message: port must be between 1-65535
+                              rule: 0 < self && self <= 65535
                         scheme:
                           type: string
+                          x-kubernetes-validations:
+                            - message: scheme must be one of [HTTP, HTTPS]
+                              rule: self in ["", "HTTP", "HTTPS"]
                       required:
                         - port
                       type: object
                     initialDelaySeconds:
                       description: Number of seconds after the container has started before readiness probes are initiated.
                       format: int32
+                      minimum: 0
                       type: integer
                     periodSeconds:
                       description: How often (in seconds) to perform the probe.
                       format: int32
+                      minimum: 0
                       type: integer
                     successThreshold:
                       description: Minimum consecutive successes for the probe to be considered successful after having failed.
                       format: int32
+                      minimum: 0
                       type: integer
                     tcpSocket:
                       description: Health is determined by if the proxy is able to connect.
@@ -9852,12 +12648,16 @@ spec:
                           maximum: 4294967295
                           minimum: 0
                           type: integer
+                          x-kubernetes-validations:
+                            - message: port must be between 1-65535
+                              rule: 0 < self && self <= 65535
                       required:
                         - port
                       type: object
                     timeoutSeconds:
                       description: Number of seconds after which the probe times out.
                       format: int32
+                      minimum: 0
                       type: integer
                   type: object
                 template:
@@ -9865,27 +12665,44 @@ spec:
                   properties:
                     address:
                       description: Address associated with the network endpoint without the port.
+                      maxLength: 256
                       type: string
+                      x-kubernetes-validations:
+                        - message: UDS must be an absolute path or abstract socket
+                          rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true'
+                        - message: UDS may not be a dir
+                          rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true'
                     labels:
                       additionalProperties:
                         type: string
                       description: One or more labels associated with the endpoint.
+                      maxProperties: 256
                       type: object
                     locality:
                       description: The locality associated with the endpoint.
+                      maxLength: 2048
                       type: string
                     network:
                       description: Network enables Istio to group endpoints resident in the same L3 domain/network.
+                      maxLength: 2048
                       type: string
                     ports:
                       additionalProperties:
                         maximum: 4294967295
                         minimum: 0
                         type: integer
+                        x-kubernetes-validations:
+                          - message: port must be between 1-65535
+                            rule: 0 < self && self <= 65535
                       description: Set of ports associated with the endpoint.
+                      maxProperties: 128
                       type: object
+                      x-kubernetes-validations:
+                        - message: port name must be valid
+                          rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$"))
                     serviceAccount:
                       description: The service account associated with the workload if a sidecar is present in the workload.
+                      maxLength: 253
                       type: string
                     weight:
                       description: The load balancing weight associated with the endpoint.
@@ -9893,12 +12710,84 @@ spec:
                       minimum: 0
                       type: integer
                   type: object
+                  x-kubernetes-validations:
+                    - message: UDS may not include ports
+                      rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true'
               required:
                 - template
               type: object
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
+          required:
+            - spec
           type: object
       served: true
       storage: false
@@ -9914,7 +12803,7 @@ spec:
         openAPIV3Schema:
           properties:
             spec:
-              description: '`WorkloadGroup` enables specifying the properties of a single workload for bootstrap and provides a template for `WorkloadEntry`, similar to how `Deployment` specifies properties of workloads via `Pod` templates.'
+              description: 'Describes a collection of workload instances. See more details at: https://istio.io/docs/reference/config/networking/workload-group.html'
               properties:
                 metadata:
                   description: Metadata that will be used for all corresponding `WorkloadEntries`.
@@ -9922,10 +12811,12 @@ spec:
                     annotations:
                       additionalProperties:
                         type: string
+                      maxProperties: 256
                       type: object
                     labels:
                       additionalProperties:
                         type: string
+                      maxProperties: 256
                       type: object
                   type: object
                 probe:
@@ -9939,12 +12830,16 @@ spec:
                               - tcpSocket
                           - required:
                               - exec
+                          - required:
+                              - grpc
                     - required:
                         - httpGet
                     - required:
                         - tcpSocket
                     - required:
                         - exec
+                    - required:
+                        - grpc
                   properties:
                     exec:
                       description: Health is determined by how the command that is executed exited.
@@ -9952,13 +12847,31 @@ spec:
                         command:
                           description: Command to run.
                           items:
+                            minLength: 1
                             type: string
                           type: array
+                      required:
+                        - command
                       type: object
                     failureThreshold:
                       description: Minimum consecutive failures for the probe to be considered failed after having succeeded.
                       format: int32
+                      minimum: 0
                       type: integer
+                    grpc:
+                      description: GRPC call is made and response/error is used to determine health.
+                      properties:
+                        port:
+                          description: Port on which the endpoint lives.
+                          maximum: 4294967295
+                          minimum: 0
+                          type: integer
+                          x-kubernetes-validations:
+                            - message: port must be between 1-65535
+                              rule: 0 < self && self <= 65535
+                        service:
+                          type: string
+                      type: object
                     httpGet:
                       description: '`httpGet` is performed to a given endpoint and the status/able to connect determines health.'
                       properties:
@@ -9970,6 +12883,7 @@ spec:
                           items:
                             properties:
                               name:
+                                pattern: ^[-_A-Za-z0-9]+$
                                 type: string
                               value:
                                 type: string
@@ -9983,22 +12897,31 @@ spec:
                           maximum: 4294967295
                           minimum: 0
                           type: integer
+                          x-kubernetes-validations:
+                            - message: port must be between 1-65535
+                              rule: 0 < self && self <= 65535
                         scheme:
                           type: string
+                          x-kubernetes-validations:
+                            - message: scheme must be one of [HTTP, HTTPS]
+                              rule: self in ["", "HTTP", "HTTPS"]
                       required:
                         - port
                       type: object
                     initialDelaySeconds:
                       description: Number of seconds after the container has started before readiness probes are initiated.
                       format: int32
+                      minimum: 0
                       type: integer
                     periodSeconds:
                       description: How often (in seconds) to perform the probe.
                       format: int32
+                      minimum: 0
                       type: integer
                     successThreshold:
                       description: Minimum consecutive successes for the probe to be considered successful after having failed.
                       format: int32
+                      minimum: 0
                       type: integer
                     tcpSocket:
                       description: Health is determined by if the proxy is able to connect.
@@ -10009,12 +12932,16 @@ spec:
                           maximum: 4294967295
                           minimum: 0
                           type: integer
+                          x-kubernetes-validations:
+                            - message: port must be between 1-65535
+                              rule: 0 < self && self <= 65535
                       required:
                         - port
                       type: object
                     timeoutSeconds:
                       description: Number of seconds after which the probe times out.
                       format: int32
+                      minimum: 0
                       type: integer
                   type: object
                 template:
@@ -10022,27 +12949,44 @@ spec:
                   properties:
                     address:
                       description: Address associated with the network endpoint without the port.
+                      maxLength: 256
                       type: string
+                      x-kubernetes-validations:
+                        - message: UDS must be an absolute path or abstract socket
+                          rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true'
+                        - message: UDS may not be a dir
+                          rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true'
                     labels:
                       additionalProperties:
                         type: string
                       description: One or more labels associated with the endpoint.
+                      maxProperties: 256
                       type: object
                     locality:
                       description: The locality associated with the endpoint.
+                      maxLength: 2048
                       type: string
                     network:
                       description: Network enables Istio to group endpoints resident in the same L3 domain/network.
+                      maxLength: 2048
                       type: string
                     ports:
                       additionalProperties:
                         maximum: 4294967295
                         minimum: 0
                         type: integer
+                        x-kubernetes-validations:
+                          - message: port must be between 1-65535
+                            rule: 0 < self && self <= 65535
                       description: Set of ports associated with the endpoint.
+                      maxProperties: 128
                       type: object
+                      x-kubernetes-validations:
+                        - message: port name must be valid
+                          rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$"))
                     serviceAccount:
                       description: The service account associated with the workload if a sidecar is present in the workload.
+                      maxLength: 253
                       type: string
                     weight:
                       description: The load balancing weight associated with the endpoint.
@@ -10050,29 +12994,106 @@ spec:
                       minimum: 0
                       type: integer
                   type: object
+                  x-kubernetes-validations:
+                    - message: UDS may not include ports
+                      rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true'
               required:
                 - template
               type: object
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
+          required:
+            - spec
           type: object
       served: true
       storage: true
       subresources:
         status: {}
 ---
+# Source: base/templates/crds.yaml
+# If we are templating these CRDs, we want to wipe out the "static"/legacy
+# labels and replace them with the standard templated istio ones.
+# This allows the continued use of `kubectl apply -f crd-all.gen.yaml`
+# without any templating+the old labels, if desired.
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    "helm.sh/resource-policy": keep
+    helm.sh/resource-policy: keep
   labels:
-    app: istio-pilot
-    chart: istio
-    heritage: Tiller
-    istio: security
-    release: istio
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: istio
+    app.kubernetes.io/version: 1.25.0
+    helm.sh/chart: base-1.25.0
   name: authorizationpolicies.security.istio.io
 spec:
   group: security.istio.io
@@ -10175,6 +13196,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                notServiceAccounts:
+                                  description: Optional.
+                                  items:
+                                    maxLength: 320
+                                    type: string
+                                  maxItems: 16
+                                  type: array
                                 principals:
                                   description: Optional.
                                   items:
@@ -10190,8 +13218,21 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                serviceAccounts:
+                                  description: Optional.
+                                  items:
+                                    maxLength: 320
+                                    type: string
+                                  maxItems: 16
+                                  type: array
                               type: object
+                              x-kubernetes-validations:
+                                - message: Cannot set serviceAccounts with namespaces or principals
+                                  rule: |-
+                                    (has(self.serviceAccounts) || has(self.notServiceAccounts)) ? (!has(self.principals) &&
+                                    !has(self.notPrincipals) && !has(self.namespaces) && !has(self.notNamespaces)) : true
                           type: object
+                        maxItems: 512
                         type: array
                       to:
                         description: Optional.
@@ -10265,30 +13306,54 @@ spec:
                           type: object
                         type: array
                     type: object
+                  maxItems: 512
                   type: array
                 selector:
                   description: Optional.
                   properties:
                     matchLabels:
                       additionalProperties:
+                        maxLength: 63
                         type: string
+                        x-kubernetes-validations:
+                          - message: wildcard not allowed in label value match
+                            rule: '!self.contains("*")'
                       description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.
+                      maxProperties: 4096
                       type: object
+                      x-kubernetes-validations:
+                        - message: wildcard not allowed in label key match
+                          rule: self.all(key, !key.contains("*"))
+                        - message: key must not be empty
+                          rule: self.all(key, key.size() != 0)
                   type: object
                 targetRef:
                   properties:
                     group:
                       description: group is the group of the target resource.
+                      maxLength: 253
+                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                       type: string
                     kind:
                       description: kind is kind of the target resource.
+                      maxLength: 63
+                      minLength: 1
+                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
                       type: string
                     name:
                       description: name is the name of the target resource.
+                      maxLength: 253
+                      minLength: 1
                       type: string
                     namespace:
                       description: namespace is the namespace of the referent.
                       type: string
+                      x-kubernetes-validations:
+                        - message: cross namespace referencing is not currently supported
+                          rule: self.size() == 0
+                  required:
+                    - kind
+                    - name
                   type: object
                 targetRefs:
                   description: Optional.
@@ -10296,21 +13361,105 @@ spec:
                     properties:
                       group:
                         description: group is the group of the target resource.
+                        maxLength: 253
+                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                        type: string
+                      kind:
+                        description: kind is kind of the target resource.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                        type: string
+                      name:
+                        description: name is the name of the target resource.
+                        maxLength: 253
+                        minLength: 1
+                        type: string
+                      namespace:
+                        description: namespace is the namespace of the referent.
+                        type: string
+                        x-kubernetes-validations:
+                          - message: cross namespace referencing is not currently supported
+                            rule: self.size() == 0
+                    required:
+                      - kind
+                      - name
+                    type: object
+                  maxItems: 16
+                  type: array
+              type: object
+              x-kubernetes-validations:
+                - message: only one of targetRefs or selector can be set
+                  rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1'
+            status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
                         type: string
-                      kind:
-                        description: kind is kind of the target resource.
+                      status:
+                        description: Status is the status of the condition.
                         type: string
-                      name:
-                        description: name is the name of the target resource.
+                      type:
+                        description: Type is the type of the condition.
                         type: string
-                      namespace:
-                        description: namespace is the namespace of the referent.
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
                         type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
                     type: object
                   type: array
               type: object
-            status:
-              type: object
               x-kubernetes-preserve-unknown-fields: true
           type: object
       served: true
@@ -10404,6 +13553,13 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                notServiceAccounts:
+                                  description: Optional.
+                                  items:
+                                    maxLength: 320
+                                    type: string
+                                  maxItems: 16
+                                  type: array
                                 principals:
                                   description: Optional.
                                   items:
@@ -10419,8 +13575,21 @@ spec:
                                   items:
                                     type: string
                                   type: array
+                                serviceAccounts:
+                                  description: Optional.
+                                  items:
+                                    maxLength: 320
+                                    type: string
+                                  maxItems: 16
+                                  type: array
                               type: object
+                              x-kubernetes-validations:
+                                - message: Cannot set serviceAccounts with namespaces or principals
+                                  rule: |-
+                                    (has(self.serviceAccounts) || has(self.notServiceAccounts)) ? (!has(self.principals) &&
+                                    !has(self.notPrincipals) && !has(self.namespaces) && !has(self.notNamespaces)) : true
                           type: object
+                        maxItems: 512
                         type: array
                       to:
                         description: Optional.
@@ -10494,30 +13663,54 @@ spec:
                           type: object
                         type: array
                     type: object
+                  maxItems: 512
                   type: array
                 selector:
                   description: Optional.
                   properties:
                     matchLabels:
                       additionalProperties:
+                        maxLength: 63
                         type: string
+                        x-kubernetes-validations:
+                          - message: wildcard not allowed in label value match
+                            rule: '!self.contains("*")'
                       description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.
+                      maxProperties: 4096
                       type: object
+                      x-kubernetes-validations:
+                        - message: wildcard not allowed in label key match
+                          rule: self.all(key, !key.contains("*"))
+                        - message: key must not be empty
+                          rule: self.all(key, key.size() != 0)
                   type: object
                 targetRef:
                   properties:
                     group:
                       description: group is the group of the target resource.
+                      maxLength: 253
+                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                       type: string
                     kind:
                       description: kind is kind of the target resource.
+                      maxLength: 63
+                      minLength: 1
+                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
                       type: string
                     name:
                       description: name is the name of the target resource.
+                      maxLength: 253
+                      minLength: 1
                       type: string
                     namespace:
                       description: namespace is the namespace of the referent.
                       type: string
+                      x-kubernetes-validations:
+                        - message: cross namespace referencing is not currently supported
+                          rule: self.size() == 0
+                  required:
+                    - kind
+                    - name
                   type: object
                 targetRefs:
                   description: Optional.
@@ -10525,20 +13718,104 @@ spec:
                     properties:
                       group:
                         description: group is the group of the target resource.
+                        maxLength: 253
+                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
                       kind:
                         description: kind is kind of the target resource.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
                         type: string
                       name:
                         description: name is the name of the target resource.
+                        maxLength: 253
+                        minLength: 1
                         type: string
                       namespace:
                         description: namespace is the namespace of the referent.
                         type: string
+                        x-kubernetes-validations:
+                          - message: cross namespace referencing is not currently supported
+                            rule: self.size() == 0
+                    required:
+                      - kind
+                      - name
                     type: object
+                  maxItems: 16
                   type: array
               type: object
+              x-kubernetes-validations:
+                - message: only one of targetRefs or selector can be set
+                  rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1'
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
           type: object
@@ -10547,17 +13824,22 @@ spec:
       subresources:
         status: {}
 ---
+# Source: base/templates/crds.yaml
+# If we are templating these CRDs, we want to wipe out the "static"/legacy
+# labels and replace them with the standard templated istio ones.
+# This allows the continued use of `kubectl apply -f crd-all.gen.yaml`
+# without any templating+the old labels, if desired.
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    "helm.sh/resource-policy": keep
+    helm.sh/resource-policy: keep
   labels:
-    app: istio-pilot
-    chart: istio
-    heritage: Tiller
-    istio: security
-    release: istio
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: istio
+    app.kubernetes.io/version: 1.25.0
+    helm.sh/chart: base-1.25.0
   name: peerauthentications.security.istio.io
 spec:
   group: security.istio.io
@@ -10620,18 +13902,102 @@ spec:
                         type: string
                     type: object
                   description: Port specific mutual TLS settings.
+                  minProperties: 1
                   type: object
+                  x-kubernetes-validations:
+                    - message: port must be between 1-65535
+                      rule: self.all(key, 0 < int(key) && int(key) <= 65535)
                 selector:
                   description: The selector determines the workloads to apply the PeerAuthentication on.
                   properties:
                     matchLabels:
                       additionalProperties:
+                        maxLength: 63
                         type: string
+                        x-kubernetes-validations:
+                          - message: wildcard not allowed in label value match
+                            rule: '!self.contains("*")'
                       description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.
+                      maxProperties: 4096
                       type: object
+                      x-kubernetes-validations:
+                        - message: wildcard not allowed in label key match
+                          rule: self.all(key, !key.contains("*"))
+                        - message: key must not be empty
+                          rule: self.all(key, key.size() != 0)
                   type: object
               type: object
+              x-kubernetes-validations:
+                - message: portLevelMtls requires selector
+                  rule: 'has(self.portLevelMtls) ? (((has(self.selector) && has(self.selector.matchLabels)) ? self.selector.matchLabels : {}).size() > 0) : true'
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
           type: object
@@ -10686,18 +14052,102 @@ spec:
                         type: string
                     type: object
                   description: Port specific mutual TLS settings.
+                  minProperties: 1
                   type: object
+                  x-kubernetes-validations:
+                    - message: port must be between 1-65535
+                      rule: self.all(key, 0 < int(key) && int(key) <= 65535)
                 selector:
                   description: The selector determines the workloads to apply the PeerAuthentication on.
                   properties:
                     matchLabels:
                       additionalProperties:
+                        maxLength: 63
                         type: string
+                        x-kubernetes-validations:
+                          - message: wildcard not allowed in label value match
+                            rule: '!self.contains("*")'
                       description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.
+                      maxProperties: 4096
                       type: object
+                      x-kubernetes-validations:
+                        - message: wildcard not allowed in label key match
+                          rule: self.all(key, !key.contains("*"))
+                        - message: key must not be empty
+                          rule: self.all(key, key.size() != 0)
                   type: object
               type: object
+              x-kubernetes-validations:
+                - message: portLevelMtls requires selector
+                  rule: 'has(self.portLevelMtls) ? (((has(self.selector) && has(self.selector.matchLabels)) ? self.selector.matchLabels : {}).size() > 0) : true'
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
           type: object
@@ -10706,17 +14156,22 @@ spec:
       subresources:
         status: {}
 ---
+# Source: base/templates/crds.yaml
+# If we are templating these CRDs, we want to wipe out the "static"/legacy
+# labels and replace them with the standard templated istio ones.
+# This allows the continued use of `kubectl apply -f crd-all.gen.yaml`
+# without any templating+the old labels, if desired.
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    "helm.sh/resource-policy": keep
+    helm.sh/resource-policy: keep
   labels:
-    app: istio-pilot
-    chart: istio
-    heritage: Tiller
-    istio: security
-    release: istio
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: istio
+    app.kubernetes.io/version: 1.25.0
+    helm.sh/chart: base-1.25.0
   name: requestauthentications.security.istio.io
 spec:
   group: security.istio.io
@@ -10746,6 +14201,7 @@ spec:
                       audiences:
                         description: The list of JWT [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3) that are allowed to access.
                         items:
+                          minLength: 1
                           type: string
                         type: array
                       forwardOriginalToken:
@@ -10754,6 +14210,7 @@ spec:
                       fromCookies:
                         description: List of cookie names from which JWT is expected.
                         items:
+                          minLength: 1
                           type: string
                         type: array
                       fromHeaders:
@@ -10762,6 +14219,7 @@ spec:
                           properties:
                             name:
                               description: The HTTP header name.
+                              minLength: 1
                               type: string
                             prefix:
                               description: The prefix that should be stripped before decoding the token.
@@ -10773,30 +14231,48 @@ spec:
                       fromParams:
                         description: List of query parameters from which JWT is expected.
                         items:
+                          minLength: 1
                           type: string
                         type: array
                       issuer:
                         description: Identifies the issuer that issued the JWT.
+                        minLength: 1
                         type: string
                       jwks:
                         description: JSON Web Key Set of public keys to validate signature of the JWT.
                         type: string
                       jwks_uri:
                         description: URL of the provider's public key set to validate signature of the JWT.
+                        maxLength: 2048
+                        minLength: 1
                         type: string
+                        x-kubernetes-validations:
+                          - message: url must have scheme http:// or https://
+                            rule: url(self).getScheme() in ["http", "https"]
                       jwksUri:
                         description: URL of the provider's public key set to validate signature of the JWT.
+                        maxLength: 2048
+                        minLength: 1
                         type: string
+                        x-kubernetes-validations:
+                          - message: url must have scheme http:// or https://
+                            rule: url(self).getScheme() in ["http", "https"]
                       outputClaimToHeaders:
                         description: This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token.
                         items:
                           properties:
                             claim:
                               description: The name of the claim to be copied from.
+                              minLength: 1
                               type: string
                             header:
                               description: The name of the header to be created.
+                              minLength: 1
+                              pattern: ^[-_A-Za-z0-9]+$
                               type: string
+                          required:
+                            - header
+                            - claim
                           type: object
                         type: array
                       outputPayloadToHeader:
@@ -10805,33 +14281,63 @@ spec:
                       timeout:
                         description: The maximum amount of time that the resolver, determined by the PILOT_JWT_ENABLE_REMOTE_JWKS environment variable, will spend waiting for the JWKS to be fetched.
                         type: string
+                        x-kubernetes-validations:
+                          - message: must be a valid duration greater than 1ms
+                            rule: duration(self) >= duration('1ms')
                     required:
                       - issuer
                     type: object
+                    x-kubernetes-validations:
+                      - message: only one of jwks or jwksUri can be set
+                        rule: '(has(self.jwksUri) ? 1 : 0) + (has(self.jwks_uri) ? 1 : 0) + (has(self.jwks) ? 1 : 0) <= 1'
+                  maxItems: 4096
                   type: array
                 selector:
                   description: Optional.
                   properties:
                     matchLabels:
                       additionalProperties:
+                        maxLength: 63
                         type: string
+                        x-kubernetes-validations:
+                          - message: wildcard not allowed in label value match
+                            rule: '!self.contains("*")'
                       description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.
+                      maxProperties: 4096
                       type: object
+                      x-kubernetes-validations:
+                        - message: wildcard not allowed in label key match
+                          rule: self.all(key, !key.contains("*"))
+                        - message: key must not be empty
+                          rule: self.all(key, key.size() != 0)
                   type: object
                 targetRef:
                   properties:
                     group:
                       description: group is the group of the target resource.
+                      maxLength: 253
+                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                       type: string
                     kind:
                       description: kind is kind of the target resource.
+                      maxLength: 63
+                      minLength: 1
+                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
                       type: string
                     name:
                       description: name is the name of the target resource.
+                      maxLength: 253
+                      minLength: 1
                       type: string
                     namespace:
                       description: namespace is the namespace of the referent.
                       type: string
+                      x-kubernetes-validations:
+                        - message: cross namespace referencing is not currently supported
+                          rule: self.size() == 0
+                  required:
+                    - kind
+                    - name
                   type: object
                 targetRefs:
                   description: Optional.
@@ -10839,20 +14345,104 @@ spec:
                     properties:
                       group:
                         description: group is the group of the target resource.
+                        maxLength: 253
+                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
                       kind:
                         description: kind is kind of the target resource.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
                         type: string
                       name:
                         description: name is the name of the target resource.
+                        maxLength: 253
+                        minLength: 1
                         type: string
                       namespace:
                         description: namespace is the namespace of the referent.
                         type: string
+                        x-kubernetes-validations:
+                          - message: cross namespace referencing is not currently supported
+                            rule: self.size() == 0
+                    required:
+                      - kind
+                      - name
                     type: object
+                  maxItems: 16
                   type: array
               type: object
+              x-kubernetes-validations:
+                - message: only one of targetRefs or selector can be set
+                  rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1'
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
           type: object
@@ -10874,6 +14464,7 @@ spec:
                       audiences:
                         description: The list of JWT [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3) that are allowed to access.
                         items:
+                          minLength: 1
                           type: string
                         type: array
                       forwardOriginalToken:
@@ -10882,6 +14473,7 @@ spec:
                       fromCookies:
                         description: List of cookie names from which JWT is expected.
                         items:
+                          minLength: 1
                           type: string
                         type: array
                       fromHeaders:
@@ -10890,6 +14482,7 @@ spec:
                           properties:
                             name:
                               description: The HTTP header name.
+                              minLength: 1
                               type: string
                             prefix:
                               description: The prefix that should be stripped before decoding the token.
@@ -10901,30 +14494,48 @@ spec:
                       fromParams:
                         description: List of query parameters from which JWT is expected.
                         items:
+                          minLength: 1
                           type: string
                         type: array
                       issuer:
                         description: Identifies the issuer that issued the JWT.
+                        minLength: 1
                         type: string
                       jwks:
                         description: JSON Web Key Set of public keys to validate signature of the JWT.
                         type: string
                       jwks_uri:
                         description: URL of the provider's public key set to validate signature of the JWT.
+                        maxLength: 2048
+                        minLength: 1
                         type: string
+                        x-kubernetes-validations:
+                          - message: url must have scheme http:// or https://
+                            rule: url(self).getScheme() in ["http", "https"]
                       jwksUri:
                         description: URL of the provider's public key set to validate signature of the JWT.
+                        maxLength: 2048
+                        minLength: 1
                         type: string
+                        x-kubernetes-validations:
+                          - message: url must have scheme http:// or https://
+                            rule: url(self).getScheme() in ["http", "https"]
                       outputClaimToHeaders:
                         description: This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token.
                         items:
                           properties:
                             claim:
                               description: The name of the claim to be copied from.
+                              minLength: 1
                               type: string
                             header:
                               description: The name of the header to be created.
+                              minLength: 1
+                              pattern: ^[-_A-Za-z0-9]+$
                               type: string
+                          required:
+                            - header
+                            - claim
                           type: object
                         type: array
                       outputPayloadToHeader:
@@ -10933,33 +14544,63 @@ spec:
                       timeout:
                         description: The maximum amount of time that the resolver, determined by the PILOT_JWT_ENABLE_REMOTE_JWKS environment variable, will spend waiting for the JWKS to be fetched.
                         type: string
+                        x-kubernetes-validations:
+                          - message: must be a valid duration greater than 1ms
+                            rule: duration(self) >= duration('1ms')
                     required:
                       - issuer
                     type: object
+                    x-kubernetes-validations:
+                      - message: only one of jwks or jwksUri can be set
+                        rule: '(has(self.jwksUri) ? 1 : 0) + (has(self.jwks_uri) ? 1 : 0) + (has(self.jwks) ? 1 : 0) <= 1'
+                  maxItems: 4096
                   type: array
                 selector:
                   description: Optional.
                   properties:
                     matchLabels:
                       additionalProperties:
+                        maxLength: 63
                         type: string
+                        x-kubernetes-validations:
+                          - message: wildcard not allowed in label value match
+                            rule: '!self.contains("*")'
                       description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.
+                      maxProperties: 4096
                       type: object
+                      x-kubernetes-validations:
+                        - message: wildcard not allowed in label key match
+                          rule: self.all(key, !key.contains("*"))
+                        - message: key must not be empty
+                          rule: self.all(key, key.size() != 0)
                   type: object
                 targetRef:
                   properties:
                     group:
                       description: group is the group of the target resource.
+                      maxLength: 253
+                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                       type: string
                     kind:
                       description: kind is kind of the target resource.
+                      maxLength: 63
+                      minLength: 1
+                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
                       type: string
                     name:
                       description: name is the name of the target resource.
+                      maxLength: 253
+                      minLength: 1
                       type: string
                     namespace:
                       description: namespace is the namespace of the referent.
                       type: string
+                      x-kubernetes-validations:
+                        - message: cross namespace referencing is not currently supported
+                          rule: self.size() == 0
+                  required:
+                    - kind
+                    - name
                   type: object
                 targetRefs:
                   description: Optional.
@@ -10967,20 +14608,104 @@ spec:
                     properties:
                       group:
                         description: group is the group of the target resource.
+                        maxLength: 253
+                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
                       kind:
                         description: kind is kind of the target resource.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
                         type: string
                       name:
                         description: name is the name of the target resource.
+                        maxLength: 253
+                        minLength: 1
                         type: string
                       namespace:
                         description: namespace is the namespace of the referent.
                         type: string
+                        x-kubernetes-validations:
+                          - message: cross namespace referencing is not currently supported
+                            rule: self.size() == 0
+                    required:
+                      - kind
+                      - name
                     type: object
+                  maxItems: 16
                   type: array
               type: object
+              x-kubernetes-validations:
+                - message: only one of targetRefs or selector can be set
+                  rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1'
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
           type: object
@@ -10989,17 +14714,22 @@ spec:
       subresources:
         status: {}
 ---
+# Source: base/templates/crds.yaml
+# If we are templating these CRDs, we want to wipe out the "static"/legacy
+# labels and replace them with the standard templated istio ones.
+# This allows the continued use of `kubectl apply -f crd-all.gen.yaml`
+# without any templating+the old labels, if desired.
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    "helm.sh/resource-policy": keep
+    helm.sh/resource-policy: keep
   labels:
-    app: istio-pilot
-    chart: istio
-    heritage: Tiller
-    istio: telemetry
-    release: istio
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: istio
+    app.kubernetes.io/version: 1.25.0
+    helm.sh/chart: base-1.25.0
   name: telemetries.telemetry.istio.io
 spec:
   group: telemetry.istio.io
@@ -11147,9 +14877,9 @@ spec:
                                 type: object
                                 x-kubernetes-validations:
                                   - message: value must be set when operation is UPSERT
-                                    rule: '((has(self.operation) ? self.operation : '''') == ''UPSERT'') ? self.value != '''' : true'
+                                    rule: '((has(self.operation) ? self.operation : "") == "UPSERT") ? (self.value != "") : true'
                                   - message: value must not be set when operation is REMOVE
-                                    rule: '((has(self.operation) ? self.operation : '''') == ''REMOVE'') ? !has(self.value) : true'
+                                    rule: '((has(self.operation) ? self.operation : "") == "REMOVE") ? !has(self.value) : true'
                               description: Optional.
                               type: object
                           type: object
@@ -11169,6 +14899,9 @@ spec:
                       reportingInterval:
                         description: Optional.
                         type: string
+                        x-kubernetes-validations:
+                          - message: must be a valid duration greater than 1ms
+                            rule: duration(self) >= duration('1ms')
                     type: object
                   type: array
                 selector:
@@ -11176,24 +14909,47 @@ spec:
                   properties:
                     matchLabels:
                       additionalProperties:
+                        maxLength: 63
                         type: string
+                        x-kubernetes-validations:
+                          - message: wildcard not allowed in label value match
+                            rule: '!self.contains("*")'
                       description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.
+                      maxProperties: 4096
                       type: object
+                      x-kubernetes-validations:
+                        - message: wildcard not allowed in label key match
+                          rule: self.all(key, !key.contains("*"))
+                        - message: key must not be empty
+                          rule: self.all(key, key.size() != 0)
                   type: object
                 targetRef:
                   properties:
                     group:
                       description: group is the group of the target resource.
+                      maxLength: 253
+                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                       type: string
                     kind:
                       description: kind is kind of the target resource.
+                      maxLength: 63
+                      minLength: 1
+                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
                       type: string
                     name:
                       description: name is the name of the target resource.
+                      maxLength: 253
+                      minLength: 1
                       type: string
                     namespace:
                       description: namespace is the namespace of the referent.
                       type: string
+                      x-kubernetes-validations:
+                        - message: cross namespace referencing is not currently supported
+                          rule: self.size() == 0
+                  required:
+                    - kind
+                    - name
                   type: object
                 targetRefs:
                   description: Optional.
@@ -11201,17 +14957,31 @@ spec:
                     properties:
                       group:
                         description: group is the group of the target resource.
+                        maxLength: 253
+                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
                       kind:
                         description: kind is kind of the target resource.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
                         type: string
                       name:
                         description: name is the name of the target resource.
+                        maxLength: 253
+                        minLength: 1
                         type: string
                       namespace:
                         description: namespace is the namespace of the referent.
                         type: string
+                        x-kubernetes-validations:
+                          - message: cross namespace referencing is not currently supported
+                            rule: self.size() == 0
+                    required:
+                      - kind
+                      - name
                     type: object
+                  maxItems: 16
                   type: array
                 tracing:
                   description: Optional.
@@ -11278,6 +15048,10 @@ spec:
                         description: Controls span reporting.
                         nullable: true
                         type: boolean
+                      enableIstioTags:
+                        description: Determines whether or not trace spans generated by Envoy will include Istio specific tags.
+                        nullable: true
+                        type: boolean
                       match:
                         description: Allows tailoring of behavior to specific conditions.
                         properties:
@@ -11317,7 +15091,77 @@ spec:
                     type: object
                   type: array
               type: object
+              x-kubernetes-validations:
+                - message: only one of targetRefs or selector can be set
+                  rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1'
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
           type: object
@@ -11457,9 +15301,9 @@ spec:
                                 type: object
                                 x-kubernetes-validations:
                                   - message: value must be set when operation is UPSERT
-                                    rule: '((has(self.operation) ? self.operation : '''') == ''UPSERT'') ? self.value != '''' : true'
+                                    rule: '((has(self.operation) ? self.operation : "") == "UPSERT") ? (self.value != "") : true'
                                   - message: value must not be set when operation is REMOVE
-                                    rule: '((has(self.operation) ? self.operation : '''') == ''REMOVE'') ? !has(self.value) : true'
+                                    rule: '((has(self.operation) ? self.operation : "") == "REMOVE") ? !has(self.value) : true'
                               description: Optional.
                               type: object
                           type: object
@@ -11479,6 +15323,9 @@ spec:
                       reportingInterval:
                         description: Optional.
                         type: string
+                        x-kubernetes-validations:
+                          - message: must be a valid duration greater than 1ms
+                            rule: duration(self) >= duration('1ms')
                     type: object
                   type: array
                 selector:
@@ -11486,24 +15333,47 @@ spec:
                   properties:
                     matchLabels:
                       additionalProperties:
+                        maxLength: 63
                         type: string
+                        x-kubernetes-validations:
+                          - message: wildcard not allowed in label value match
+                            rule: '!self.contains("*")'
                       description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.
+                      maxProperties: 4096
                       type: object
+                      x-kubernetes-validations:
+                        - message: wildcard not allowed in label key match
+                          rule: self.all(key, !key.contains("*"))
+                        - message: key must not be empty
+                          rule: self.all(key, key.size() != 0)
                   type: object
                 targetRef:
                   properties:
                     group:
                       description: group is the group of the target resource.
+                      maxLength: 253
+                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                       type: string
                     kind:
                       description: kind is kind of the target resource.
+                      maxLength: 63
+                      minLength: 1
+                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
                       type: string
                     name:
                       description: name is the name of the target resource.
+                      maxLength: 253
+                      minLength: 1
                       type: string
                     namespace:
                       description: namespace is the namespace of the referent.
                       type: string
+                      x-kubernetes-validations:
+                        - message: cross namespace referencing is not currently supported
+                          rule: self.size() == 0
+                  required:
+                    - kind
+                    - name
                   type: object
                 targetRefs:
                   description: Optional.
@@ -11511,17 +15381,31 @@ spec:
                     properties:
                       group:
                         description: group is the group of the target resource.
+                        maxLength: 253
+                        pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                         type: string
                       kind:
                         description: kind is kind of the target resource.
+                        maxLength: 63
+                        minLength: 1
+                        pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
                         type: string
                       name:
                         description: name is the name of the target resource.
+                        maxLength: 253
+                        minLength: 1
                         type: string
                       namespace:
                         description: namespace is the namespace of the referent.
                         type: string
+                        x-kubernetes-validations:
+                          - message: cross namespace referencing is not currently supported
+                            rule: self.size() == 0
+                    required:
+                      - kind
+                      - name
                     type: object
+                  maxItems: 16
                   type: array
                 tracing:
                   description: Optional.
@@ -11588,6 +15472,10 @@ spec:
                         description: Controls span reporting.
                         nullable: true
                         type: boolean
+                      enableIstioTags:
+                        description: Determines whether or not trace spans generated by Envoy will include Istio specific tags.
+                        nullable: true
+                        type: boolean
                       match:
                         description: Allows tailoring of behavior to specific conditions.
                         properties:
@@ -11627,7 +15515,77 @@ spec:
                     type: object
                   type: array
               type: object
+              x-kubernetes-validations:
+                - message: only one of targetRefs or selector can be set
+                  rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1'
             status:
+              properties:
+                conditions:
+                  description: Current service state of the resource.
+                  items:
+                    properties:
+                      lastProbeTime:
+                        description: Last time we probed the condition.
+                        format: date-time
+                        type: string
+                      lastTransitionTime:
+                        description: Last time the condition transitioned from one status to another.
+                        format: date-time
+                        type: string
+                      message:
+                        description: Human-readable message indicating details about last transition.
+                        type: string
+                      observedGeneration:
+                        anyOf:
+                          - type: integer
+                          - type: string
+                        description: Resource Generation to which the Condition refers.
+                        x-kubernetes-int-or-string: true
+                      reason:
+                        description: Unique, one-word, CamelCase reason for the condition's last transition.
+                        type: string
+                      status:
+                        description: Status is the status of the condition.
+                        type: string
+                      type:
+                        description: Type is the type of the condition.
+                        type: string
+                    type: object
+                  type: array
+                observedGeneration:
+                  anyOf:
+                    - type: integer
+                    - type: string
+                  x-kubernetes-int-or-string: true
+                validationMessages:
+                  description: Includes any errors or warnings detected by Istio's analyzers.
+                  items:
+                    properties:
+                      documentationUrl:
+                        description: A url pointing to the Istio documentation for this specific error type.
+                        type: string
+                      level:
+                        description: |-
+                          Represents how severe a message is.
+
+                          Valid Options: UNKNOWN, ERROR, WARNING, INFO
+                        enum:
+                          - UNKNOWN
+                          - ERROR
+                          - WARNING
+                          - INFO
+                        type: string
+                      type:
+                        properties:
+                          code:
+                            description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
+                            type: string
+                          name:
+                            description: A human-readable name for the message type.
+                            type: string
+                        type: object
+                    type: object
+                  type: array
               type: object
               x-kubernetes-preserve-unknown-fields: true
           type: object