diff --git a/gen.sh b/gen.sh
index 10f5251cee2..6520c0be2f8 100755
--- a/gen.sh
+++ b/gen.sh
@@ -24,7 +24,8 @@ buf generate \
   --path analysis \
   --path authentication \
   --path meta \
-  --path telemetry
+  --path telemetry \
+  --path policy
 
 # These folders do not have the full plugins used, as they are not full CRDs.
 # We pass them a custom configuration to exclude the non-required files
diff --git a/kubernetes/customresourcedefinitions.gen.yaml b/kubernetes/customresourcedefinitions.gen.yaml
index 0c0ffc8a719..bd285ad7a34 100644
--- a/kubernetes/customresourcedefinitions.gen.yaml
+++ b/kubernetes/customresourcedefinitions.gen.yaml
@@ -5073,6 +5073,276 @@ spec:
     subresources:
       status: {}
 
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    "helm.sh/resource-policy": keep
+  labels:
+    app: istio-pilot
+    chart: istio
+    heritage: Tiller
+    istio: policy
+    release: istio
+  name: telemetries.policy.istio.io
+spec:
+  group: policy.istio.io
+  names:
+    categories:
+    - istio-io
+    - policy-istio-io
+    kind: Policy
+    listKind: PolicyList
+    plural: telemetries
+    shortNames:
+    - policy
+    singular: policy
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: 'CreationTimestamp is a timestamp representing the server time
+        when this object was created. It is not guaranteed to be set in happens-before
+        order across separate operations. Clients may not set this value. It is represented
+        in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for
+        lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata'
+      jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        properties:
+          spec:
+            allOf:
+            - oneOf:
+              - not:
+                  anyOf:
+                  - required:
+                    - workload
+                  - required:
+                    - route
+              - required:
+                - workload
+              - required:
+                - route
+            - oneOf:
+              - not:
+                  anyOf:
+                  - required:
+                    - global
+                  - required:
+                    - local
+              - required:
+                - global
+              - required:
+                - local
+            properties:
+              descriptors:
+                description: Optional.
+                items:
+                  properties:
+                    entries:
+                      items:
+                        oneOf:
+                        - not:
+                            anyOf:
+                            - required:
+                              - header
+                            - required:
+                              - headerMatch
+                            - required:
+                              - constant
+                            - required:
+                              - expression
+                        - required:
+                          - header
+                        - required:
+                          - headerMatch
+                        - required:
+                          - constant
+                        - required:
+                          - expression
+                        properties:
+                          constant:
+                            description: Constant entry key and value.
+                            properties:
+                              key:
+                                description: Descriptor entry key.
+                                type: string
+                              value:
+                                description: Descriptor entry value.
+                                type: string
+                            type: object
+                          expression:
+                            description: CEL expression entry.
+                            properties:
+                              key:
+                                description: Descriptor entry key.
+                                type: string
+                              skipIfError:
+                                description: If set to true, the descriptor entry
+                                  is omitted if the expression evaluates to an error.
+                                type: boolean
+                              text:
+                                description: Descriptor expression.
+                                type: string
+                            type: object
+                          header:
+                            description: Entry obtained from a header value.
+                            properties:
+                              key:
+                                description: Descriptor entry key.
+                                type: string
+                              name:
+                                description: Request header name.
+                                type: string
+                              skipIfAbsent:
+                                description: When true, the descriptor entry is omitted
+                                  from the descriptor if the header is absent.
+                                type: boolean
+                            type: object
+                          headerMatch:
+                            description: Entry obtained by testing a header value
+                              against exact value, prefix, etc.
+                            properties:
+                              conditions:
+                                description: The request matches when it matches all
+                                  conditions.
+                                items:
+                                  oneOf:
+                                  - not:
+                                      anyOf:
+                                      - required:
+                                        - exact
+                                      - required:
+                                        - prefix
+                                      - required:
+                                        - present
+                                  - required:
+                                    - exact
+                                  - required:
+                                    - prefix
+                                  - required:
+                                    - present
+                                  properties:
+                                    exact:
+                                      description: The header value must match exactly.
+                                      type: string
+                                    name:
+                                      description: Header name.
+                                      type: string
+                                    prefix:
+                                      description: The header value must start with
+                                        the given value.
+                                      type: string
+                                    present:
+                                      description: If specified as true, the header
+                                        matches when it is present in the request.
+                                      type: boolean
+                                  type: object
+                                type: array
+                              value:
+                                description: Descriptor entry value.
+                                type: string
+                            type: object
+                        type: object
+                      type: array
+                  type: object
+                type: array
+              global:
+                description: Global rate limiting provider reference.
+                properties:
+                  name:
+                    description: Provider name.
+                    type: string
+                type: object
+              local:
+                description: Local rate limit policy.
+                properties:
+                  descriptors:
+                    description: Descriptor overrides.
+                    items:
+                      properties:
+                        entries:
+                          description: Descriptor entries to be matched exactly.
+                          items:
+                            properties:
+                              key:
+                                type: string
+                              value:
+                                type: string
+                            type: object
+                          type: array
+                        tokenBucket:
+                          description: Override token bucket.
+                          properties:
+                            fillInterval:
+                              description: The fill interval that tokens are added
+                                to the bucket.
+                              type: string
+                            maxTokens:
+                              description: The maximum tokens that the bucket can
+                                hold.
+                              type: integer
+                            tokensPerFill:
+                              description: The number of tokens added to the bucket
+                                during each fill interval.
+                              nullable: true
+                              type: integer
+                          type: object
+                      type: object
+                    type: array
+                  tokenBucket:
+                    properties:
+                      fillInterval:
+                        description: The fill interval that tokens are added to the
+                          bucket.
+                        type: string
+                      maxTokens:
+                        description: The maximum tokens that the bucket can hold.
+                        type: integer
+                      tokensPerFill:
+                        description: The number of tokens added to the bucket during
+                          each fill interval.
+                        nullable: true
+                        type: integer
+                    type: object
+                type: object
+              route:
+                description: Optional.
+                properties:
+                  group:
+                    description: Resource API group.
+                    type: string
+                  kind:
+                    description: Resource kind.
+                    type: string
+                  name:
+                    description: Resource name.
+                    type: string
+                  route:
+                    description: Optional.
+                    type: string
+                type: object
+              workload:
+                description: Optional.
+                properties:
+                  matchLabels:
+                    additionalProperties:
+                      type: string
+                    type: object
+                type: object
+            type: object
+          status:
+            type: object
+            x-kubernetes-preserve-unknown-fields: true
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
diff --git a/mesh/v1alpha1/config.pb.go b/mesh/v1alpha1/config.pb.go
index 20ce54cd9c9..e16156f3414 100644
--- a/mesh/v1alpha1/config.pb.go
+++ b/mesh/v1alpha1/config.pb.go
@@ -1338,6 +1338,7 @@ type MeshConfig_ExtensionProvider struct {
 	//	*MeshConfig_ExtensionProvider_Stackdriver
 	//	*MeshConfig_ExtensionProvider_Opencensus
 	//	*MeshConfig_ExtensionProvider_Skywalking
+	//	*MeshConfig_ExtensionProvider_RateLimit
 	Provider             isMeshConfig_ExtensionProvider_Provider `protobuf_oneof:"provider"`
 	XXX_NoUnkeyedLiteral struct{}                                `json:"-"`
 	XXX_unrecognized     []byte                                  `json:"-"`
@@ -1407,6 +1408,9 @@ type MeshConfig_ExtensionProvider_Opencensus struct {
 type MeshConfig_ExtensionProvider_Skywalking struct {
 	Skywalking *MeshConfig_ExtensionProvider_SkyWalkingTracingProvider `protobuf:"bytes,9,opt,name=skywalking,proto3,oneof" json:"skywalking,omitempty"`
 }
+type MeshConfig_ExtensionProvider_RateLimit struct {
+	RateLimit *MeshConfig_ExtensionProvider_RateLimitProvider `protobuf:"bytes,10,opt,name=rate_limit,json=rateLimit,proto3,oneof" json:"rateLimit,omitempty"`
+}
 
 func (*MeshConfig_ExtensionProvider_EnvoyExtAuthzHttp) isMeshConfig_ExtensionProvider_Provider() {}
 func (*MeshConfig_ExtensionProvider_EnvoyExtAuthzGrpc) isMeshConfig_ExtensionProvider_Provider() {}
@@ -1416,6 +1420,7 @@ func (*MeshConfig_ExtensionProvider_Datadog) isMeshConfig_ExtensionProvider_Prov
 func (*MeshConfig_ExtensionProvider_Stackdriver) isMeshConfig_ExtensionProvider_Provider()       {}
 func (*MeshConfig_ExtensionProvider_Opencensus) isMeshConfig_ExtensionProvider_Provider()        {}
 func (*MeshConfig_ExtensionProvider_Skywalking) isMeshConfig_ExtensionProvider_Provider()        {}
+func (*MeshConfig_ExtensionProvider_RateLimit) isMeshConfig_ExtensionProvider_Provider()         {}
 
 func (m *MeshConfig_ExtensionProvider) GetProvider() isMeshConfig_ExtensionProvider_Provider {
 	if m != nil {
@@ -1487,6 +1492,13 @@ func (m *MeshConfig_ExtensionProvider) GetSkywalking() *MeshConfig_ExtensionProv
 	return nil
 }
 
+func (m *MeshConfig_ExtensionProvider) GetRateLimit() *MeshConfig_ExtensionProvider_RateLimitProvider {
+	if x, ok := m.GetProvider().(*MeshConfig_ExtensionProvider_RateLimit); ok {
+		return x.RateLimit
+	}
+	return nil
+}
+
 // XXX_OneofWrappers is for the internal use of the proto package.
 func (*MeshConfig_ExtensionProvider) XXX_OneofWrappers() []interface{} {
 	return []interface{}{
@@ -1498,6 +1510,7 @@ func (*MeshConfig_ExtensionProvider) XXX_OneofWrappers() []interface{} {
 		(*MeshConfig_ExtensionProvider_Stackdriver)(nil),
 		(*MeshConfig_ExtensionProvider_Opencensus)(nil),
 		(*MeshConfig_ExtensionProvider_Skywalking)(nil),
+		(*MeshConfig_ExtensionProvider_RateLimit)(nil),
 	}
 }
 
@@ -2387,6 +2400,97 @@ func (m *MeshConfig_ExtensionProvider_OpenCensusAgentTracingProvider) GetMaxTagL
 	return 0
 }
 
+// Defines configuration for a global rate limiting service provider.
+// The service must implement Rate Limit Service (RLS):
+// https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/ratelimit/v3/rls.proto.
+type MeshConfig_ExtensionProvider_RateLimitProvider struct {
+	// REQUIRED. Specifies the service that exposes the rate limit API.
+	// The format is "[<Namespace>/]<Hostname>". The specification of <Namespace> is required only when it is insufficient
+	// to unambiguously resolve a service in the service registry. The <Hostname> is a fully qualified host name of a
+	// service defined by the Kubernetes service or ServiceEntry.
+	//
+	// Example: "rls.default.svc.cluster.local" or "bar/rls.example.com".
+	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
+	// REQUIRED. Specifies the port of the service.
+	Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
+	// The rate limit domain to use when calling the service.
+	// This corresponds to the `domain` field in the RateLimitRequest proto:
+	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/ratelimit/v3/rls.proto#service-ratelimit-v3-ratelimitrequest.
+	Domain string `protobuf:"bytes,3,opt,name=domain,proto3" json:"domain,omitempty"`
+	// The behaviour in case the rate limiting service does not respond back.
+	// When it is set to true, the proxy will not allow traffic in case of
+	// communication failure between rate limiting service and the proxy.
+	FailureModeDeny      bool     `protobuf:"varint,4,opt,name=failure_mode_deny,json=failureModeDeny,proto3" json:"failureModeDeny,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *MeshConfig_ExtensionProvider_RateLimitProvider) Reset() {
+	*m = MeshConfig_ExtensionProvider_RateLimitProvider{}
+}
+func (m *MeshConfig_ExtensionProvider_RateLimitProvider) String() string {
+	return proto.CompactTextString(m)
+}
+func (*MeshConfig_ExtensionProvider_RateLimitProvider) ProtoMessage() {}
+func (*MeshConfig_ExtensionProvider_RateLimitProvider) Descriptor() ([]byte, []int) {
+	return fileDescriptor_b5c7ece76d5d5022, []int{0, 5, 9}
+}
+func (m *MeshConfig_ExtensionProvider_RateLimitProvider) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *MeshConfig_ExtensionProvider_RateLimitProvider) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_MeshConfig_ExtensionProvider_RateLimitProvider.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *MeshConfig_ExtensionProvider_RateLimitProvider) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_MeshConfig_ExtensionProvider_RateLimitProvider.Merge(m, src)
+}
+func (m *MeshConfig_ExtensionProvider_RateLimitProvider) XXX_Size() int {
+	return m.Size()
+}
+func (m *MeshConfig_ExtensionProvider_RateLimitProvider) XXX_DiscardUnknown() {
+	xxx_messageInfo_MeshConfig_ExtensionProvider_RateLimitProvider.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_MeshConfig_ExtensionProvider_RateLimitProvider proto.InternalMessageInfo
+
+func (m *MeshConfig_ExtensionProvider_RateLimitProvider) GetService() string {
+	if m != nil {
+		return m.Service
+	}
+	return ""
+}
+
+func (m *MeshConfig_ExtensionProvider_RateLimitProvider) GetPort() uint32 {
+	if m != nil {
+		return m.Port
+	}
+	return 0
+}
+
+func (m *MeshConfig_ExtensionProvider_RateLimitProvider) GetDomain() string {
+	if m != nil {
+		return m.Domain
+	}
+	return ""
+}
+
+func (m *MeshConfig_ExtensionProvider_RateLimitProvider) GetFailureModeDeny() bool {
+	if m != nil {
+		return m.FailureModeDeny
+	}
+	return false
+}
+
 // Holds the name references to the providers that will be used by default
 // in other Istio configuration resources if the provider is not specified.
 type MeshConfig_DefaultProviders struct {
@@ -2664,6 +2768,7 @@ func init() {
 	proto.RegisterType((*MeshConfig_ExtensionProvider_SkyWalkingTracingProvider)(nil), "istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.SkyWalkingTracingProvider")
 	proto.RegisterType((*MeshConfig_ExtensionProvider_StackdriverProvider)(nil), "istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.StackdriverProvider")
 	proto.RegisterType((*MeshConfig_ExtensionProvider_OpenCensusAgentTracingProvider)(nil), "istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.OpenCensusAgentTracingProvider")
+	proto.RegisterType((*MeshConfig_ExtensionProvider_RateLimitProvider)(nil), "istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.RateLimitProvider")
 	proto.RegisterType((*MeshConfig_DefaultProviders)(nil), "istio.mesh.v1alpha1.MeshConfig.DefaultProviders")
 	proto.RegisterType((*MeshConfig_ProxyPathNormalization)(nil), "istio.mesh.v1alpha1.MeshConfig.ProxyPathNormalization")
 	proto.RegisterType((*ConfigSource)(nil), "istio.mesh.v1alpha1.ConfigSource")
@@ -2673,214 +2778,218 @@ func init() {
 func init() { proto.RegisterFile("mesh/v1alpha1/config.proto", fileDescriptor_b5c7ece76d5d5022) }
 
 var fileDescriptor_b5c7ece76d5d5022 = []byte{
-	// 3310 bytes of a gzipped FileDescriptorProto
+	// 3374 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xc4, 0x5a, 0xcd, 0x72, 0x1b, 0x49,
-	0x72, 0x16, 0x40, 0x48, 0x6c, 0x26, 0x08, 0xb2, 0x51, 0xfc, 0x51, 0x13, 0xfa, 0xa3, 0x38, 0x23,
-	0x0d, 0x57, 0x1e, 0x83, 0x23, 0x6a, 0x76, 0x56, 0x3b, 0x6b, 0x3b, 0x0c, 0x02, 0x90, 0x48, 0x0c,
-	0x44, 0xd2, 0x45, 0x50, 0x9a, 0x9f, 0xd8, 0xa8, 0x28, 0x76, 0x17, 0x80, 0x5e, 0x36, 0xba, 0xe1,
-	0xae, 0x02, 0x45, 0x4c, 0xc4, 0x3e, 0x81, 0x4f, 0x3e, 0xfa, 0x19, 0x1c, 0xf6, 0xc1, 0x17, 0xbf,
-	0x82, 0x23, 0xf6, 0xe2, 0xc3, 0x1e, 0x7d, 0x70, 0xcc, 0xd9, 0x11, 0xf6, 0x23, 0x38, 0xea, 0xa7,
-	0x81, 0x26, 0x09, 0x09, 0xe2, 0x84, 0xd6, 0xbe, 0xa1, 0xb3, 0x32, 0xbf, 0xcc, 0xca, 0xaa, 0xcc,
-	0xca, 0xca, 0x02, 0x94, 0x7a, 0x8c, 0x77, 0xb7, 0xce, 0x9e, 0xd2, 0xa0, 0xdf, 0xa5, 0x4f, 0xb7,
-	0xdc, 0x28, 0x6c, 0xfb, 0x9d, 0x72, 0x3f, 0x8e, 0x44, 0x84, 0x96, 0x7c, 0x2e, 0xfc, 0xa8, 0x2c,
-	0x39, 0xca, 0x09, 0x47, 0xe9, 0x7e, 0x27, 0x8a, 0x3a, 0x01, 0xdb, 0x52, 0x2c, 0x27, 0x83, 0xf6,
-	0x96, 0x37, 0x88, 0xa9, 0xf0, 0xa3, 0x50, 0x0b, 0x5d, 0x1d, 0x7f, 0x1b, 0xd3, 0x7e, 0x9f, 0xc5,
-	0xdc, 0x8c, 0xaf, 0x5d, 0x54, 0xd8, 0x8f, 0xa3, 0xf3, 0xa1, 0x19, 0x7a, 0x12, 0x32, 0xf1, 0x36,
-	0x8a, 0x4f, 0xfd, 0xb0, 0x93, 0x30, 0x3c, 0xdb, 0xf2, 0x18, 0x17, 0x7e, 0xa8, 0x34, 0x90, 0x78,
-	0x10, 0x30, 0xc3, 0xfb, 0xe5, 0xe9, 0x73, 0x5e, 0xf6, 0xa3, 0x2d, 0xda, 0xf7, 0x7b, 0xd4, 0xed,
-	0xfa, 0x21, 0x8b, 0x87, 0x5b, 0xfd, 0xd3, 0x8e, 0x24, 0xf0, 0xad, 0x1e, 0x13, 0x74, 0xeb, 0xec,
-	0xe9, 0x56, 0x87, 0x85, 0x2c, 0xa6, 0x82, 0x79, 0x5a, 0x6a, 0xe3, 0x7f, 0x2a, 0x00, 0xaf, 0x18,
-	0xef, 0x56, 0xd5, 0x34, 0xd1, 0x13, 0x28, 0x2a, 0xfd, 0x24, 0xf0, 0xb9, 0x60, 0x21, 0xe9, 0x47,
-	0xb1, 0x70, 0x72, 0xeb, 0x99, 0xcd, 0x9b, 0x78, 0x51, 0x0d, 0x34, 0x15, 0xfd, 0x30, 0x8a, 0x05,
-	0x7a, 0x0c, 0x9a, 0x44, 0xba, 0x42, 0xf4, 0x35, 0xe7, 0x4d, 0xc5, 0x59, 0x50, 0xe4, 0x5d, 0x21,
-	0xfa, 0x8a, 0x6f, 0x07, 0x16, 0xdd, 0x28, 0x0c, 0x99, 0x2b, 0x88, 0xf0, 0x7b, 0x2c, 0x1a, 0x08,
-	0xe7, 0xd6, 0x7a, 0x66, 0x33, 0xbf, 0xbd, 0x56, 0xd6, 0x9e, 0x29, 0x27, 0x9e, 0x29, 0xd7, 0x8c,
-	0xe7, 0xf0, 0x82, 0x91, 0x68, 0x69, 0x01, 0xf4, 0x06, 0x4a, 0x8a, 0xc9, 0x8d, 0x02, 0xe2, 0x31,
-	0xc1, 0x5c, 0x35, 0xfb, 0x04, 0xee, 0xc9, 0x34, 0x38, 0x27, 0x11, 0xae, 0x25, 0xb2, 0x09, 0x70,
-	0x04, 0x05, 0xe1, 0xf6, 0xc9, 0x29, 0x63, 0x7d, 0x1a, 0xf8, 0x67, 0xcc, 0xb9, 0xab, 0xb0, 0x1a,
-	0x65, 0xbd, 0xd2, 0x63, 0xff, 0x27, 0xeb, 0xfd, 0xac, 0x5c, 0xd5, 0xa6, 0xf9, 0x51, 0x78, 0x18,
-	0x45, 0xc1, 0x11, 0x13, 0xc2, 0x0f, 0x3b, 0xbc, 0xdc, 0xaa, 0x1e, 0x8e, 0x7f, 0xbb, 0xfd, 0x6f,
-	0x12, 0x44, 0x3c, 0x2f, 0x52, 0x5f, 0xe8, 0x13, 0x28, 0xf8, 0x61, 0x27, 0x66, 0x9c, 0x13, 0x37,
-	0xa0, 0x9c, 0x3b, 0xb3, 0xeb, 0x99, 0xcd, 0x39, 0x3c, 0x6f, 0x88, 0x55, 0x49, 0x43, 0x9f, 0xc1,
-	0x62, 0xc2, 0xc4, 0x59, 0x7c, 0xe6, 0xbb, 0xcc, 0xb1, 0x14, 0xdb, 0x82, 0x21, 0x1f, 0x69, 0x2a,
-	0xea, 0xc1, 0xed, 0x11, 0x5a, 0x14, 0x8a, 0x38, 0x0a, 0x02, 0x16, 0x93, 0x5e, 0xe4, 0x31, 0x67,
-	0x6e, 0x3d, 0xb3, 0xb9, 0xb0, 0xfd, 0xcb, 0xf2, 0x84, 0x2d, 0x5b, 0x1e, 0xaf, 0x78, 0x79, 0xcf,
-	0xe8, 0x1d, 0x49, 0xbf, 0x8a, 0x3c, 0x86, 0x57, 0xfc, 0x49, 0x64, 0xf4, 0x0b, 0xb0, 0xc7, 0x76,
-	0x05, 0xcc, 0x15, 0x51, 0xec, 0x7c, 0xa9, 0x0c, 0x5b, 0x1c, 0x19, 0xa6, 0xc9, 0xe8, 0x11, 0x2c,
-	0xb0, 0x90, 0x9e, 0x04, 0x8c, 0x88, 0x98, 0xba, 0x7e, 0xd8, 0x71, 0xe6, 0xd7, 0x33, 0x9b, 0x16,
-	0x2e, 0x68, 0x6a, 0x4b, 0x13, 0xe5, 0x26, 0xa2, 0xae, 0x2b, 0x01, 0x83, 0xa8, 0x43, 0xda, 0x7e,
-	0xc0, 0x9c, 0x82, 0x02, 0x2c, 0x68, 0x72, 0x33, 0xea, 0xbc, 0xf0, 0x03, 0x26, 0x37, 0x66, 0x9a,
-	0x2f, 0x8a, 0x7b, 0x54, 0x38, 0x8e, 0x56, 0x3d, 0xe6, 0x54, 0x64, 0x44, 0x61, 0x29, 0xc5, 0xcb,
-	0x42, 0x37, 0xf2, 0xa4, 0xfe, 0x3b, 0xca, 0x21, 0x4f, 0xa7, 0x39, 0xa4, 0x92, 0xa0, 0xd5, 0x8d,
-	0x20, 0x2e, 0xd2, 0xcb, 0x24, 0x54, 0x83, 0x07, 0x66, 0x76, 0x2c, 0x3c, 0x8b, 0x86, 0x24, 0xa5,
-	0x2f, 0x59, 0xb0, 0x4d, 0x35, 0xdd, 0x3b, 0x9a, 0xad, 0x2e, 0xb9, 0x46, 0xc8, 0xc9, 0xea, 0xfd,
-	0x06, 0x4a, 0x9e, 0xcf, 0x53, 0x30, 0x3a, 0xea, 0x58, 0x2c, 0x81, 0x9c, 0xe7, 0x0a, 0xe0, 0xb6,
-	0xe1, 0x50, 0x08, 0x4d, 0x33, 0xde, 0x8c, 0x3a, 0xe8, 0x25, 0x2c, 0x78, 0xac, 0x4d, 0x07, 0x81,
-	0x20, 0x3a, 0x47, 0x39, 0x0b, 0x6a, 0xeb, 0xae, 0x4f, 0x9c, 0xe0, 0xa1, 0x0c, 0x49, 0x3d, 0x43,
-	0x5c, 0x30, 0x72, 0x26, 0xe6, 0x7b, 0x70, 0x3b, 0x1a, 0x88, 0x93, 0x68, 0x10, 0x7a, 0x72, 0xad,
-	0xda, 0x6d, 0xdf, 0x25, 0xfd, 0x28, 0xf0, 0xdd, 0xa1, 0x53, 0x54, 0x88, 0x53, 0xf7, 0xd0, 0x81,
-	0x11, 0x6f, 0x69, 0xe9, 0x43, 0x25, 0x8c, 0x57, 0xa2, 0x49, 0x64, 0xb4, 0x0b, 0x0b, 0xda, 0x5e,
-	0xc2, 0xa3, 0x41, 0xec, 0x32, 0xee, 0xac, 0xae, 0xcf, 0x6c, 0xe6, 0xb7, 0x1f, 0x4e, 0xd4, 0xa2,
-	0x35, 0x1c, 0x29, 0x4e, 0x5c, 0x70, 0x53, 0x5f, 0x1c, 0xd5, 0xc0, 0x36, 0x8b, 0x40, 0x07, 0x22,
-	0x22, 0x3d, 0x11, 0x70, 0xe7, 0xcf, 0x94, 0xc5, 0xa5, 0x2b, 0xa9, 0x60, 0x27, 0x8a, 0x82, 0xd7,
-	0x34, 0x18, 0x30, 0x6c, 0xb6, 0x65, 0x65, 0x20, 0xa2, 0x57, 0x22, 0xe0, 0xe8, 0x21, 0xcc, 0x8b,
-	0x78, 0xc0, 0x05, 0xf1, 0xa2, 0x1e, 0xf5, 0x43, 0xa7, 0xa4, 0x36, 0x55, 0x5e, 0xd1, 0x6a, 0x8a,
-	0x84, 0xbe, 0x80, 0xe5, 0x34, 0x0b, 0xa1, 0x81, 0x4f, 0x39, 0xe3, 0x4e, 0x79, 0x7d, 0x66, 0x73,
-	0x0e, 0xa3, 0x14, 0x6b, 0x45, 0x8f, 0xa0, 0x6f, 0x61, 0xd1, 0xa5, 0xc4, 0x65, 0xb1, 0xf0, 0xdb,
-	0xbe, 0x4b, 0x05, 0xe3, 0xce, 0xd7, 0x6a, 0x96, 0x5b, 0xd3, 0x7c, 0x59, 0x1d, 0xcb, 0xd4, 0xa8,
-	0xa0, 0x78, 0xc1, 0xa5, 0x29, 0x12, 0x47, 0xbf, 0x86, 0xb5, 0x64, 0xd9, 0xcd, 0x4e, 0x23, 0xec,
-	0x5c, 0x26, 0x5f, 0x22, 0x22, 0xe7, 0x81, 0x32, 0x68, 0xd5, 0x30, 0x98, 0x6d, 0x56, 0x57, 0xc3,
-	0xad, 0x08, 0xed, 0xc2, 0xc3, 0x44, 0xf4, 0xcc, 0x8f, 0xc5, 0x80, 0x06, 0x13, 0x20, 0xd6, 0x15,
-	0xc4, 0x3d, 0xc3, 0xf8, 0x5a, 0xf3, 0x5d, 0x46, 0x6a, 0xc0, 0x46, 0x82, 0x74, 0xf9, 0x34, 0x4a,
-	0x41, 0x3d, 0x54, 0x50, 0xf7, 0x0d, 0x67, 0x6d, 0xcc, 0x88, 0x07, 0xc1, 0x18, 0xeb, 0x11, 0x2c,
-	0xc4, 0x51, 0x24, 0x48, 0x48, 0x7b, 0x8c, 0xf7, 0xa9, 0xcb, 0x9c, 0x0d, 0x9d, 0x00, 0x24, 0x75,
-	0x3f, 0x21, 0xa2, 0x36, 0x2c, 0x05, 0x91, 0x4b, 0x03, 0x5f, 0x0c, 0x49, 0x70, 0x42, 0xb8, 0x4e,
-	0xb5, 0xce, 0x27, 0x6a, 0xbd, 0xbf, 0x7a, 0x4f, 0xba, 0x6e, 0x1a, 0xa9, 0x66, 0x44, 0xbd, 0x1d,
-	0x1a, 0xd0, 0xd0, 0x65, 0xb1, 0x49, 0xd4, 0xb8, 0x98, 0x40, 0x36, 0x4f, 0x0c, 0x09, 0x55, 0xc1,
-	0xf6, 0x42, 0x4e, 0x62, 0xd6, 0x8e, 0x19, 0xef, 0x12, 0x79, 0x56, 0x3a, 0x9f, 0x4e, 0x3d, 0xae,
-	0xbc, 0x90, 0x63, 0x2d, 0x81, 0xa9, 0x60, 0xe8, 0x07, 0x28, 0x76, 0xb7, 0xc9, 0xa0, 0xdf, 0x89,
-	0xa9, 0xc7, 0x92, 0x60, 0xfa, 0x85, 0xca, 0x3f, 0x53, 0x37, 0xc0, 0xee, 0xf6, 0xb1, 0x96, 0x33,
-	0x61, 0xb4, 0xd8, 0xbd, 0x48, 0x90, 0x3b, 0xc0, 0x0f, 0x75, 0xb8, 0xba, 0xc1, 0x80, 0x0b, 0x16,
-	0x13, 0x2e, 0xa8, 0x76, 0xa0, 0xf3, 0xb9, 0xf2, 0xdd, 0xaa, 0x61, 0xa8, 0xea, 0xf1, 0x23, 0x41,
-	0x95, 0x27, 0x65, 0xc2, 0x19, 0x85, 0xfa, 0x55, 0xd9, 0x3f, 0x57, 0xb2, 0xa3, 0x64, 0x70, 0x59,
-	0xb8, 0x06, 0xf3, 0x17, 0x36, 0xf4, 0x96, 0xda, 0xd0, 0x93, 0xd3, 0x4d, 0x6a, 0xcb, 0xe2, 0x0b,
-	0x52, 0xe8, 0x6f, 0xa0, 0x20, 0xba, 0xb1, 0xdf, 0x1e, 0x65, 0xad, 0xa7, 0xca, 0xb9, 0x9f, 0x4f,
-	0x73, 0x4b, 0x4b, 0x09, 0x99, 0x0c, 0x36, 0x2f, 0x52, 0x5f, 0xe8, 0x7b, 0xb0, 0x93, 0x7d, 0x6c,
-	0xb6, 0x05, 0x77, 0xb6, 0x3f, 0x2c, 0xda, 0xcc, 0xc6, 0x4e, 0x0e, 0x6e, 0xbc, 0xc8, 0x2f, 0x12,
-	0x10, 0x86, 0xdb, 0x26, 0xc7, 0xf4, 0xe3, 0xa8, 0xc7, 0x44, 0x97, 0x0d, 0x38, 0xe9, 0xb1, 0xb8,
-	0xc3, 0x9c, 0x67, 0x53, 0x53, 0xcd, 0x8a, 0x16, 0x3d, 0x1c, 0x49, 0xbe, 0x92, 0x82, 0xe8, 0x07,
-	0xb8, 0x7b, 0xc6, 0x62, 0xbf, 0x3d, 0x4c, 0x27, 0x08, 0x42, 0x05, 0x71, 0x03, 0x9f, 0x85, 0xc2,
-	0xf9, 0x6a, 0x2a, 0xf0, 0x9a, 0x96, 0x4f, 0x79, 0xb9, 0x22, 0xaa, 0x4a, 0x18, 0x6d, 0x43, 0xd6,
-	0xa5, 0xce, 0xaf, 0x14, 0xc4, 0xc6, 0xd4, 0x64, 0x53, 0xc1, 0x59, 0x97, 0xa2, 0x13, 0x58, 0x62,
-	0xe7, 0x82, 0x85, 0x5c, 0x06, 0x71, 0x3f, 0x8e, 0xce, 0x7c, 0x8f, 0xc5, 0xdc, 0xf9, 0xb5, 0xf2,
-	0xe1, 0xd4, 0x03, 0xb3, 0x9e, 0x88, 0x1e, 0x1a, 0x49, 0x8c, 0xd8, 0x65, 0x12, 0x47, 0xbf, 0x85,
-	0x62, 0x92, 0x32, 0xc6, 0x1a, 0xfe, 0x42, 0x99, 0xf9, 0xc5, 0x34, 0x0d, 0x35, 0x2d, 0x38, 0x02,
-	0xc3, 0xb6, 0x77, 0x89, 0x82, 0x3c, 0x58, 0xf2, 0x7c, 0xee, 0x46, 0x67, 0x2c, 0x1e, 0x8e, 0x6a,
-	0x13, 0xee, 0xfc, 0x46, 0x4d, 0xe1, 0x59, 0x59, 0xd7, 0xc6, 0xe5, 0x74, 0x6d, 0x5c, 0xee, 0x9f,
-	0x76, 0x24, 0x81, 0x97, 0x65, 0x6d, 0x5c, 0x3e, 0x7b, 0x5a, 0x6e, 0xd2, 0x13, 0x16, 0x24, 0x05,
-	0x0c, 0x46, 0x23, 0xbc, 0x84, 0xc4, 0x11, 0x03, 0xd4, 0xa7, 0xa2, 0x4b, 0x42, 0x59, 0x68, 0x04,
-	0xfe, 0x8f, 0x2a, 0xfa, 0x9d, 0xbf, 0xbc, 0x90, 0x83, 0xde, 0x39, 0x0b, 0x75, 0x04, 0x1f, 0x52,
-	0xd1, 0xdd, 0x4f, 0x4b, 0xe3, 0x62, 0xff, 0x32, 0xa9, 0xf4, 0x4f, 0x19, 0x58, 0x99, 0x78, 0xa6,
-	0xa2, 0x7d, 0xc8, 0xa9, 0xe2, 0x2e, 0xa3, 0x72, 0xc9, 0xd7, 0x3f, 0xeb, 0x60, 0x2e, 0xab, 0x0a,
-	0x4f, 0xe1, 0x6c, 0xd4, 0x20, 0xa7, 0x0a, 0xbb, 0x22, 0x14, 0x70, 0xfd, 0xe5, 0xde, 0x51, 0x0b,
-	0x7f, 0x47, 0x0e, 0xf6, 0x9b, 0xdf, 0xd9, 0x37, 0x50, 0x01, 0xe6, 0x2a, 0xcd, 0xe6, 0xc1, 0x1b,
-	0x52, 0xd9, 0xff, 0xce, 0xce, 0x6c, 0xe4, 0xac, 0xac, 0x9d, 0x7d, 0xb2, 0xfc, 0x7a, 0x0f, 0xb7,
-	0x8e, 0x2b, 0x4d, 0x72, 0x54, 0xc7, 0xaf, 0xf7, 0xaa, 0x75, 0xc5, 0x5c, 0xea, 0xc0, 0xe2, 0xa5,
-	0x63, 0x0b, 0x21, 0x98, 0xe9, 0xb3, 0x9e, 0xb2, 0x73, 0x6e, 0xf7, 0x06, 0x96, 0x1f, 0xe8, 0x73,
-	0x28, 0xf2, 0xbe, 0xdf, 0x6e, 0x33, 0x72, 0x32, 0x08, 0xbd, 0x80, 0x91, 0x41, 0x1c, 0x38, 0x59,
-	0xc3, 0xb1, 0xa8, 0x87, 0x76, 0xd4, 0xc8, 0x71, 0x1c, 0xec, 0x20, 0xb0, 0xd3, 0xe1, 0xe1, 0x51,
-	0x41, 0x4b, 0xbf, 0x87, 0xf9, 0x74, 0x1e, 0x40, 0x9f, 0xc2, 0x82, 0x4c, 0xd0, 0x24, 0xf0, 0x7b,
-	0xbe, 0x50, 0x70, 0x19, 0x5d, 0x4d, 0x4b, 0x6a, 0x53, 0x12, 0x8f, 0xe3, 0x00, 0xbd, 0x04, 0x94,
-	0xe2, 0x4a, 0x2e, 0x0d, 0xd9, 0x69, 0x49, 0xdd, 0x1e, 0x81, 0x98, 0xcb, 0x42, 0xe9, 0x9f, 0x33,
-	0xb0, 0x78, 0x29, 0x63, 0xa0, 0x16, 0x58, 0xa3, 0xa4, 0x93, 0x51, 0x90, 0xcf, 0xaf, 0x99, 0x74,
-	0xca, 0xa3, 0xec, 0x33, 0x42, 0x42, 0xcb, 0x70, 0xb3, 0x1b, 0x71, 0xc1, 0x9d, 0xac, 0x3a, 0x43,
-	0xf5, 0x47, 0x69, 0x0b, 0xac, 0x91, 0xde, 0x4f, 0xa0, 0x90, 0x64, 0x70, 0x75, 0x88, 0x29, 0xe5,
-	0x16, 0x9e, 0x37, 0x44, 0x75, 0xea, 0x95, 0xfe, 0x98, 0x81, 0x6c, 0xb5, 0x82, 0x1c, 0x98, 0xa5,
-	0x9e, 0x27, 0xcb, 0x73, 0xe3, 0x9f, 0xe4, 0x13, 0x1d, 0xc0, 0xbc, 0x08, 0xf8, 0x38, 0x6d, 0x66,
-	0x2f, 0x24, 0xe3, 0x89, 0xb7, 0x1f, 0x95, 0x66, 0x5a, 0xcd, 0xa3, 0x91, 0xd5, 0x79, 0x11, 0xf0,
-	0x91, 0x59, 0x3b, 0xb0, 0x18, 0xb3, 0xbf, 0x1d, 0x30, 0x3e, 0x76, 0xf4, 0xcc, 0xd4, 0xd3, 0xd3,
-	0x48, 0x24, 0x77, 0xb2, 0x07, 0x90, 0x57, 0xfa, 0x3d, 0xc2, 0x7d, 0x8f, 0xa9, 0xeb, 0xa7, 0x85,
-	0x41, 0x93, 0x8e, 0x7c, 0x8f, 0x95, 0xfe, 0xf5, 0x2e, 0x14, 0xaf, 0x64, 0x1d, 0x84, 0x20, 0xa7,
-	0x8e, 0x31, 0x3d, 0x45, 0xf5, 0x1b, 0xfd, 0x5d, 0x06, 0x96, 0x75, 0x69, 0xcd, 0xce, 0x85, 0x2c,
-	0x13, 0xbb, 0x3f, 0xaa, 0xeb, 0xaa, 0x99, 0xe8, 0xb7, 0xd7, 0xce, 0x6d, 0x65, 0x55, 0x87, 0x4b,
-	0x72, 0x1c, 0xd2, 0xa0, 0x32, 0x10, 0xdd, 0x28, 0x36, 0x61, 0xab, 0x2e, 0xbc, 0x86, 0x6d, 0xf7,
-	0x06, 0x2e, 0x32, 0xc3, 0x29, 0x99, 0x7e, 0x94, 0x83, 0x13, 0xad, 0xe9, 0xc4, 0x7d, 0xd7, 0xb8,
-	0xe8, 0xa3, 0x5a, 0xf3, 0x32, 0xee, 0xbb, 0xef, 0xb4, 0x46, 0x0e, 0x22, 0x0a, 0xb7, 0x7e, 0xf4,
-	0xfb, 0xa7, 0x7e, 0xa8, 0x3c, 0x9c, 0xdf, 0x7e, 0x79, 0x7d, 0xf5, 0xdf, 0x2b, 0x79, 0x73, 0x97,
-	0x4b, 0x69, 0x33, 0xc0, 0xe8, 0x77, 0x30, 0x17, 0xf8, 0x9d, 0xae, 0xe0, 0x82, 0xf5, 0x55, 0x73,
-	0x60, 0x7c, 0xb3, 0xbe, 0x86, 0x96, 0x66, 0x02, 0x71, 0x55, 0xd1, 0x18, 0x1e, 0x79, 0x30, 0x2b,
-	0x73, 0x84, 0x17, 0x75, 0x4c, 0x7b, 0x61, 0xf7, 0xfa, 0x9a, 0x6a, 0x1a, 0xe0, 0xaa, 0x9e, 0x04,
-	0x1a, 0xf9, 0x90, 0xe7, 0x82, 0xba, 0xa7, 0x5e, 0xec, 0x9f, 0xb1, 0x58, 0x5d, 0xde, 0xf3, 0xdb,
+	0x72, 0x16, 0x40, 0x48, 0x6c, 0x26, 0x08, 0xb2, 0x51, 0x14, 0xa9, 0x26, 0x24, 0x51, 0x14, 0x67,
+	0xa4, 0xe1, 0xca, 0x63, 0x70, 0x44, 0xcd, 0xce, 0x6a, 0x67, 0x6d, 0x87, 0x41, 0x00, 0x12, 0x89,
+	0x81, 0x48, 0xba, 0x08, 0x4a, 0xf3, 0x13, 0x1b, 0x15, 0xc5, 0xee, 0x02, 0xd0, 0xcb, 0x46, 0x37,
+	0xdc, 0x55, 0xa0, 0x88, 0x89, 0xd8, 0xa3, 0x4f, 0x3e, 0xf9, 0xe8, 0x07, 0xf0, 0xc9, 0x61, 0x1f,
+	0xfc, 0x14, 0x8e, 0xd8, 0x8b, 0x0f, 0x7b, 0x74, 0x38, 0x1c, 0x73, 0x76, 0x84, 0x5f, 0xc1, 0x51,
+	0x3f, 0x0d, 0x34, 0x49, 0x48, 0x10, 0x27, 0x66, 0xbc, 0x37, 0x74, 0x56, 0xe6, 0x97, 0x59, 0x59,
+	0x99, 0x59, 0x59, 0x55, 0x80, 0x52, 0x8f, 0xf1, 0xee, 0xd6, 0xd9, 0x53, 0x1a, 0xf4, 0xbb, 0xf4,
+	0xe9, 0x96, 0x1b, 0x85, 0x6d, 0xbf, 0x53, 0xee, 0xc7, 0x91, 0x88, 0xd0, 0x92, 0xcf, 0x85, 0x1f,
+	0x95, 0x25, 0x47, 0x39, 0xe1, 0x28, 0xad, 0x75, 0xa2, 0xa8, 0x13, 0xb0, 0x2d, 0xc5, 0x72, 0x32,
+	0x68, 0x6f, 0x79, 0x83, 0x98, 0x0a, 0x3f, 0x0a, 0xb5, 0xd0, 0xd5, 0xf1, 0xb7, 0x31, 0xed, 0xf7,
+	0x59, 0xcc, 0xcd, 0xf8, 0xea, 0x45, 0x85, 0xfd, 0x38, 0x3a, 0x1f, 0x9a, 0xa1, 0x27, 0x21, 0x13,
+	0x6f, 0xa3, 0xf8, 0xd4, 0x0f, 0x3b, 0x09, 0xc3, 0xb3, 0x2d, 0x8f, 0x71, 0xe1, 0x87, 0x4a, 0x03,
+	0x89, 0x07, 0x01, 0x33, 0xbc, 0x9f, 0x9f, 0x3e, 0xe7, 0x65, 0x3f, 0xda, 0xa2, 0x7d, 0xbf, 0x47,
+	0xdd, 0xae, 0x1f, 0xb2, 0x78, 0xb8, 0xd5, 0x3f, 0xed, 0x48, 0x02, 0xdf, 0xea, 0x31, 0x41, 0xb7,
+	0xce, 0x9e, 0x6e, 0x75, 0x58, 0xc8, 0x62, 0x2a, 0x98, 0xa7, 0xa5, 0x36, 0xfe, 0xab, 0x0a, 0xf0,
+	0x8a, 0xf1, 0x6e, 0x55, 0x4d, 0x13, 0x3d, 0x81, 0xa2, 0xd2, 0x4f, 0x02, 0x9f, 0x0b, 0x16, 0x92,
+	0x7e, 0x14, 0x0b, 0x27, 0xb7, 0x9e, 0xd9, 0xbc, 0x89, 0x17, 0xd5, 0x40, 0x53, 0xd1, 0x0f, 0xa3,
+	0x58, 0xa0, 0xc7, 0xa0, 0x49, 0xa4, 0x2b, 0x44, 0x5f, 0x73, 0xde, 0x54, 0x9c, 0x05, 0x45, 0xde,
+	0x15, 0xa2, 0xaf, 0xf8, 0x76, 0x60, 0xd1, 0x8d, 0xc2, 0x90, 0xb9, 0x82, 0x08, 0xbf, 0xc7, 0xa2,
+	0x81, 0x70, 0x6e, 0xad, 0x67, 0x36, 0xf3, 0xdb, 0xab, 0x65, 0xed, 0x99, 0x72, 0xe2, 0x99, 0x72,
+	0xcd, 0x78, 0x0e, 0x2f, 0x18, 0x89, 0x96, 0x16, 0x40, 0x6f, 0xa0, 0xa4, 0x98, 0xdc, 0x28, 0x20,
+	0x1e, 0x13, 0xcc, 0x55, 0xb3, 0x4f, 0xe0, 0x9e, 0x4c, 0x83, 0x73, 0x12, 0xe1, 0x5a, 0x22, 0x9b,
+	0x00, 0x47, 0x50, 0x10, 0x6e, 0x9f, 0x9c, 0x32, 0xd6, 0xa7, 0x81, 0x7f, 0xc6, 0x9c, 0x7b, 0x0a,
+	0xab, 0x51, 0xd6, 0x2b, 0x3d, 0xf6, 0x7f, 0xb2, 0xde, 0xcf, 0xca, 0x55, 0x6d, 0x9a, 0x1f, 0x85,
+	0x87, 0x51, 0x14, 0x1c, 0x31, 0x21, 0xfc, 0xb0, 0xc3, 0xcb, 0xad, 0xea, 0xe1, 0xf8, 0xb7, 0xdb,
+	0xff, 0x2a, 0x41, 0xc4, 0xf3, 0x22, 0xf5, 0x85, 0x3e, 0x82, 0x82, 0x1f, 0x76, 0x62, 0xc6, 0x39,
+	0x71, 0x03, 0xca, 0xb9, 0x33, 0xbb, 0x9e, 0xd9, 0x9c, 0xc3, 0xf3, 0x86, 0x58, 0x95, 0x34, 0xf4,
+	0x09, 0x2c, 0x26, 0x4c, 0x9c, 0xc5, 0x67, 0xbe, 0xcb, 0x1c, 0x4b, 0xb1, 0x2d, 0x18, 0xf2, 0x91,
+	0xa6, 0xa2, 0x1e, 0xdc, 0x19, 0xa1, 0x45, 0xa1, 0x88, 0xa3, 0x20, 0x60, 0x31, 0xe9, 0x45, 0x1e,
+	0x73, 0xe6, 0xd6, 0x33, 0x9b, 0x0b, 0xdb, 0xbf, 0x2c, 0x4f, 0x08, 0xd9, 0xf2, 0x78, 0xc5, 0xcb,
+	0x7b, 0x46, 0xef, 0x48, 0xfa, 0x55, 0xe4, 0x31, 0xbc, 0xec, 0x4f, 0x22, 0xa3, 0x5f, 0x80, 0x3d,
+	0xb6, 0x2b, 0x60, 0xae, 0x88, 0x62, 0xe7, 0x73, 0x65, 0xd8, 0xe2, 0xc8, 0x30, 0x4d, 0x46, 0x8f,
+	0x60, 0x81, 0x85, 0xf4, 0x24, 0x60, 0x44, 0xc4, 0xd4, 0xf5, 0xc3, 0x8e, 0x33, 0xbf, 0x9e, 0xd9,
+	0xb4, 0x70, 0x41, 0x53, 0x5b, 0x9a, 0x28, 0x83, 0x88, 0xba, 0xae, 0x04, 0x0c, 0xa2, 0x0e, 0x69,
+	0xfb, 0x01, 0x73, 0x0a, 0x0a, 0xb0, 0xa0, 0xc9, 0xcd, 0xa8, 0xf3, 0xc2, 0x0f, 0x98, 0x0c, 0xcc,
+	0x34, 0x5f, 0x14, 0xf7, 0xa8, 0x70, 0x1c, 0xad, 0x7a, 0xcc, 0xa9, 0xc8, 0x88, 0xc2, 0x52, 0x8a,
+	0x97, 0x85, 0x6e, 0xe4, 0x49, 0xfd, 0x77, 0x95, 0x43, 0x9e, 0x4e, 0x73, 0x48, 0x25, 0x41, 0xab,
+	0x1b, 0x41, 0x5c, 0xa4, 0x97, 0x49, 0xa8, 0x06, 0x0f, 0xcc, 0xec, 0x58, 0x78, 0x16, 0x0d, 0x49,
+	0x4a, 0x5f, 0xb2, 0x60, 0x9b, 0x6a, 0xba, 0x77, 0x35, 0x5b, 0x5d, 0x72, 0x8d, 0x90, 0x93, 0xd5,
+	0xfb, 0x0d, 0x94, 0x3c, 0x9f, 0xa7, 0x60, 0x74, 0xd6, 0xb1, 0x58, 0x02, 0x39, 0xcf, 0x15, 0xc0,
+	0x1d, 0xc3, 0xa1, 0x10, 0x9a, 0x66, 0xbc, 0x19, 0x75, 0xd0, 0x4b, 0x58, 0xf0, 0x58, 0x9b, 0x0e,
+	0x02, 0x41, 0x74, 0x8d, 0x72, 0x16, 0x54, 0xe8, 0xae, 0x4f, 0x9c, 0xe0, 0xa1, 0x4c, 0x49, 0x3d,
+	0x43, 0x5c, 0x30, 0x72, 0x26, 0xe7, 0x7b, 0x70, 0x27, 0x1a, 0x88, 0x93, 0x68, 0x10, 0x7a, 0x72,
+	0xad, 0xda, 0x6d, 0xdf, 0x25, 0xfd, 0x28, 0xf0, 0xdd, 0xa1, 0x53, 0x54, 0x88, 0x53, 0x63, 0xe8,
+	0xc0, 0x88, 0xb7, 0xb4, 0xf4, 0xa1, 0x12, 0xc6, 0xcb, 0xd1, 0x24, 0x32, 0xda, 0x85, 0x05, 0x6d,
+	0x2f, 0xe1, 0xd1, 0x20, 0x76, 0x19, 0x77, 0x56, 0xd6, 0x67, 0x36, 0xf3, 0xdb, 0x0f, 0x27, 0x6a,
+	0xd1, 0x1a, 0x8e, 0x14, 0x27, 0x2e, 0xb8, 0xa9, 0x2f, 0x8e, 0x6a, 0x60, 0x9b, 0x45, 0xa0, 0x03,
+	0x11, 0x91, 0x9e, 0x08, 0xb8, 0xf3, 0x67, 0xca, 0xe2, 0xd2, 0x95, 0x52, 0xb0, 0x13, 0x45, 0xc1,
+	0x6b, 0x1a, 0x0c, 0x18, 0x36, 0x61, 0x59, 0x19, 0x88, 0xe8, 0x95, 0x08, 0x38, 0x7a, 0x08, 0xf3,
+	0x22, 0x1e, 0x70, 0x41, 0xbc, 0xa8, 0x47, 0xfd, 0xd0, 0x29, 0xa9, 0xa0, 0xca, 0x2b, 0x5a, 0x4d,
+	0x91, 0xd0, 0x67, 0x70, 0x3b, 0xcd, 0x42, 0x68, 0xe0, 0x53, 0xce, 0xb8, 0x53, 0x5e, 0x9f, 0xd9,
+	0x9c, 0xc3, 0x28, 0xc5, 0x5a, 0xd1, 0x23, 0xe8, 0x6b, 0x58, 0x74, 0x29, 0x71, 0x59, 0x2c, 0xfc,
+	0xb6, 0xef, 0x52, 0xc1, 0xb8, 0xf3, 0xa5, 0x9a, 0xe5, 0xd6, 0x34, 0x5f, 0x56, 0xc7, 0x32, 0x35,
+	0x2a, 0x28, 0x5e, 0x70, 0x69, 0x8a, 0xc4, 0xd1, 0xaf, 0x61, 0x35, 0x59, 0x76, 0x13, 0x69, 0x84,
+	0x9d, 0xcb, 0xe2, 0x4b, 0x44, 0xe4, 0x3c, 0x50, 0x06, 0xad, 0x18, 0x06, 0x13, 0x66, 0x75, 0x35,
+	0xdc, 0x8a, 0xd0, 0x2e, 0x3c, 0x4c, 0x44, 0xcf, 0xfc, 0x58, 0x0c, 0x68, 0x30, 0x01, 0x62, 0x5d,
+	0x41, 0xdc, 0x37, 0x8c, 0xaf, 0x35, 0xdf, 0x65, 0xa4, 0x06, 0x6c, 0x24, 0x48, 0x97, 0x77, 0xa3,
+	0x14, 0xd4, 0x43, 0x05, 0xb5, 0x66, 0x38, 0x6b, 0x63, 0x46, 0x3c, 0x08, 0xc6, 0x58, 0x8f, 0x60,
+	0x21, 0x8e, 0x22, 0x41, 0x42, 0xda, 0x63, 0xbc, 0x4f, 0x5d, 0xe6, 0x6c, 0xe8, 0x02, 0x20, 0xa9,
+	0xfb, 0x09, 0x11, 0xb5, 0x61, 0x29, 0x88, 0x5c, 0x1a, 0xf8, 0x62, 0x48, 0x82, 0x13, 0xc2, 0x75,
+	0xa9, 0x75, 0x3e, 0x52, 0xeb, 0xfd, 0xc5, 0x7b, 0xca, 0x75, 0xd3, 0x48, 0x35, 0x23, 0xea, 0xed,
+	0xd0, 0x80, 0x86, 0x2e, 0x8b, 0x4d, 0xa1, 0xc6, 0xc5, 0x04, 0xb2, 0x79, 0x62, 0x48, 0xa8, 0x0a,
+	0xb6, 0x17, 0x72, 0x12, 0xb3, 0x76, 0xcc, 0x78, 0x97, 0xc8, 0xbd, 0xd2, 0xf9, 0x78, 0xea, 0x76,
+	0xe5, 0x85, 0x1c, 0x6b, 0x09, 0x4c, 0x05, 0x43, 0xdf, 0x41, 0xb1, 0xbb, 0x4d, 0x06, 0xfd, 0x4e,
+	0x4c, 0x3d, 0x96, 0x24, 0xd3, 0x2f, 0x54, 0xfd, 0x99, 0x1a, 0x00, 0xbb, 0xdb, 0xc7, 0x5a, 0xce,
+	0xa4, 0xd1, 0x62, 0xf7, 0x22, 0x41, 0x46, 0x80, 0x1f, 0xea, 0x74, 0x75, 0x83, 0x01, 0x17, 0x2c,
+	0x26, 0x5c, 0x50, 0xed, 0x40, 0xe7, 0x53, 0xe5, 0xbb, 0x15, 0xc3, 0x50, 0xd5, 0xe3, 0x47, 0x82,
+	0x2a, 0x4f, 0xca, 0x82, 0x33, 0x4a, 0xf5, 0xab, 0xb2, 0x7f, 0xae, 0x64, 0x47, 0xc5, 0xe0, 0xb2,
+	0x70, 0x0d, 0xe6, 0x2f, 0x04, 0xf4, 0x96, 0x0a, 0xe8, 0xc9, 0xe5, 0x26, 0x15, 0xb2, 0xf8, 0x82,
+	0x14, 0xfa, 0x1b, 0x28, 0x88, 0x6e, 0xec, 0xb7, 0x47, 0x55, 0xeb, 0xa9, 0x72, 0xee, 0xa7, 0xd3,
+	0xdc, 0xd2, 0x52, 0x42, 0xa6, 0x82, 0xcd, 0x8b, 0xd4, 0x17, 0xfa, 0x16, 0xec, 0x24, 0x8e, 0x4d,
+	0x58, 0x70, 0x67, 0xfb, 0xc3, 0xb2, 0xcd, 0x04, 0x76, 0xb2, 0x71, 0xe3, 0x45, 0x7e, 0x91, 0x80,
+	0x30, 0xdc, 0x31, 0x35, 0xa6, 0x1f, 0x47, 0x3d, 0x26, 0xba, 0x6c, 0xc0, 0x49, 0x8f, 0xc5, 0x1d,
+	0xe6, 0x3c, 0x9b, 0x5a, 0x6a, 0x96, 0xb5, 0xe8, 0xe1, 0x48, 0xf2, 0x95, 0x14, 0x44, 0xdf, 0xc1,
+	0xbd, 0x33, 0x16, 0xfb, 0xed, 0x61, 0xba, 0x40, 0x10, 0x2a, 0x88, 0x1b, 0xf8, 0x2c, 0x14, 0xce,
+	0x17, 0x53, 0x81, 0x57, 0xb5, 0x7c, 0xca, 0xcb, 0x15, 0x51, 0x55, 0xc2, 0x68, 0x1b, 0xb2, 0x2e,
+	0x75, 0x7e, 0xa5, 0x20, 0x36, 0xa6, 0x16, 0x9b, 0x0a, 0xce, 0xba, 0x14, 0x9d, 0xc0, 0x12, 0x3b,
+	0x17, 0x2c, 0xe4, 0x32, 0x89, 0xfb, 0x71, 0x74, 0xe6, 0x7b, 0x2c, 0xe6, 0xce, 0xaf, 0x95, 0x0f,
+	0xa7, 0x6e, 0x98, 0xf5, 0x44, 0xf4, 0xd0, 0x48, 0x62, 0xc4, 0x2e, 0x93, 0x38, 0xfa, 0x2d, 0x14,
+	0x93, 0x92, 0x31, 0xd6, 0xf0, 0x17, 0xca, 0xcc, 0xcf, 0xa6, 0x69, 0xa8, 0x69, 0xc1, 0x11, 0x18,
+	0xb6, 0xbd, 0x4b, 0x14, 0xe4, 0xc1, 0x92, 0xe7, 0x73, 0x37, 0x3a, 0x63, 0xf1, 0x70, 0xd4, 0x9b,
+	0x70, 0xe7, 0x37, 0x6a, 0x0a, 0xcf, 0xca, 0xba, 0x37, 0x2e, 0xa7, 0x7b, 0xe3, 0x72, 0xff, 0xb4,
+	0x23, 0x09, 0xbc, 0x2c, 0x7b, 0xe3, 0xf2, 0xd9, 0xd3, 0x72, 0x93, 0x9e, 0xb0, 0x20, 0x69, 0x60,
+	0x30, 0x1a, 0xe1, 0x25, 0x24, 0x8e, 0x18, 0xa0, 0x3e, 0x15, 0x5d, 0x12, 0xca, 0x46, 0x23, 0xf0,
+	0xbf, 0x57, 0xd9, 0xef, 0xfc, 0xe5, 0x85, 0x1a, 0xf4, 0xce, 0x59, 0xa8, 0x2d, 0xf8, 0x90, 0x8a,
+	0xee, 0x7e, 0x5a, 0x1a, 0x17, 0xfb, 0x97, 0x49, 0xa5, 0x7f, 0xc9, 0xc0, 0xf2, 0xc4, 0x3d, 0x15,
+	0xed, 0x43, 0x4e, 0x35, 0x77, 0x19, 0x55, 0x4b, 0xbe, 0xfc, 0x51, 0x1b, 0x73, 0x59, 0x75, 0x78,
+	0x0a, 0x67, 0xa3, 0x06, 0x39, 0xd5, 0xd8, 0x15, 0xa1, 0x80, 0xeb, 0x2f, 0xf7, 0x8e, 0x5a, 0xf8,
+	0x1b, 0x72, 0xb0, 0xdf, 0xfc, 0xc6, 0xbe, 0x81, 0x0a, 0x30, 0x57, 0x69, 0x36, 0x0f, 0xde, 0x90,
+	0xca, 0xfe, 0x37, 0x76, 0x66, 0x23, 0x67, 0x65, 0xed, 0xec, 0x93, 0xdb, 0xaf, 0xf7, 0x70, 0xeb,
+	0xb8, 0xd2, 0x24, 0x47, 0x75, 0xfc, 0x7a, 0xaf, 0x5a, 0x57, 0xcc, 0xa5, 0x0e, 0x2c, 0x5e, 0xda,
+	0xb6, 0x10, 0x82, 0x99, 0x3e, 0xeb, 0x29, 0x3b, 0xe7, 0x76, 0x6f, 0x60, 0xf9, 0x81, 0x3e, 0x85,
+	0x22, 0xef, 0xfb, 0xed, 0x36, 0x23, 0x27, 0x83, 0xd0, 0x0b, 0x18, 0x19, 0xc4, 0x81, 0x93, 0x35,
+	0x1c, 0x8b, 0x7a, 0x68, 0x47, 0x8d, 0x1c, 0xc7, 0xc1, 0x0e, 0x02, 0x3b, 0x9d, 0x1e, 0x1e, 0x15,
+	0xb4, 0xf4, 0x7b, 0x98, 0x4f, 0xd7, 0x01, 0xf4, 0x31, 0x2c, 0xc8, 0x02, 0x4d, 0x02, 0xbf, 0xe7,
+	0x0b, 0x05, 0x97, 0xd1, 0xdd, 0xb4, 0xa4, 0x36, 0x25, 0xf1, 0x38, 0x0e, 0xd0, 0x4b, 0x40, 0x29,
+	0xae, 0xe4, 0xd0, 0x90, 0x9d, 0x56, 0xd4, 0xed, 0x11, 0x88, 0x39, 0x2c, 0x94, 0xfe, 0x35, 0x03,
+	0x8b, 0x97, 0x2a, 0x06, 0x6a, 0x81, 0x35, 0x2a, 0x3a, 0x19, 0x05, 0xf9, 0xfc, 0x9a, 0x45, 0xa7,
+	0x3c, 0xaa, 0x3e, 0x23, 0x24, 0x74, 0x1b, 0x6e, 0x76, 0x23, 0x2e, 0xb8, 0x93, 0x55, 0x7b, 0xa8,
+	0xfe, 0x28, 0x6d, 0x81, 0x35, 0xd2, 0xfb, 0x11, 0x14, 0x92, 0x0a, 0xae, 0x36, 0x31, 0xa5, 0xdc,
+	0xc2, 0xf3, 0x86, 0xa8, 0x76, 0xbd, 0xd2, 0x1f, 0x33, 0x90, 0xad, 0x56, 0x90, 0x03, 0xb3, 0xd4,
+	0xf3, 0x64, 0x7b, 0x6e, 0xfc, 0x93, 0x7c, 0xa2, 0x03, 0x98, 0x17, 0x01, 0x1f, 0x97, 0xcd, 0xec,
+	0x85, 0x62, 0x3c, 0xf1, 0xf4, 0xa3, 0xca, 0x4c, 0xab, 0x79, 0x34, 0xb2, 0x3a, 0x2f, 0x02, 0x3e,
+	0x32, 0x6b, 0x07, 0x16, 0x63, 0xf6, 0xb7, 0x03, 0xc6, 0xc7, 0x8e, 0x9e, 0x99, 0xba, 0x7b, 0x1a,
+	0x89, 0xe4, 0x4c, 0xf6, 0x00, 0xf2, 0x4a, 0xbf, 0x47, 0xb8, 0xef, 0x31, 0x75, 0xfc, 0xb4, 0x30,
+	0x68, 0xd2, 0x91, 0xef, 0xb1, 0xd2, 0x3f, 0xad, 0x41, 0xf1, 0x4a, 0xd5, 0x41, 0x08, 0x72, 0x6a,
+	0x1b, 0xd3, 0x53, 0x54, 0xbf, 0xd1, 0xdf, 0x67, 0xe0, 0xb6, 0x6e, 0xad, 0xd9, 0xb9, 0x90, 0x6d,
+	0x62, 0xf7, 0x7b, 0x75, 0x5c, 0x35, 0x13, 0xfd, 0xfa, 0xda, 0xb5, 0xad, 0xac, 0xfa, 0x70, 0x49,
+	0x8e, 0x43, 0x1a, 0x54, 0x06, 0xa2, 0x1b, 0xc5, 0x26, 0x6d, 0xd5, 0x81, 0xd7, 0xb0, 0xed, 0xde,
+	0xc0, 0x45, 0x66, 0x38, 0x25, 0xd3, 0xf7, 0x72, 0x70, 0xa2, 0x35, 0x9d, 0xb8, 0xef, 0x1a, 0x17,
+	0xfd, 0xa4, 0xd6, 0xbc, 0x8c, 0xfb, 0xee, 0x3b, 0xad, 0x91, 0x83, 0x88, 0xc2, 0xad, 0xef, 0xfd,
+	0xfe, 0xa9, 0x1f, 0x2a, 0x0f, 0xe7, 0xb7, 0x5f, 0x5e, 0x5f, 0xfd, 0xb7, 0x4a, 0xde, 0x9c, 0xe5,
+	0x52, 0xda, 0x0c, 0x30, 0xfa, 0x1d, 0xcc, 0x05, 0x7e, 0xa7, 0x2b, 0xb8, 0x60, 0x7d, 0x75, 0x39,
+	0x30, 0x3e, 0x59, 0x5f, 0x43, 0x4b, 0x33, 0x81, 0xb8, 0xaa, 0x68, 0x0c, 0x8f, 0x3c, 0x98, 0x95,
+	0x35, 0xc2, 0x8b, 0x3a, 0xe6, 0x7a, 0x61, 0xf7, 0xfa, 0x9a, 0x6a, 0x1a, 0xe0, 0xaa, 0x9e, 0x04,
+	0x1a, 0xf9, 0x90, 0xe7, 0x82, 0xba, 0xa7, 0x5e, 0xec, 0x9f, 0xb1, 0x58, 0x1d, 0xde, 0xf3, 0xdb,
 	0xf5, 0xeb, 0x6b, 0x3a, 0x1a, 0x83, 0xa4, 0xd4, 0xa4, 0xb1, 0x51, 0x0c, 0x10, 0xf5, 0x59, 0xe8,
-	0xb2, 0x90, 0x0f, 0xb8, 0xba, 0xff, 0xe7, 0xb7, 0x0f, 0xaf, 0xaf, 0xe9, 0xa0, 0xcf, 0xc2, 0xaa,
-	0xc2, 0xa8, 0x74, 0x64, 0xe4, 0x5e, 0x99, 0x5b, 0x4a, 0x0b, 0xea, 0x01, 0xf0, 0xd3, 0xe1, 0x5b,
-	0x1a, 0xc8, 0xa0, 0x57, 0x2d, 0x84, 0xfc, 0xf6, 0x37, 0x3f, 0x63, 0x76, 0xa7, 0xc3, 0x37, 0x1a,
-	0x63, 0x82, 0xba, 0xb1, 0x82, 0xd2, 0x3f, 0x66, 0xe0, 0xd1, 0xbb, 0xb7, 0x30, 0xd6, 0x69, 0x61,
-	0x27, 0xf2, 0x86, 0xf2, 0xfe, 0xdf, 0xa3, 0xe7, 0x24, 0xc9, 0x2d, 0x27, 0x43, 0x59, 0x81, 0xca,
-	0x48, 0x2f, 0xe0, 0xc5, 0x1e, 0x3d, 0x4f, 0x58, 0x25, 0x19, 0x6d, 0xc3, 0x0a, 0x0d, 0x82, 0xe8,
-	0x2d, 0xe9, 0xd3, 0x58, 0xf8, 0x34, 0x20, 0x3d, 0xc6, 0x39, 0xed, 0x30, 0x15, 0xf4, 0x16, 0x5e,
-	0x52, 0x83, 0x87, 0x7a, 0xec, 0x95, 0x1e, 0x42, 0x1b, 0x50, 0xe8, 0x53, 0xf7, 0x94, 0x50, 0x6e,
-	0xb0, 0x67, 0x14, 0x6f, 0x5e, 0x12, 0x2b, 0x5c, 0xe1, 0x96, 0xfe, 0x65, 0x16, 0x1e, 0x7f, 0x58,
-	0xf8, 0xcb, 0x8c, 0x9b, 0xf4, 0x01, 0x4c, 0xc6, 0x35, 0x9f, 0x32, 0x4b, 0xa9, 0x56, 0x59, 0x56,
-	0xd9, 0xae, 0x7e, 0xa3, 0x67, 0x30, 0x9b, 0x24, 0xcb, 0xb9, 0x69, 0xc9, 0x32, 0xe1, 0x94, 0x59,
-	0x52, 0xd5, 0x22, 0xfd, 0x98, 0xb5, 0xfd, 0x73, 0x65, 0xef, 0x1c, 0x06, 0x49, 0x3a, 0x54, 0x14,
-	0x74, 0x07, 0xe6, 0xda, 0xd4, 0x0f, 0x88, 0x5c, 0x5e, 0x93, 0x44, 0x2d, 0x49, 0x90, 0x1b, 0x02,
-	0x3d, 0x86, 0x45, 0x59, 0xf8, 0x0f, 0x38, 0x89, 0x42, 0xc2, 0xe2, 0x38, 0x8a, 0x55, 0x7c, 0xce,
-	0xe1, 0x82, 0x26, 0x1f, 0x84, 0x75, 0x49, 0x44, 0xbf, 0x02, 0xc7, 0x0f, 0xdd, 0x60, 0xe0, 0x31,
-	0xd2, 0x65, 0x54, 0x96, 0x5a, 0xc4, 0x0f, 0x89, 0xdb, 0x65, 0xee, 0xa9, 0x73, 0x4b, 0x9d, 0x4d,
-	0x2b, 0x66, 0x7c, 0x57, 0x0f, 0xef, 0x85, 0x55, 0x39, 0x88, 0x5e, 0xc0, 0x7a, 0x22, 0x98, 0x2c,
-	0xda, 0x15, 0x00, 0x50, 0x00, 0x77, 0x0d, 0x9f, 0x59, 0xc3, 0x4b, 0x38, 0x7f, 0xc8, 0xc0, 0x27,
-	0x09, 0x10, 0xf5, 0x3c, 0x5f, 0x3a, 0x81, 0x06, 0x57, 0xb1, 0xf2, 0xaa, 0xd2, 0xfb, 0xfd, 0x9f,
-	0x2a, 0xa1, 0x97, 0xf7, 0xb4, 0x0d, 0x95, 0x91, 0x09, 0x17, 0xed, 0xac, 0x87, 0x22, 0x1e, 0xe2,
-	0x07, 0xfe, 0xfb, 0xb9, 0xd0, 0x3f, 0x64, 0xe0, 0xde, 0x65, 0xb7, 0x9c, 0x44, 0xde, 0x70, 0x3c,
-	0x8f, 0x79, 0xb5, 0x01, 0xde, 0x7c, 0xcc, 0x79, 0xa4, 0xe2, 0x08, 0xaf, 0x5d, 0x74, 0xb6, 0xa4,
-	0x25, 0xb6, 0xfd, 0x15, 0xdc, 0x4d, 0xbc, 0x2a, 0x22, 0x32, 0xe8, 0x73, 0x11, 0x33, 0xda, 0x93,
-	0xfb, 0x43, 0x05, 0x8c, 0x33, 0xab, 0x56, 0xcb, 0x31, 0x3c, 0xad, 0xe8, 0xd8, 0x70, 0x1c, 0x84,
-	0x15, 0x39, 0x8e, 0xfe, 0x1a, 0xee, 0xa5, 0xe4, 0xbd, 0xe8, 0x6d, 0x38, 0x46, 0xf0, 0x58, 0x38,
-	0x74, 0x2c, 0x05, 0xb0, 0x36, 0x02, 0xa8, 0x8d, 0x58, 0x0e, 0xc2, 0x1a, 0x0b, 0x87, 0x25, 0x0c,
-	0x9f, 0x7e, 0x88, 0x9b, 0x91, 0x0d, 0x33, 0xa7, 0x6c, 0x68, 0x22, 0x4b, 0xfe, 0x94, 0xf5, 0xd2,
-	0x99, 0xbc, 0x19, 0xe9, 0x72, 0x12, 0xeb, 0x8f, 0xaf, 0xb3, 0xcf, 0x33, 0xa5, 0xff, 0xca, 0xbe,
-	0x2f, 0x68, 0xd3, 0xa7, 0xe4, 0xcf, 0x0f, 0xda, 0x9b, 0x1f, 0x1c, 0xb4, 0x17, 0x62, 0x72, 0x66,
-	0x7a, 0x4c, 0xe6, 0x26, 0xc5, 0xe4, 0xf4, 0x4d, 0x74, 0xeb, 0xff, 0x6b, 0x13, 0x95, 0x4e, 0x61,
-	0x65, 0x62, 0x51, 0x70, 0x4d, 0xe7, 0x7e, 0x0a, 0x0b, 0x32, 0xdd, 0x0b, 0xda, 0x21, 0x01, 0x0b,
-	0x3b, 0xa2, 0xab, 0x9c, 0x55, 0xc0, 0xf3, 0x3d, 0x7a, 0xde, 0xa2, 0x9d, 0xa6, 0xa2, 0x95, 0xfe,
-	0x3e, 0x03, 0xce, 0xbb, 0x8a, 0x83, 0x6b, 0x2a, 0x7c, 0x08, 0xf3, 0xa6, 0x87, 0x2b, 0xa2, 0x53,
-	0xb3, 0x36, 0x73, 0x38, 0xaf, 0x69, 0x2d, 0x49, 0x9a, 0x60, 0x53, 0x6e, 0x82, 0x4d, 0x01, 0xac,
-	0x4e, 0xae, 0x22, 0xfe, 0x24, 0x1e, 0x08, 0x60, 0xed, 0x9d, 0x67, 0xed, 0x47, 0xf7, 0x40, 0xe9,
-	0x3f, 0xb2, 0xb0, 0x34, 0xa1, 0x70, 0x91, 0xd1, 0xe7, 0xb1, 0x93, 0x41, 0xc7, 0xdc, 0x41, 0xf4,
-	0x07, 0x6a, 0x81, 0x23, 0x67, 0x10, 0x0e, 0x7a, 0x27, 0x2c, 0x26, 0x51, 0x9b, 0x50, 0x21, 0x62,
-	0xff, 0x64, 0x20, 0x4f, 0x57, 0x5d, 0x7e, 0xdf, 0xb9, 0x12, 0x31, 0x7b, 0xa1, 0xf8, 0xea, 0x4b,
-	0xd3, 0x3c, 0xe9, 0xd1, 0xf3, 0x7d, 0x25, 0x7b, 0xd0, 0xae, 0x8c, 0x24, 0xd1, 0x6b, 0x58, 0xbb,
-	0x84, 0x1a, 0x86, 0x91, 0x50, 0x5b, 0x94, 0x9b, 0x3a, 0xfa, 0xbd, 0xb0, 0xab, 0x69, 0xd8, 0xb1,
-	0x28, 0xfa, 0x01, 0xee, 0x5e, 0xc4, 0x35, 0x45, 0x03, 0x61, 0x67, 0x2c, 0x14, 0xdc, 0xd4, 0xc8,
-	0xef, 0x85, 0x76, 0x52, 0xd0, 0xa6, 0xae, 0xa8, 0x2b, 0xe1, 0x09, 0x8b, 0x79, 0x73, 0xc2, 0x62,
-	0xfe, 0x31, 0x0b, 0xf7, 0xdf, 0x5f, 0xad, 0x5d, 0x73, 0x49, 0xdf, 0xc2, 0xac, 0x1b, 0x85, 0x82,
-	0x9d, 0xcb, 0x4b, 0xd8, 0xcc, 0xe6, 0xc2, 0xf6, 0x6f, 0x3f, 0x76, 0xf9, 0x58, 0x96, 0xdf, 0xac,
-	0xaa, 0x95, 0xe0, 0x44, 0xdb, 0x87, 0x85, 0xca, 0x06, 0x83, 0xf9, 0xb4, 0x38, 0x5a, 0x84, 0xfc,
-	0xf1, 0xfe, 0xd1, 0x61, 0xbd, 0xba, 0xf7, 0x62, 0xaf, 0x5e, 0xb3, 0x6f, 0xa0, 0x15, 0x28, 0xbe,
-	0x79, 0x56, 0x25, 0x2d, 0x5c, 0xa9, 0xd6, 0x49, 0xf5, 0x60, 0xbf, 0x55, 0xff, 0xb6, 0x65, 0x67,
-	0xd0, 0x3c, 0x58, 0x2f, 0xf1, 0x61, 0x95, 0xec, 0xec, 0xed, 0xdb, 0x59, 0x74, 0x1b, 0x96, 0xaa,
-	0xcd, 0x83, 0xe3, 0xda, 0x25, 0xb6, 0x19, 0x74, 0x0b, 0xb2, 0x3b, 0xcf, 0xec, 0xdc, 0x0e, 0x80,
-	0x95, 0x74, 0x9c, 0x4a, 0x9f, 0x83, 0x7d, 0xb9, 0x99, 0x24, 0x7d, 0x9a, 0x3c, 0x51, 0x19, 0x9f,
-	0x9a, 0xcf, 0xd2, 0x7f, 0x67, 0x60, 0x75, 0x72, 0xd7, 0x06, 0x85, 0x50, 0xb8, 0xd8, 0x04, 0xd2,
-	0x1d, 0x99, 0xdd, 0x9f, 0xd7, 0x04, 0x2a, 0x5f, 0xf8, 0x6a, 0x0d, 0xfb, 0x0c, 0x5f, 0x84, 0xdf,
-	0x60, 0x50, 0xbc, 0xc2, 0x83, 0xf2, 0x30, 0x5b, 0xab, 0xbf, 0xa8, 0x1c, 0x37, 0x5b, 0xf6, 0x0d,
-	0x64, 0x41, 0x6e, 0xff, 0x60, 0xbf, 0x6e, 0x67, 0xe4, 0xaf, 0x9d, 0xca, 0x51, 0xdd, 0xce, 0xa2,
-	0x22, 0x14, 0x5e, 0xd5, 0xf1, 0xcb, 0x3a, 0x39, 0x6a, 0x56, 0x8e, 0x76, 0xeb, 0x47, 0xf6, 0x0c,
-	0xba, 0x0b, 0x4e, 0xad, 0x5e, 0x3d, 0xa8, 0xd5, 0x49, 0x65, 0xbf, 0x46, 0x2e, 0x8e, 0xe6, 0x36,
-	0x1a, 0xb0, 0x32, 0xf1, 0x41, 0xf0, 0xea, 0xda, 0xcc, 0xc2, 0xcc, 0xc1, 0x8b, 0x17, 0x76, 0x26,
-	0x6d, 0x44, 0x16, 0x01, 0xdc, 0x3a, 0x6a, 0xe1, 0xbd, 0x6a, 0xcb, 0x9e, 0xd9, 0x78, 0x0c, 0x20,
-	0x4f, 0x10, 0xd3, 0xb9, 0x4a, 0xcc, 0xbb, 0x81, 0x16, 0x00, 0x5e, 0x1d, 0xab, 0x26, 0x52, 0xab,
-	0x79, 0x64, 0x67, 0x36, 0x3e, 0x83, 0xe2, 0x95, 0x37, 0x37, 0xc9, 0xae, 0x96, 0x51, 0xcd, 0xab,
-	0x71, 0x74, 0xb0, 0x6f, 0x67, 0x36, 0xb6, 0x61, 0xf1, 0x52, 0x73, 0x1c, 0x21, 0x58, 0xa8, 0x1d,
-	0x90, 0xfd, 0x83, 0x16, 0x39, 0x3e, 0x7c, 0x89, 0x2b, 0x35, 0x89, 0x9f, 0x87, 0xd9, 0xe4, 0x23,
-	0xd3, 0xc8, 0x59, 0x19, 0x3b, 0xdb, 0xc8, 0x59, 0x59, 0x7b, 0xa6, 0x91, 0xb3, 0x66, 0xec, 0x5c,
-	0x23, 0x67, 0x7d, 0x61, 0x3f, 0x6d, 0xe4, 0xac, 0x35, 0xbb, 0xd4, 0xc8, 0x59, 0xf7, 0xed, 0x07,
-	0x8d, 0x9c, 0x05, 0x76, 0xbe, 0x91, 0xb3, 0xf2, 0xf6, 0x7c, 0x23, 0x67, 0x2d, 0xda, 0x76, 0x23,
-	0x67, 0xd9, 0x76, 0xb1, 0x91, 0xb3, 0x90, 0xbd, 0xd4, 0xc8, 0x59, 0x4b, 0xf6, 0x72, 0x23, 0x67,
-	0x2d, 0xdb, 0x2b, 0x8d, 0x9c, 0xb5, 0x62, 0xaf, 0x36, 0x72, 0xd6, 0x6d, 0xdb, 0x69, 0xe4, 0xac,
-	0x7b, 0xf6, 0xfd, 0x46, 0xce, 0xfa, 0xa5, 0xfd, 0x55, 0x23, 0x67, 0x3d, 0xb2, 0x1f, 0x37, 0x72,
-	0xd6, 0x63, 0xfb, 0xb3, 0x46, 0xce, 0xfa, 0xcc, 0xde, 0xc4, 0xa8, 0xe7, 0x9f, 0xb3, 0x58, 0x1f,
-	0xc7, 0xea, 0x95, 0x85, 0xc5, 0x78, 0x49, 0xd3, 0x62, 0xa6, 0x1e, 0x48, 0x0c, 0x71, 0x25, 0x79,
-	0x01, 0xd4, 0xaf, 0x04, 0x5a, 0x82, 0xe3, 0xd1, 0xc3, 0xa0, 0x96, 0x51, 0x4f, 0xec, 0x5a, 0x90,
-	0xe3, 0xd5, 0x34, 0x2b, 0x19, 0xd5, 0x13, 0xf8, 0x11, 0xf7, 0x3d, 0xe6, 0xd2, 0x58, 0x96, 0x5f,
-	0x82, 0x05, 0xac, 0xc7, 0x84, 0x6a, 0x86, 0x72, 0xd5, 0xd7, 0xa5, 0xed, 0xb6, 0x1f, 0xfa, 0x62,
-	0x88, 0xf3, 0x74, 0x20, 0xaf, 0x0d, 0xfa, 0x75, 0xa1, 0x18, 0x7b, 0xe3, 0xc7, 0x0e, 0x8f, 0x05,
-	0x74, 0x88, 0x0b, 0x5a, 0xa5, 0x69, 0x11, 0xe1, 0xe4, 0xa1, 0x53, 0x37, 0xa7, 0x55, 0x4b, 0xe6,
-	0x82, 0xad, 0x78, 0x9e, 0x7b, 0x9c, 0x0c, 0x3c, 0x4e, 0xe4, 0xdd, 0x03, 0x17, 0xf9, 0x15, 0xc0,
-	0x55, 0x83, 0x20, 0x47, 0xd4, 0xd9, 0x42, 0x7a, 0xd1, 0x20, 0x14, 0x18, 0x29, 0x41, 0xce, 0xc8,
-	0xe9, 0x73, 0x4e, 0x38, 0x25, 0xbf, 0x7b, 0x2b, 0x70, 0x49, 0xb0, 0xb8, 0x97, 0xbc, 0x27, 0x79,
-	0x31, 0xf5, 0x43, 0x92, 0xfc, 0x9d, 0x02, 0x2f, 0x27, 0x3e, 0x31, 0x1e, 0x3c, 0xa1, 0xc2, 0xed,
-	0x62, 0x27, 0xfd, 0x45, 0x64, 0xda, 0x61, 0xa1, 0x88, 0x7d, 0xc6, 0xf1, 0xca, 0x95, 0x11, 0x59,
-	0x86, 0x6d, 0xfc, 0x21, 0x03, 0xf3, 0xe9, 0x67, 0xc5, 0xff, 0xcb, 0xf6, 0xd8, 0x21, 0x2c, 0xf3,
-	0xc1, 0x09, 0x77, 0x63, 0xff, 0x84, 0x79, 0x24, 0x66, 0xc9, 0x13, 0xa8, 0x4e, 0xcf, 0xf7, 0x26,
-	0x66, 0x0f, 0x6c, 0xb8, 0xf0, 0xd2, 0x58, 0x34, 0xa1, 0xf1, 0x8d, 0x6f, 0x20, 0x9f, 0xea, 0xbd,
-	0xca, 0x5b, 0x21, 0x67, 0x6e, 0xcc, 0xcc, 0x93, 0x8e, 0x9e, 0x0f, 0x68, 0x92, 0x7a, 0xc5, 0xb9,
-	0x03, 0x73, 0x5e, 0xc8, 0xf5, 0x6b, 0x9b, 0xe9, 0x2e, 0x5a, 0x5e, 0xc8, 0xd5, 0x43, 0xdb, 0x93,
-	0x75, 0xb0, 0x12, 0x64, 0xb4, 0x0c, 0x76, 0xd2, 0xe4, 0x4d, 0x5a, 0xc3, 0xf6, 0x8d, 0x9d, 0xcd,
-	0x7f, 0xfb, 0xe9, 0x7e, 0xe6, 0xdf, 0x7f, 0xba, 0x9f, 0xf9, 0xcf, 0x9f, 0xee, 0x67, 0xbe, 0x2f,
-	0x69, 0x7b, 0xf5, 0xbf, 0x4e, 0xb6, 0x2e, 0xfc, 0x8f, 0xe5, 0xe4, 0x96, 0x3a, 0x22, 0x9f, 0xfd,
-	0x6f, 0x00, 0x00, 0x00, 0xff, 0xff, 0x41, 0x4d, 0x4a, 0xa8, 0x50, 0x23, 0x00, 0x00,
+	0xb2, 0x90, 0x0f, 0xb8, 0x3a, 0xff, 0xe7, 0xb7, 0x0f, 0xaf, 0xaf, 0xe9, 0xa0, 0xcf, 0xc2, 0xaa,
+	0xc2, 0xa8, 0x74, 0x64, 0xe6, 0x5e, 0x99, 0x5b, 0x4a, 0x0b, 0xea, 0x01, 0xf0, 0xd3, 0xe1, 0x5b,
+	0x1a, 0xc8, 0xa4, 0x57, 0x57, 0x08, 0xf9, 0xed, 0xaf, 0x7e, 0xc4, 0xec, 0x4e, 0x87, 0x6f, 0x34,
+	0xc6, 0x04, 0x75, 0x63, 0x05, 0xc8, 0x03, 0x18, 0x57, 0x66, 0x07, 0x94, 0xba, 0xea, 0xf5, 0xd5,
+	0xe1, 0xa4, 0x50, 0xa7, 0x23, 0x63, 0x54, 0xbd, 0x4b, 0xff, 0x9c, 0x81, 0x47, 0xef, 0x4e, 0x14,
+	0xac, 0x8b, 0xcf, 0x4e, 0xe4, 0x0d, 0xd1, 0x13, 0x28, 0xf6, 0xe8, 0x39, 0x49, 0x2a, 0xd8, 0xc9,
+	0x50, 0xf6, 0xb9, 0xb2, 0x9e, 0x14, 0xf0, 0x62, 0x8f, 0x9e, 0x27, 0xac, 0x92, 0x8c, 0xb6, 0x61,
+	0x99, 0x06, 0x41, 0xf4, 0x96, 0xf4, 0x69, 0x2c, 0x7c, 0x1a, 0x90, 0x1e, 0xe3, 0x9c, 0x76, 0x98,
+	0x2a, 0x2d, 0x16, 0x5e, 0x52, 0x83, 0x87, 0x7a, 0xec, 0x95, 0x1e, 0x42, 0x1b, 0x50, 0xe8, 0x53,
+	0xf7, 0x94, 0x50, 0x6e, 0xb0, 0x67, 0x14, 0x6f, 0x5e, 0x12, 0x2b, 0x5c, 0xe1, 0x96, 0xfe, 0x6d,
+	0x16, 0x1e, 0x7f, 0x58, 0x91, 0x91, 0x75, 0x3d, 0xb9, 0x6d, 0x30, 0x75, 0xdd, 0x7c, 0xca, 0x5a,
+	0xa8, 0x2e, 0xe4, 0xb2, 0xca, 0x76, 0xf5, 0x1b, 0x3d, 0x83, 0xd9, 0xa4, 0x24, 0xcf, 0x4d, 0x2b,
+	0xc9, 0x09, 0xa7, 0xac, 0xc5, 0xaa, 0xe3, 0xe9, 0xc7, 0xac, 0xed, 0x9f, 0x2b, 0x7b, 0xe7, 0x30,
+	0x48, 0xd2, 0xa1, 0xa2, 0xa0, 0xbb, 0x30, 0xd7, 0xa6, 0x7e, 0x40, 0x64, 0x10, 0x99, 0x52, 0x6d,
+	0x49, 0x82, 0x0c, 0x3b, 0xf4, 0x18, 0x16, 0xe5, 0xf1, 0x62, 0xc0, 0x49, 0x14, 0x12, 0x16, 0xc7,
+	0x51, 0xac, 0xaa, 0xc0, 0x1c, 0x2e, 0x68, 0xf2, 0x41, 0x58, 0x97, 0x44, 0xf4, 0x2b, 0x70, 0xfc,
+	0xd0, 0x0d, 0x06, 0x1e, 0x23, 0x5d, 0x46, 0x65, 0x43, 0x47, 0xfc, 0x90, 0xb8, 0x5d, 0xe6, 0x9e,
+	0x3a, 0xb7, 0xd4, 0x0e, 0xb8, 0x6c, 0xc6, 0x77, 0xf5, 0xf0, 0x5e, 0x58, 0x95, 0x83, 0xe8, 0x05,
+	0xac, 0x27, 0x82, 0xc9, 0xa2, 0x5d, 0x01, 0x00, 0x05, 0x70, 0xcf, 0xf0, 0x99, 0x35, 0xbc, 0x84,
+	0xf3, 0x87, 0x0c, 0x7c, 0x94, 0x00, 0x51, 0xcf, 0xf3, 0xa5, 0x13, 0x68, 0x70, 0x15, 0x2b, 0xaf,
+	0xfa, 0xc9, 0xdf, 0xff, 0x5c, 0xdb, 0x46, 0x79, 0x4f, 0xdb, 0x50, 0x19, 0x99, 0x70, 0xd1, 0xce,
+	0x7a, 0x28, 0xe2, 0x21, 0x7e, 0xe0, 0xbf, 0x9f, 0x0b, 0xfd, 0x63, 0x06, 0xee, 0x5f, 0x76, 0xcb,
+	0x49, 0xe4, 0x0d, 0xc7, 0xf3, 0x98, 0x57, 0x01, 0xf0, 0xe6, 0xa7, 0x9c, 0x47, 0x2a, 0x8f, 0xf0,
+	0xea, 0x45, 0x67, 0x4b, 0x5a, 0x62, 0xdb, 0x5f, 0xc1, 0xbd, 0xc4, 0xab, 0x22, 0x22, 0x83, 0x3e,
+	0x17, 0x31, 0xa3, 0x3d, 0x19, 0x1f, 0x2a, 0x61, 0x9c, 0x59, 0xb5, 0x5a, 0x8e, 0xe1, 0x69, 0x45,
+	0xc7, 0x86, 0xe3, 0x20, 0xac, 0xc8, 0x71, 0xf4, 0xd7, 0x70, 0x3f, 0x25, 0xef, 0x45, 0x6f, 0xc3,
+	0x31, 0x82, 0xc7, 0xc2, 0xa1, 0x63, 0x29, 0x80, 0xd5, 0x11, 0x40, 0x6d, 0xc4, 0x72, 0x10, 0xd6,
+	0x58, 0x38, 0x2c, 0x61, 0xf8, 0xf8, 0x43, 0xdc, 0x8c, 0x6c, 0x98, 0x39, 0x65, 0x43, 0x93, 0x59,
+	0xf2, 0xa7, 0xec, 0xca, 0xce, 0xe4, 0xf9, 0x4b, 0x37, 0xad, 0x58, 0x7f, 0x7c, 0x99, 0x7d, 0x9e,
+	0x29, 0xfd, 0x4f, 0xf6, 0x7d, 0x49, 0x9b, 0xde, 0x8b, 0x7f, 0x7c, 0xd2, 0xde, 0xfc, 0xe0, 0xa4,
+	0xbd, 0x90, 0x93, 0x33, 0xd3, 0x73, 0x32, 0x37, 0x29, 0x27, 0xa7, 0x07, 0xd1, 0xad, 0x3f, 0x55,
+	0x10, 0x95, 0x4e, 0x61, 0x79, 0x62, 0xeb, 0x71, 0x4d, 0xe7, 0x7e, 0x0c, 0x0b, 0xb2, 0xdc, 0x0b,
+	0xda, 0x21, 0x01, 0x0b, 0x3b, 0xa2, 0xab, 0x9c, 0x55, 0xc0, 0xf3, 0x3d, 0x7a, 0xde, 0xa2, 0x9d,
+	0xa6, 0xa2, 0x95, 0xfe, 0x21, 0x03, 0xce, 0xbb, 0x5a, 0x90, 0x6b, 0x2a, 0x7c, 0x08, 0xf3, 0xe6,
+	0xa6, 0x58, 0x44, 0xa7, 0x66, 0x6d, 0xe6, 0x70, 0x5e, 0xd3, 0x5a, 0x92, 0x34, 0xc1, 0xa6, 0xdc,
+	0x04, 0x9b, 0x02, 0x58, 0x99, 0xdc, 0xab, 0xfc, 0x2c, 0x1e, 0x08, 0x60, 0xf5, 0x9d, 0x3b, 0xfa,
+	0x4f, 0xee, 0x81, 0xd2, 0x7f, 0x66, 0x61, 0x69, 0x42, 0x7b, 0x24, 0xb3, 0xcf, 0x63, 0x27, 0x83,
+	0x8e, 0x39, 0xe9, 0xe8, 0x0f, 0xd4, 0x02, 0x47, 0xce, 0x20, 0x1c, 0xf4, 0x4e, 0x58, 0x4c, 0xa2,
+	0x36, 0xa1, 0x42, 0xc4, 0xfe, 0xc9, 0x40, 0xee, 0xae, 0xba, 0xc9, 0xbf, 0x7b, 0x25, 0x63, 0xf6,
+	0x42, 0xf1, 0xc5, 0xe7, 0xe6, 0x8a, 0xa6, 0x47, 0xcf, 0xf7, 0x95, 0xec, 0x41, 0xbb, 0x32, 0x92,
+	0x44, 0xaf, 0x61, 0xf5, 0x12, 0x6a, 0x18, 0x46, 0x42, 0x85, 0x28, 0x37, 0xdd, 0xfa, 0x7b, 0x61,
+	0x57, 0xd2, 0xb0, 0x63, 0x51, 0xf4, 0x1d, 0xdc, 0xbb, 0x88, 0x6b, 0x9a, 0x06, 0xc2, 0xce, 0x58,
+	0x28, 0xb8, 0xe9, 0xc4, 0xdf, 0x0b, 0xed, 0xa4, 0xa0, 0x4d, 0x5f, 0x51, 0x57, 0xc2, 0x13, 0x16,
+	0xf3, 0xe6, 0x84, 0xc5, 0xfc, 0x63, 0x16, 0xd6, 0xde, 0xdf, 0x13, 0x5e, 0x73, 0x49, 0xdf, 0xc2,
+	0xac, 0x1b, 0x85, 0x82, 0x9d, 0xcb, 0xa3, 0xde, 0xcc, 0xe6, 0xc2, 0xf6, 0x6f, 0x7f, 0xea, 0x26,
+	0xb5, 0x2c, 0xbf, 0x59, 0x55, 0x2b, 0xc1, 0x89, 0xb6, 0x0f, 0x4b, 0x95, 0x0d, 0x06, 0xf3, 0x69,
+	0x71, 0xb4, 0x08, 0xf9, 0xe3, 0xfd, 0xa3, 0xc3, 0x7a, 0x75, 0xef, 0xc5, 0x5e, 0xbd, 0x66, 0xdf,
+	0x40, 0xcb, 0x50, 0x7c, 0xf3, 0xac, 0x4a, 0x5a, 0xb8, 0x52, 0xad, 0x93, 0xea, 0xc1, 0x7e, 0xab,
+	0xfe, 0x75, 0xcb, 0xce, 0xa0, 0x79, 0xb0, 0x5e, 0xe2, 0xc3, 0x2a, 0xd9, 0xd9, 0xdb, 0xb7, 0xb3,
+	0xe8, 0x0e, 0x2c, 0x55, 0x9b, 0x07, 0xc7, 0xb5, 0x4b, 0x6c, 0x33, 0xe8, 0x16, 0x64, 0x77, 0x9e,
+	0xd9, 0xb9, 0xd2, 0xdf, 0x65, 0xa0, 0x78, 0xa5, 0x0f, 0xbd, 0xa6, 0x27, 0x57, 0xe0, 0x96, 0x79,
+	0x84, 0xd0, 0x69, 0x61, 0xbe, 0x64, 0x5b, 0x2a, 0xcb, 0xf7, 0x20, 0x66, 0xea, 0x69, 0x4f, 0xef,
+	0x73, 0xba, 0xd7, 0x5a, 0x34, 0x03, 0xaf, 0x22, 0x8f, 0xc9, 0xdd, 0x6d, 0x07, 0xc0, 0x4a, 0xee,
+	0xd7, 0x4a, 0x9f, 0x82, 0x7d, 0xf9, 0xea, 0x4c, 0x5a, 0x94, 0x3c, 0xc8, 0x19, 0x8b, 0xcc, 0x67,
+	0xe9, 0x7f, 0x33, 0xb0, 0x32, 0xf9, 0x8e, 0x0a, 0x85, 0x50, 0xb8, 0x78, 0xe5, 0xa5, 0xef, 0x9f,
+	0x76, 0x7f, 0xdc, 0x95, 0x57, 0xf9, 0xc2, 0x57, 0x6b, 0xd8, 0x67, 0xf8, 0x22, 0xfc, 0x06, 0x83,
+	0xe2, 0x15, 0x1e, 0x94, 0x87, 0xd9, 0x5a, 0xfd, 0x45, 0xe5, 0xb8, 0xd9, 0xb2, 0x6f, 0x20, 0x0b,
+	0x72, 0xfb, 0x07, 0xfb, 0x75, 0x3b, 0x23, 0x7f, 0xed, 0x54, 0x8e, 0xea, 0x76, 0x16, 0x15, 0xa1,
+	0xf0, 0xaa, 0x8e, 0x5f, 0xd6, 0xc9, 0x51, 0xb3, 0x72, 0xb4, 0x5b, 0x3f, 0xb2, 0x67, 0xd0, 0x3d,
+	0x70, 0x6a, 0xf5, 0xea, 0x41, 0xad, 0x4e, 0x2a, 0xfb, 0x35, 0x72, 0x71, 0x34, 0xb7, 0xd1, 0x80,
+	0xe5, 0x89, 0xcf, 0x9f, 0x57, 0x63, 0x64, 0x16, 0x66, 0x0e, 0x5e, 0xbc, 0xb0, 0x33, 0x69, 0x23,
+	0xb2, 0x08, 0xe0, 0xd6, 0x51, 0x0b, 0xef, 0x55, 0x5b, 0xf6, 0xcc, 0xc6, 0x63, 0x00, 0xb9, 0x93,
+	0x99, 0x7b, 0xba, 0xc4, 0xbc, 0x1b, 0x68, 0x01, 0xe0, 0xd5, 0xb1, 0xba, 0x32, 0x6b, 0x35, 0x8f,
+	0xec, 0xcc, 0xc6, 0x27, 0x50, 0xbc, 0xf2, 0xc2, 0x28, 0xd9, 0x55, 0x38, 0xa9, 0x79, 0x35, 0x8e,
+	0x0e, 0xf6, 0xed, 0xcc, 0xc6, 0x36, 0x2c, 0x5e, 0x7a, 0x0a, 0x40, 0x08, 0x16, 0x6a, 0x07, 0x64,
+	0xff, 0xa0, 0x45, 0x8e, 0x0f, 0x5f, 0xe2, 0x4a, 0x4d, 0xe2, 0xe7, 0x61, 0x36, 0xf9, 0xc8, 0x34,
+	0x72, 0x56, 0xc6, 0xce, 0x36, 0x72, 0x56, 0xd6, 0x9e, 0x69, 0xe4, 0xac, 0x19, 0x3b, 0xd7, 0xc8,
+	0x59, 0x9f, 0xd9, 0x4f, 0x1b, 0x39, 0x6b, 0xd5, 0x2e, 0x35, 0x72, 0xd6, 0x9a, 0xfd, 0xa0, 0x91,
+	0xb3, 0xc0, 0xce, 0x37, 0x72, 0x56, 0xde, 0x9e, 0x6f, 0xe4, 0xac, 0x45, 0xdb, 0x6e, 0xe4, 0x2c,
+	0xdb, 0x2e, 0x36, 0x72, 0x16, 0xb2, 0x97, 0x1a, 0x39, 0x6b, 0xc9, 0xbe, 0xdd, 0xc8, 0x59, 0xb7,
+	0xed, 0xe5, 0x46, 0xce, 0x5a, 0xb6, 0x57, 0x1a, 0x39, 0xeb, 0x8e, 0xed, 0x34, 0x72, 0xd6, 0x7d,
+	0x7b, 0xad, 0x91, 0xb3, 0x7e, 0x69, 0x7f, 0xd1, 0xc8, 0x59, 0x8f, 0xec, 0xc7, 0x8d, 0x9c, 0xf5,
+	0xd8, 0xfe, 0xa4, 0x91, 0xb3, 0x3e, 0xb1, 0x37, 0x31, 0xea, 0xf9, 0xe7, 0x2c, 0xd6, 0x6d, 0x81,
+	0x7a, 0x53, 0x62, 0x31, 0x5e, 0xd2, 0xb4, 0x98, 0xa9, 0xe7, 0x20, 0x43, 0x5c, 0x4e, 0xde, 0x3b,
+	0xf5, 0x9b, 0x88, 0x96, 0xe0, 0x78, 0xf4, 0x0c, 0xaa, 0x65, 0xd4, 0x1f, 0x0a, 0xb4, 0x20, 0xc7,
+	0x2b, 0x69, 0x56, 0x32, 0xea, 0x6b, 0xf0, 0x23, 0xee, 0x7b, 0xcc, 0xa5, 0xb1, 0x6c, 0x03, 0x05,
+	0x0b, 0x58, 0x8f, 0x09, 0x75, 0xf5, 0xcb, 0xd5, 0x2d, 0x36, 0x6d, 0xb7, 0xfd, 0xd0, 0x17, 0x43,
+	0x9c, 0xa7, 0x03, 0x79, 0x7c, 0xd1, 0x6f, 0x29, 0xc5, 0xd8, 0x1b, 0x3f, 0xed, 0x78, 0x2c, 0xa0,
+	0x43, 0x5c, 0xd0, 0x2a, 0xcd, 0x85, 0x18, 0x4e, 0x9e, 0x75, 0xf5, 0x55, 0xbc, 0xba, 0x80, 0xba,
+	0x60, 0x2b, 0x9e, 0xe7, 0x1e, 0x27, 0x03, 0x8f, 0x13, 0x79, 0x06, 0xc2, 0x45, 0x7e, 0x05, 0x70,
+	0xc5, 0x20, 0xc8, 0x11, 0xb5, 0xc7, 0x91, 0x5e, 0x34, 0x08, 0x05, 0x46, 0x4a, 0x90, 0x33, 0x72,
+	0xfa, 0x9c, 0x13, 0x4e, 0xc9, 0xef, 0xde, 0x0a, 0x5c, 0x12, 0x2c, 0xee, 0x25, 0xaf, 0x67, 0x5e,
+	0x4c, 0xfd, 0x90, 0x24, 0x7f, 0x1e, 0xc1, 0xb7, 0x13, 0x9f, 0x18, 0x0f, 0x9e, 0x50, 0xe1, 0x76,
+	0xb1, 0x93, 0xfe, 0x22, 0xb2, 0xfc, 0xb1, 0x50, 0xc4, 0x3e, 0xe3, 0x78, 0xf9, 0xca, 0x88, 0x6c,
+	0x07, 0x37, 0xfe, 0x90, 0x81, 0xf9, 0xf4, 0x23, 0xea, 0xff, 0xe7, 0x65, 0xe0, 0x21, 0xdc, 0xe6,
+	0x83, 0x13, 0xee, 0xc6, 0xfe, 0x09, 0xf3, 0x48, 0xcc, 0x92, 0x07, 0x5f, 0xbd, 0x4d, 0xdc, 0x9f,
+	0x58, 0x3d, 0xb0, 0xe1, 0xc2, 0x4b, 0x63, 0xd1, 0x84, 0xc6, 0x37, 0xbe, 0x82, 0x7c, 0xea, 0xa6,
+	0x59, 0x9e, 0x4e, 0x39, 0x73, 0x63, 0x66, 0x1e, 0xb0, 0xf4, 0x7c, 0x40, 0x93, 0xd4, 0x9b, 0xd5,
+	0x5d, 0x98, 0xf3, 0x42, 0xae, 0xdf, 0x16, 0xcd, 0x5d, 0xaa, 0xe5, 0x85, 0x5c, 0x3d, 0x2b, 0x3e,
+	0x59, 0x07, 0x2b, 0x41, 0x46, 0xb7, 0xc1, 0x4e, 0xae, 0xb4, 0x93, 0x8b, 0x70, 0xfb, 0xc6, 0xce,
+	0xe6, 0xbf, 0xff, 0xb0, 0x96, 0xf9, 0x8f, 0x1f, 0xd6, 0x32, 0xff, 0xfd, 0xc3, 0x5a, 0xe6, 0xdb,
+	0x92, 0xb6, 0x57, 0xff, 0xc7, 0x66, 0xeb, 0xc2, 0xbf, 0x76, 0x4e, 0x6e, 0xa9, 0xad, 0xfa, 0xd9,
+	0xff, 0x05, 0x00, 0x00, 0xff, 0xff, 0xa2, 0xde, 0xdf, 0x1e, 0x3e, 0x24, 0x00, 0x00,
 }
 
 func (m *MeshConfig) Marshal() (dAtA []byte, err error) {
@@ -3886,6 +3995,27 @@ func (m *MeshConfig_ExtensionProvider_Skywalking) MarshalToSizedBuffer(dAtA []by
 	}
 	return len(dAtA) - i, nil
 }
+func (m *MeshConfig_ExtensionProvider_RateLimit) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *MeshConfig_ExtensionProvider_RateLimit) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.RateLimit != nil {
+		{
+			size, err := m.RateLimit.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintConfig(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x52
+	}
+	return len(dAtA) - i, nil
+}
 func (m *MeshConfig_ExtensionProvider_EnvoyExternalAuthorizationRequestBody) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -4453,20 +4583,76 @@ func (m *MeshConfig_ExtensionProvider_OpenCensusAgentTracingProvider) MarshalToS
 		dAtA[i] = 0x20
 	}
 	if len(m.Context) > 0 {
-		dAtA35 := make([]byte, len(m.Context)*10)
-		var j34 int
+		dAtA36 := make([]byte, len(m.Context)*10)
+		var j35 int
 		for _, num := range m.Context {
 			for num >= 1<<7 {
-				dAtA35[j34] = uint8(uint64(num)&0x7f | 0x80)
+				dAtA36[j35] = uint8(uint64(num)&0x7f | 0x80)
 				num >>= 7
-				j34++
+				j35++
 			}
-			dAtA35[j34] = uint8(num)
-			j34++
+			dAtA36[j35] = uint8(num)
+			j35++
+		}
+		i -= j35
+		copy(dAtA[i:], dAtA36[:j35])
+		i = encodeVarintConfig(dAtA, i, uint64(j35))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.Port != 0 {
+		i = encodeVarintConfig(dAtA, i, uint64(m.Port))
+		i--
+		dAtA[i] = 0x10
+	}
+	if len(m.Service) > 0 {
+		i -= len(m.Service)
+		copy(dAtA[i:], m.Service)
+		i = encodeVarintConfig(dAtA, i, uint64(len(m.Service)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MeshConfig_ExtensionProvider_RateLimitProvider) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MeshConfig_ExtensionProvider_RateLimitProvider) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *MeshConfig_ExtensionProvider_RateLimitProvider) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.FailureModeDeny {
+		i--
+		if m.FailureModeDeny {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
 		}
-		i -= j34
-		copy(dAtA[i:], dAtA35[:j34])
-		i = encodeVarintConfig(dAtA, i, uint64(j34))
+		i--
+		dAtA[i] = 0x20
+	}
+	if len(m.Domain) > 0 {
+		i -= len(m.Domain)
+		copy(dAtA[i:], m.Domain)
+		i = encodeVarintConfig(dAtA, i, uint64(len(m.Domain)))
 		i--
 		dAtA[i] = 0x1a
 	}
@@ -4576,20 +4762,20 @@ func (m *ConfigSource) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
 	if len(m.SubscribedResources) > 0 {
-		dAtA37 := make([]byte, len(m.SubscribedResources)*10)
-		var j36 int
+		dAtA38 := make([]byte, len(m.SubscribedResources)*10)
+		var j37 int
 		for _, num := range m.SubscribedResources {
 			for num >= 1<<7 {
-				dAtA37[j36] = uint8(uint64(num)&0x7f | 0x80)
+				dAtA38[j37] = uint8(uint64(num)&0x7f | 0x80)
 				num >>= 7
-				j36++
+				j37++
 			}
-			dAtA37[j36] = uint8(num)
-			j36++
+			dAtA38[j37] = uint8(num)
+			j37++
 		}
-		i -= j36
-		copy(dAtA[i:], dAtA37[:j36])
-		i = encodeVarintConfig(dAtA, i, uint64(j36))
+		i -= j37
+		copy(dAtA[i:], dAtA38[:j37])
+		i = encodeVarintConfig(dAtA, i, uint64(j37))
 		i--
 		dAtA[i] = 0x1a
 	}
@@ -5106,6 +5292,18 @@ func (m *MeshConfig_ExtensionProvider_Skywalking) Size() (n int) {
 	}
 	return n
 }
+func (m *MeshConfig_ExtensionProvider_RateLimit) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.RateLimit != nil {
+		l = m.RateLimit.Size()
+		n += 1 + l + sovConfig(uint64(l))
+	}
+	return n
+}
 func (m *MeshConfig_ExtensionProvider_EnvoyExternalAuthorizationRequestBody) Size() (n int) {
 	if m == nil {
 		return 0
@@ -5383,6 +5581,32 @@ func (m *MeshConfig_ExtensionProvider_OpenCensusAgentTracingProvider) Size() (n
 	return n
 }
 
+func (m *MeshConfig_ExtensionProvider_RateLimitProvider) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Service)
+	if l > 0 {
+		n += 1 + l + sovConfig(uint64(l))
+	}
+	if m.Port != 0 {
+		n += 1 + sovConfig(uint64(m.Port))
+	}
+	l = len(m.Domain)
+	if l > 0 {
+		n += 1 + l + sovConfig(uint64(l))
+	}
+	if m.FailureModeDeny {
+		n += 2
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
 func (m *MeshConfig_DefaultProviders) Size() (n int) {
 	if m == nil {
 		return 0
@@ -7809,6 +8033,41 @@ func (m *MeshConfig_ExtensionProvider) Unmarshal(dAtA []byte) error {
 			}
 			m.Provider = &MeshConfig_ExtensionProvider_Skywalking{v}
 			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RateLimit", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowConfig
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthConfig
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthConfig
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &MeshConfig_ExtensionProvider_RateLimitProvider{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Provider = &MeshConfig_ExtensionProvider_RateLimit{v}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipConfig(dAtA[iNdEx:])
@@ -9597,6 +9856,160 @@ func (m *MeshConfig_ExtensionProvider_OpenCensusAgentTracingProvider) Unmarshal(
 	}
 	return nil
 }
+func (m *MeshConfig_ExtensionProvider_RateLimitProvider) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowConfig
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RateLimitProvider: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RateLimitProvider: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Service", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowConfig
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthConfig
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthConfig
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Service = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Port", wireType)
+			}
+			m.Port = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowConfig
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Port |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Domain", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowConfig
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthConfig
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthConfig
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Domain = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FailureModeDeny", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowConfig
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.FailureModeDeny = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := skipConfig(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthConfig
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *MeshConfig_DefaultProviders) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
diff --git a/mesh/v1alpha1/config.proto b/mesh/v1alpha1/config.proto
index fb47338ab3f..1a889f20082 100644
--- a/mesh/v1alpha1/config.proto
+++ b/mesh/v1alpha1/config.proto
@@ -485,6 +485,8 @@ message MeshConfig {
       OpenCensusAgentTracingProvider opencensus = 8;
       // Configures a Apache SkyWalking provider.
       SkyWalkingTracingProvider skywalking = 9;
+      // Configures a global rate limit service.
+      RateLimitProvider rate_limit = 10;
     }
 
     message EnvoyExternalAuthorizationRequestBody {
@@ -771,6 +773,32 @@ message MeshConfig {
       // NOTE: currently only controls max length of the path tag.
       uint32 max_tag_length = 4;
     }
+
+    // Defines configuration for a global rate limiting service provider.
+    // The service must implement Rate Limit Service (RLS):
+    // https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/ratelimit/v3/rls.proto.
+    message RateLimitProvider {
+      // REQUIRED. Specifies the service that exposes the rate limit API.
+      // The format is "[<Namespace>/]<Hostname>". The specification of <Namespace> is required only when it is insufficient
+      // to unambiguously resolve a service in the service registry. The <Hostname> is a fully qualified host name of a
+      // service defined by the Kubernetes service or ServiceEntry.
+      //
+      // Example: "rls.default.svc.cluster.local" or "bar/rls.example.com".
+      string service = 1;
+
+      // REQUIRED. Specifies the port of the service.
+      uint32 port = 2;
+
+      // The rate limit domain to use when calling the service.
+      // This corresponds to the `domain` field in the RateLimitRequest proto:
+      // https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/ratelimit/v3/rls.proto#service-ratelimit-v3-ratelimitrequest.
+      string domain = 3;
+
+      // The behaviour in case the rate limiting service does not respond back.
+      // When it is set to true, the proxy will not allow traffic in case of
+      // communication failure between rate limiting service and the proxy.
+      bool failure_mode_deny = 4;
+    }
   }
 
   // Defines a list of extension providers that extend Istio's functionality. For example, the AuthorizationPolicy
diff --git a/mesh/v1alpha1/istio.mesh.v1alpha1.gen.json b/mesh/v1alpha1/istio.mesh.v1alpha1.gen.json
index 2f8b5200da1..e25c81edf02 100644
--- a/mesh/v1alpha1/istio.mesh.v1alpha1.gen.json
+++ b/mesh/v1alpha1/istio.mesh.v1alpha1.gen.json
@@ -436,6 +436,16 @@
                       "$ref": "#/components/schemas/istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.SkyWalkingTracingProvider"
                     }
                   }
+                },
+                {
+                  "required": [
+                    "rateLimit"
+                  ],
+                  "properties": {
+                    "rateLimit": {
+                      "$ref": "#/components/schemas/istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.RateLimitProvider"
+                    }
+                  }
                 }
               ]
             }
@@ -519,6 +529,16 @@
                 "$ref": "#/components/schemas/istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.SkyWalkingTracingProvider"
               }
             }
+          },
+          {
+            "required": [
+              "rateLimit"
+            ],
+            "properties": {
+              "rateLimit": {
+                "$ref": "#/components/schemas/istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.RateLimitProvider"
+              }
+            }
           }
         ]
       },
@@ -710,6 +730,28 @@
           "B3"
         ]
       },
+      "istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.RateLimitProvider": {
+        "description": "Defines configuration for a global rate limiting service provider. The service must implement Rate Limit Service (RLS): https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/ratelimit/v3/rls.proto.",
+        "type": "object",
+        "properties": {
+          "service": {
+            "description": "REQUIRED. Specifies the service that exposes the rate limit API. The format is \"[\u003cNamespace\u003e/]\u003cHostname\u003e\". The specification of \u003cNamespace\u003e is required only when it is insufficient to unambiguously resolve a service in the service registry. The \u003cHostname\u003e is a fully qualified host name of a service defined by the Kubernetes service or ServiceEntry.",
+            "type": "string"
+          },
+          "port": {
+            "description": "REQUIRED. Specifies the port of the service.",
+            "type": "integer"
+          },
+          "domain": {
+            "description": "The rate limit domain to use when calling the service. This corresponds to the `domain` field in the RateLimitRequest proto: https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/ratelimit/v3/rls.proto#service-ratelimit-v3-ratelimitrequest.",
+            "type": "string"
+          },
+          "failureModeDeny": {
+            "description": "The behaviour in case the rate limiting service does not respond back. When it is set to true, the proxy will not allow traffic in case of communication failure between rate limiting service and the proxy.",
+            "type": "boolean"
+          }
+        }
+      },
       "istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.SkyWalkingTracingProvider": {
         "description": "Defines configuration for a SkyWalking tracer.",
         "type": "object",
diff --git a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
index baed3159d01..170da5d256a 100644
--- a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
+++ b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
@@ -5,7 +5,7 @@
 layout: protoc-gen-docs
 generator: protoc-gen-docs
 weight: 20
-number_of_entries: 45
+number_of_entries: 46
 ---
 <p>Configuration affecting the service mesh as a whole.</p>
 
@@ -1056,6 +1056,17 @@ <h2 id="MeshConfig-ExtensionProvider">MeshConfig.ExtensionProvider</h2>
 <td>
 <p>Configures a Apache SkyWalking provider.</p>
 
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="MeshConfig-ExtensionProvider-rate_limit" class="oneof">
+<td><code>rateLimit</code></td>
+<td><code><a href="#MeshConfig-ExtensionProvider-RateLimitProvider">RateLimitProvider (oneof)</a></code></td>
+<td>
+<p>Configures a global rate limit service.</p>
+
 </td>
 <td>
 No
@@ -1832,6 +1843,78 @@ <h2 id="MeshConfig-ExtensionProvider-OpenCensusAgentTracingProvider">MeshConfig.
 <p>Optional. Controls the overall path length allowed in a reported span.
 NOTE: currently only controls max length of the path tag.</p>
 
+</td>
+<td>
+No
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="MeshConfig-ExtensionProvider-RateLimitProvider">MeshConfig.ExtensionProvider.RateLimitProvider</h2>
+<section>
+<p>Defines configuration for a global rate limiting service provider.
+The service must implement Rate Limit Service (RLS):
+https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/ratelimit/v3/rls.proto.</p>
+
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+<th>Required</th>
+</tr>
+</thead>
+<tbody>
+<tr id="MeshConfig-ExtensionProvider-RateLimitProvider-service">
+<td><code>service</code></td>
+<td><code>string</code></td>
+<td>
+<p>REQUIRED. Specifies the service that exposes the rate limit API.
+The format is &ldquo;[<Namespace>/]<Hostname>&rdquo;. The specification of <Namespace> is required only when it is insufficient
+to unambiguously resolve a service in the service registry. The <Hostname> is a fully qualified host name of a
+service defined by the Kubernetes service or ServiceEntry.</p>
+
+<p>Example: &ldquo;rls.default.svc.cluster.local&rdquo; or &ldquo;bar/rls.example.com&rdquo;.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="MeshConfig-ExtensionProvider-RateLimitProvider-port">
+<td><code>port</code></td>
+<td><code>uint32</code></td>
+<td>
+<p>REQUIRED. Specifies the port of the service.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="MeshConfig-ExtensionProvider-RateLimitProvider-domain">
+<td><code>domain</code></td>
+<td><code>string</code></td>
+<td>
+<p>The rate limit domain to use when calling the service.
+This corresponds to the <code>domain</code> field in the RateLimitRequest proto:
+https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/ratelimit/v3/rls.proto#service-ratelimit-v3-ratelimitrequest.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="MeshConfig-ExtensionProvider-RateLimitProvider-failure_mode_deny">
+<td><code>failureModeDeny</code></td>
+<td><code>bool</code></td>
+<td>
+<p>The behaviour in case the rate limiting service does not respond back.
+When it is set to true, the proxy will not allow traffic in case of
+communication failure between rate limiting service and the proxy.</p>
+
 </td>
 <td>
 No
diff --git a/policy/v1alpha1/ratelimit.pb.go b/policy/v1alpha1/ratelimit.pb.go
new file mode 100644
index 00000000000..547b00c00a0
--- /dev/null
+++ b/policy/v1alpha1/ratelimit.pb.go
@@ -0,0 +1,4569 @@
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: policy/v1alpha1/ratelimit.proto
+
+package v1alpha1
+
+import (
+	fmt "fmt"
+	proto "github.com/gogo/protobuf/proto"
+	types "github.com/gogo/protobuf/types"
+	io "io"
+	v1beta1 "istio.io/api/type/v1beta1"
+	math "math"
+	math_bits "math/bits"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
+
+// $schema: istio.policy.v1alpha1.RateLimit
+// $title: Rate limiting
+// $description: Rate limiting configuration
+// $location: https://istio.io/docs/reference/config/policy/ratelimit.html
+// $aliases: [/docs/reference/config/policy/v1alpha1/ratelimit]
+//
+// <!-- crd generation tags
+// +cue-gen:Policy:groupName:policy.istio.io
+// +cue-gen:Policy:version:v1alpha1
+// +cue-gen:Policy:storageVersion
+// +cue-gen:Policy:annotations:helm.sh/resource-policy=keep
+// +cue-gen:Policy:labels:app=istio-pilot,chart=istio,istio=policy,heritage=Tiller,release=istio
+// +cue-gen:Policy:subresource:status
+// +cue-gen:Policy:scope:Namespaced
+// +cue-gen:Policy:resource:categories=istio-io,policy-istio-io,shortNames=policy,plural=telemetries
+// +cue-gen:Policy:preserveUnknownFields:false
+// +cue-gen:Policy:printerColumn:name=Age,type=date,JSONPath=.metadata.creationTimestamp,description="CreationTimestamp is a timestamp
+// representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations.
+// Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+// Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata"
+// -->
+//
+// <!-- go code generation tags
+// +kubetype-gen
+// +kubetype-gen:groupVersion=policy.istio.io/v1alpha1
+// +genclient
+// +k8s:deepcopy-gen=true
+// -->
+type RateLimit struct {
+	// Types that are valid to be assigned to Binding:
+	//	*RateLimit_Workload
+	//	*RateLimit_Route
+	Binding isRateLimit_Binding `protobuf_oneof:"binding"`
+	// Optional. Specifies a set of descriptors that are evaluated against the
+	// rate limit policy.  The rate limit applies if any of the generated
+	// descriptors trigger a limit.
+	Descriptors []*RateLimitDescriptor `protobuf:"bytes,3,rep,name=descriptors,proto3" json:"descriptors,omitempty"`
+	// Types that are valid to be assigned to Policy:
+	//	*RateLimit_Global
+	//	*RateLimit_Local
+	Policy               isRateLimit_Policy `protobuf_oneof:"policy"`
+	XXX_NoUnkeyedLiteral struct{}           `json:"-"`
+	XXX_unrecognized     []byte             `json:"-"`
+	XXX_sizecache        int32              `json:"-"`
+}
+
+func (m *RateLimit) Reset()         { *m = RateLimit{} }
+func (m *RateLimit) String() string { return proto.CompactTextString(m) }
+func (*RateLimit) ProtoMessage()    {}
+func (*RateLimit) Descriptor() ([]byte, []int) {
+	return fileDescriptor_7b829187ad6375d0, []int{0}
+}
+func (m *RateLimit) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *RateLimit) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_RateLimit.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *RateLimit) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_RateLimit.Merge(m, src)
+}
+func (m *RateLimit) XXX_Size() int {
+	return m.Size()
+}
+func (m *RateLimit) XXX_DiscardUnknown() {
+	xxx_messageInfo_RateLimit.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_RateLimit proto.InternalMessageInfo
+
+type isRateLimit_Binding interface {
+	isRateLimit_Binding()
+	MarshalTo([]byte) (int, error)
+	Size() int
+}
+type isRateLimit_Policy interface {
+	isRateLimit_Policy()
+	MarshalTo([]byte) (int, error)
+	Size() int
+}
+
+type RateLimit_Workload struct {
+	Workload *v1beta1.WorkloadSelector `protobuf:"bytes,1,opt,name=workload,proto3,oneof" json:"workload,omitempty"`
+}
+type RateLimit_Route struct {
+	Route *RouteSelector `protobuf:"bytes,2,opt,name=route,proto3,oneof" json:"route,omitempty"`
+}
+type RateLimit_Global struct {
+	Global *ProviderRef `protobuf:"bytes,4,opt,name=global,proto3,oneof" json:"global,omitempty"`
+}
+type RateLimit_Local struct {
+	Local *LocalRateLimit `protobuf:"bytes,5,opt,name=local,proto3,oneof" json:"local,omitempty"`
+}
+
+func (*RateLimit_Workload) isRateLimit_Binding() {}
+func (*RateLimit_Route) isRateLimit_Binding()    {}
+func (*RateLimit_Global) isRateLimit_Policy()    {}
+func (*RateLimit_Local) isRateLimit_Policy()     {}
+
+func (m *RateLimit) GetBinding() isRateLimit_Binding {
+	if m != nil {
+		return m.Binding
+	}
+	return nil
+}
+func (m *RateLimit) GetPolicy() isRateLimit_Policy {
+	if m != nil {
+		return m.Policy
+	}
+	return nil
+}
+
+func (m *RateLimit) GetWorkload() *v1beta1.WorkloadSelector {
+	if x, ok := m.GetBinding().(*RateLimit_Workload); ok {
+		return x.Workload
+	}
+	return nil
+}
+
+func (m *RateLimit) GetRoute() *RouteSelector {
+	if x, ok := m.GetBinding().(*RateLimit_Route); ok {
+		return x.Route
+	}
+	return nil
+}
+
+func (m *RateLimit) GetDescriptors() []*RateLimitDescriptor {
+	if m != nil {
+		return m.Descriptors
+	}
+	return nil
+}
+
+func (m *RateLimit) GetGlobal() *ProviderRef {
+	if x, ok := m.GetPolicy().(*RateLimit_Global); ok {
+		return x.Global
+	}
+	return nil
+}
+
+func (m *RateLimit) GetLocal() *LocalRateLimit {
+	if x, ok := m.GetPolicy().(*RateLimit_Local); ok {
+		return x.Local
+	}
+	return nil
+}
+
+// XXX_OneofWrappers is for the internal use of the proto package.
+func (*RateLimit) XXX_OneofWrappers() []interface{} {
+	return []interface{}{
+		(*RateLimit_Workload)(nil),
+		(*RateLimit_Route)(nil),
+		(*RateLimit_Global)(nil),
+		(*RateLimit_Local)(nil),
+	}
+}
+
+// Route selector references a client networking resource to overlay the rate
+// limit filter application. This can be a service, a virtual service, or a
+// gateway resource. Route name designation is optional.
+// If no route name is provided, the rate limit applies to all routes. However,
+// the rate limit for a named route takes priority over the rate limit for the
+// entire resource.
+//
+// For example, a selector addressing a Kubernetes service:
+// ```yaml
+// name: foo
+// group: core
+// kind: Service
+// ```
+//
+// This selector references an HTTPRoute from a Kubernetes gateway:
+// ```yaml
+// name: foo
+// group: networking.x-k8s.io
+// kind: HTTPRoute
+// ```
+//
+// This selector references an individual route from a VirtualService:
+// ```yaml
+// name: foo
+// group: networking.istio.io
+// kind: VirtualService
+// route: blah
+// ```
+type RouteSelector struct {
+	// Resource name.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Resource API group.
+	Group string `protobuf:"bytes,2,opt,name=group,proto3" json:"group,omitempty"`
+	// Resource kind.
+	Kind string `protobuf:"bytes,3,opt,name=kind,proto3" json:"kind,omitempty"`
+	// Optional. Individual route rule name within the resource.
+	Route                string   `protobuf:"bytes,4,opt,name=route,proto3" json:"route,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *RouteSelector) Reset()         { *m = RouteSelector{} }
+func (m *RouteSelector) String() string { return proto.CompactTextString(m) }
+func (*RouteSelector) ProtoMessage()    {}
+func (*RouteSelector) Descriptor() ([]byte, []int) {
+	return fileDescriptor_7b829187ad6375d0, []int{1}
+}
+func (m *RouteSelector) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *RouteSelector) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_RouteSelector.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *RouteSelector) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_RouteSelector.Merge(m, src)
+}
+func (m *RouteSelector) XXX_Size() int {
+	return m.Size()
+}
+func (m *RouteSelector) XXX_DiscardUnknown() {
+	xxx_messageInfo_RouteSelector.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_RouteSelector proto.InternalMessageInfo
+
+func (m *RouteSelector) GetName() string {
+	if m != nil {
+		return m.Name
+	}
+	return ""
+}
+
+func (m *RouteSelector) GetGroup() string {
+	if m != nil {
+		return m.Group
+	}
+	return ""
+}
+
+func (m *RouteSelector) GetKind() string {
+	if m != nil {
+		return m.Kind
+	}
+	return ""
+}
+
+func (m *RouteSelector) GetRoute() string {
+	if m != nil {
+		return m.Route
+	}
+	return ""
+}
+
+// RateLimitDescriptor is an ordered sequence of entries used for classification of requests.
+//
+// The following descriptor produces the sequence `[(path, /), (uid, john)]` for a request to `/`
+// with a header `user-id` set to `john`:
+// ```yaml
+// entries:
+// - header:
+//     key: path
+//     name: :path
+// - header:
+//     key: uid
+//     name: user-id
+// ```
+//
+// The following descriptor produces the client SPIFFE service account URI:
+// ```yaml
+// entries:
+// - expression:
+//     key: client-id
+//     text: connection.uri_san_peer_certificate
+// ```
+type RateLimitDescriptor struct {
+	Entries              []*RateLimitEntry `protobuf:"bytes,1,rep,name=entries,proto3" json:"entries,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}          `json:"-"`
+	XXX_unrecognized     []byte            `json:"-"`
+	XXX_sizecache        int32             `json:"-"`
+}
+
+func (m *RateLimitDescriptor) Reset()         { *m = RateLimitDescriptor{} }
+func (m *RateLimitDescriptor) String() string { return proto.CompactTextString(m) }
+func (*RateLimitDescriptor) ProtoMessage()    {}
+func (*RateLimitDescriptor) Descriptor() ([]byte, []int) {
+	return fileDescriptor_7b829187ad6375d0, []int{2}
+}
+func (m *RateLimitDescriptor) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *RateLimitDescriptor) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_RateLimitDescriptor.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *RateLimitDescriptor) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_RateLimitDescriptor.Merge(m, src)
+}
+func (m *RateLimitDescriptor) XXX_Size() int {
+	return m.Size()
+}
+func (m *RateLimitDescriptor) XXX_DiscardUnknown() {
+	xxx_messageInfo_RateLimitDescriptor.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_RateLimitDescriptor proto.InternalMessageInfo
+
+func (m *RateLimitDescriptor) GetEntries() []*RateLimitEntry {
+	if m != nil {
+		return m.Entries
+	}
+	return nil
+}
+
+// RateLimitEntry is a property of the request used for classification of requests.
+type RateLimitEntry struct {
+	// Types that are valid to be assigned to EntryType:
+	//	*RateLimitEntry_Header
+	//	*RateLimitEntry_HeaderMatch
+	//	*RateLimitEntry_Constant
+	//	*RateLimitEntry_Expression_
+	EntryType            isRateLimitEntry_EntryType `protobuf_oneof:"entry_type"`
+	XXX_NoUnkeyedLiteral struct{}                   `json:"-"`
+	XXX_unrecognized     []byte                     `json:"-"`
+	XXX_sizecache        int32                      `json:"-"`
+}
+
+func (m *RateLimitEntry) Reset()         { *m = RateLimitEntry{} }
+func (m *RateLimitEntry) String() string { return proto.CompactTextString(m) }
+func (*RateLimitEntry) ProtoMessage()    {}
+func (*RateLimitEntry) Descriptor() ([]byte, []int) {
+	return fileDescriptor_7b829187ad6375d0, []int{3}
+}
+func (m *RateLimitEntry) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *RateLimitEntry) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_RateLimitEntry.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *RateLimitEntry) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_RateLimitEntry.Merge(m, src)
+}
+func (m *RateLimitEntry) XXX_Size() int {
+	return m.Size()
+}
+func (m *RateLimitEntry) XXX_DiscardUnknown() {
+	xxx_messageInfo_RateLimitEntry.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_RateLimitEntry proto.InternalMessageInfo
+
+type isRateLimitEntry_EntryType interface {
+	isRateLimitEntry_EntryType()
+	MarshalTo([]byte) (int, error)
+	Size() int
+}
+
+type RateLimitEntry_Header struct {
+	Header *RateLimitEntry_RequestHeader `protobuf:"bytes,1,opt,name=header,proto3,oneof" json:"header,omitempty"`
+}
+type RateLimitEntry_HeaderMatch struct {
+	HeaderMatch *RateLimitEntry_RequestHeaderMatch `protobuf:"bytes,2,opt,name=header_match,json=headerMatch,proto3,oneof" json:"header_match,omitempty"`
+}
+type RateLimitEntry_Constant struct {
+	Constant *RateLimitEntry_ConstantEntry `protobuf:"bytes,3,opt,name=constant,proto3,oneof" json:"constant,omitempty"`
+}
+type RateLimitEntry_Expression_ struct {
+	Expression *RateLimitEntry_Expression `protobuf:"bytes,4,opt,name=expression,proto3,oneof" json:"expression,omitempty"`
+}
+
+func (*RateLimitEntry_Header) isRateLimitEntry_EntryType()      {}
+func (*RateLimitEntry_HeaderMatch) isRateLimitEntry_EntryType() {}
+func (*RateLimitEntry_Constant) isRateLimitEntry_EntryType()    {}
+func (*RateLimitEntry_Expression_) isRateLimitEntry_EntryType() {}
+
+func (m *RateLimitEntry) GetEntryType() isRateLimitEntry_EntryType {
+	if m != nil {
+		return m.EntryType
+	}
+	return nil
+}
+
+func (m *RateLimitEntry) GetHeader() *RateLimitEntry_RequestHeader {
+	if x, ok := m.GetEntryType().(*RateLimitEntry_Header); ok {
+		return x.Header
+	}
+	return nil
+}
+
+func (m *RateLimitEntry) GetHeaderMatch() *RateLimitEntry_RequestHeaderMatch {
+	if x, ok := m.GetEntryType().(*RateLimitEntry_HeaderMatch); ok {
+		return x.HeaderMatch
+	}
+	return nil
+}
+
+func (m *RateLimitEntry) GetConstant() *RateLimitEntry_ConstantEntry {
+	if x, ok := m.GetEntryType().(*RateLimitEntry_Constant); ok {
+		return x.Constant
+	}
+	return nil
+}
+
+func (m *RateLimitEntry) GetExpression() *RateLimitEntry_Expression {
+	if x, ok := m.GetEntryType().(*RateLimitEntry_Expression_); ok {
+		return x.Expression
+	}
+	return nil
+}
+
+// XXX_OneofWrappers is for the internal use of the proto package.
+func (*RateLimitEntry) XXX_OneofWrappers() []interface{} {
+	return []interface{}{
+		(*RateLimitEntry_Header)(nil),
+		(*RateLimitEntry_HeaderMatch)(nil),
+		(*RateLimitEntry_Constant)(nil),
+		(*RateLimitEntry_Expression_)(nil),
+	}
+}
+
+// Entry obtained a request header value.
+type RateLimitEntry_RequestHeader struct {
+	// Descriptor entry key.
+	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	// Request header name. The value of the header is used as the entry value.
+	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	// When true, the descriptor entry is omitted from the descriptor if the header is absent.
+	// By default, the entire descriptor is skipped and the rate limit is not applied.
+	SkipIfAbsent         bool     `protobuf:"varint,3,opt,name=skip_if_absent,json=skipIfAbsent,proto3" json:"skip_if_absent,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *RateLimitEntry_RequestHeader) Reset()         { *m = RateLimitEntry_RequestHeader{} }
+func (m *RateLimitEntry_RequestHeader) String() string { return proto.CompactTextString(m) }
+func (*RateLimitEntry_RequestHeader) ProtoMessage()    {}
+func (*RateLimitEntry_RequestHeader) Descriptor() ([]byte, []int) {
+	return fileDescriptor_7b829187ad6375d0, []int{3, 0}
+}
+func (m *RateLimitEntry_RequestHeader) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *RateLimitEntry_RequestHeader) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_RateLimitEntry_RequestHeader.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *RateLimitEntry_RequestHeader) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_RateLimitEntry_RequestHeader.Merge(m, src)
+}
+func (m *RateLimitEntry_RequestHeader) XXX_Size() int {
+	return m.Size()
+}
+func (m *RateLimitEntry_RequestHeader) XXX_DiscardUnknown() {
+	xxx_messageInfo_RateLimitEntry_RequestHeader.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_RateLimitEntry_RequestHeader proto.InternalMessageInfo
+
+func (m *RateLimitEntry_RequestHeader) GetKey() string {
+	if m != nil {
+		return m.Key
+	}
+	return ""
+}
+
+func (m *RateLimitEntry_RequestHeader) GetName() string {
+	if m != nil {
+		return m.Name
+	}
+	return ""
+}
+
+func (m *RateLimitEntry_RequestHeader) GetSkipIfAbsent() bool {
+	if m != nil {
+		return m.SkipIfAbsent
+	}
+	return false
+}
+
+// Entry obtained by testing a request header value.
+type RateLimitEntry_RequestHeaderMatch struct {
+	// Descriptor entry value. The key is always `header_match`.
+	Value string `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty"`
+	// The request matches when it matches all conditions.
+	Conditions           []*RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition `protobuf:"bytes,3,rep,name=conditions,proto3" json:"conditions,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                                                  `json:"-"`
+	XXX_unrecognized     []byte                                                    `json:"-"`
+	XXX_sizecache        int32                                                     `json:"-"`
+}
+
+func (m *RateLimitEntry_RequestHeaderMatch) Reset()         { *m = RateLimitEntry_RequestHeaderMatch{} }
+func (m *RateLimitEntry_RequestHeaderMatch) String() string { return proto.CompactTextString(m) }
+func (*RateLimitEntry_RequestHeaderMatch) ProtoMessage()    {}
+func (*RateLimitEntry_RequestHeaderMatch) Descriptor() ([]byte, []int) {
+	return fileDescriptor_7b829187ad6375d0, []int{3, 1}
+}
+func (m *RateLimitEntry_RequestHeaderMatch) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *RateLimitEntry_RequestHeaderMatch) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_RateLimitEntry_RequestHeaderMatch.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *RateLimitEntry_RequestHeaderMatch) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_RateLimitEntry_RequestHeaderMatch.Merge(m, src)
+}
+func (m *RateLimitEntry_RequestHeaderMatch) XXX_Size() int {
+	return m.Size()
+}
+func (m *RateLimitEntry_RequestHeaderMatch) XXX_DiscardUnknown() {
+	xxx_messageInfo_RateLimitEntry_RequestHeaderMatch.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_RateLimitEntry_RequestHeaderMatch proto.InternalMessageInfo
+
+func (m *RateLimitEntry_RequestHeaderMatch) GetValue() string {
+	if m != nil {
+		return m.Value
+	}
+	return ""
+}
+
+func (m *RateLimitEntry_RequestHeaderMatch) GetConditions() []*RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition {
+	if m != nil {
+		return m.Conditions
+	}
+	return nil
+}
+
+// Header match condition evaluates a request header against one of the patterns.
+// Use `:authority` header to refer to HTTP/1.1 Host header and `:method`
+// header to refer to HTTP method.
+type RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition struct {
+	// Header name.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Types that are valid to be assigned to Condition:
+	//	*RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Exact
+	//	*RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Prefix
+	//	*RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Present
+	Condition            isRateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Condition `protobuf_oneof:"condition"`
+	XXX_NoUnkeyedLiteral struct{}                                                           `json:"-"`
+	XXX_unrecognized     []byte                                                             `json:"-"`
+	XXX_sizecache        int32                                                              `json:"-"`
+}
+
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) Reset() {
+	*m = RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition{}
+}
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) String() string {
+	return proto.CompactTextString(m)
+}
+func (*RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) ProtoMessage() {}
+func (*RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) Descriptor() ([]byte, []int) {
+	return fileDescriptor_7b829187ad6375d0, []int{3, 1, 0}
+}
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition.Merge(m, src)
+}
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) XXX_Size() int {
+	return m.Size()
+}
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) XXX_DiscardUnknown() {
+	xxx_messageInfo_RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition proto.InternalMessageInfo
+
+type isRateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Condition interface {
+	isRateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Condition()
+	MarshalTo([]byte) (int, error)
+	Size() int
+}
+
+type RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Exact struct {
+	Exact string `protobuf:"bytes,2,opt,name=exact,proto3,oneof" json:"exact,omitempty"`
+}
+type RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Prefix struct {
+	Prefix string `protobuf:"bytes,3,opt,name=prefix,proto3,oneof" json:"prefix,omitempty"`
+}
+type RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Present struct {
+	Present bool `protobuf:"varint,4,opt,name=present,proto3,oneof" json:"present,omitempty"`
+}
+
+func (*RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Exact) isRateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Condition() {
+}
+func (*RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Prefix) isRateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Condition() {
+}
+func (*RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Present) isRateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Condition() {
+}
+
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) GetCondition() isRateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Condition {
+	if m != nil {
+		return m.Condition
+	}
+	return nil
+}
+
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) GetName() string {
+	if m != nil {
+		return m.Name
+	}
+	return ""
+}
+
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) GetExact() string {
+	if x, ok := m.GetCondition().(*RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Exact); ok {
+		return x.Exact
+	}
+	return ""
+}
+
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) GetPrefix() string {
+	if x, ok := m.GetCondition().(*RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Prefix); ok {
+		return x.Prefix
+	}
+	return ""
+}
+
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) GetPresent() bool {
+	if x, ok := m.GetCondition().(*RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Present); ok {
+		return x.Present
+	}
+	return false
+}
+
+// XXX_OneofWrappers is for the internal use of the proto package.
+func (*RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) XXX_OneofWrappers() []interface{} {
+	return []interface{}{
+		(*RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Exact)(nil),
+		(*RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Prefix)(nil),
+		(*RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Present)(nil),
+	}
+}
+
+// Constant entry.
+type RateLimitEntry_ConstantEntry struct {
+	// Descriptor entry key.
+	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	// Descriptor entry value.
+	Value                string   `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *RateLimitEntry_ConstantEntry) Reset()         { *m = RateLimitEntry_ConstantEntry{} }
+func (m *RateLimitEntry_ConstantEntry) String() string { return proto.CompactTextString(m) }
+func (*RateLimitEntry_ConstantEntry) ProtoMessage()    {}
+func (*RateLimitEntry_ConstantEntry) Descriptor() ([]byte, []int) {
+	return fileDescriptor_7b829187ad6375d0, []int{3, 2}
+}
+func (m *RateLimitEntry_ConstantEntry) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *RateLimitEntry_ConstantEntry) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_RateLimitEntry_ConstantEntry.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *RateLimitEntry_ConstantEntry) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_RateLimitEntry_ConstantEntry.Merge(m, src)
+}
+func (m *RateLimitEntry_ConstantEntry) XXX_Size() int {
+	return m.Size()
+}
+func (m *RateLimitEntry_ConstantEntry) XXX_DiscardUnknown() {
+	xxx_messageInfo_RateLimitEntry_ConstantEntry.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_RateLimitEntry_ConstantEntry proto.InternalMessageInfo
+
+func (m *RateLimitEntry_ConstantEntry) GetKey() string {
+	if m != nil {
+		return m.Key
+	}
+	return ""
+}
+
+func (m *RateLimitEntry_ConstantEntry) GetValue() string {
+	if m != nil {
+		return m.Value
+	}
+	return ""
+}
+
+// CEL expression.
+// For example, the expression `filter_state['wasm.downstream_peer'].labels['app'].value`
+// produces the `app` label value for the downstream peer.
+// See https://istio.io/latest/docs/tasks/observability/metrics/customize-metrics/#use-expressions-for-values.
+type RateLimitEntry_Expression struct {
+	// Descriptor entry key.
+	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	// If set to true, the descriptor entry is omitted if the expression evaluates to an error.
+	// By default, the rate limit is not applied for this descriptor when an expression produces an error.
+	SkipIfError bool `protobuf:"varint,2,opt,name=skip_if_error,json=skipIfError,proto3" json:"skip_if_error,omitempty"`
+	// Descriptor expression.
+	Text                 string   `protobuf:"bytes,3,opt,name=text,proto3" json:"text,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *RateLimitEntry_Expression) Reset()         { *m = RateLimitEntry_Expression{} }
+func (m *RateLimitEntry_Expression) String() string { return proto.CompactTextString(m) }
+func (*RateLimitEntry_Expression) ProtoMessage()    {}
+func (*RateLimitEntry_Expression) Descriptor() ([]byte, []int) {
+	return fileDescriptor_7b829187ad6375d0, []int{3, 3}
+}
+func (m *RateLimitEntry_Expression) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *RateLimitEntry_Expression) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_RateLimitEntry_Expression.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *RateLimitEntry_Expression) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_RateLimitEntry_Expression.Merge(m, src)
+}
+func (m *RateLimitEntry_Expression) XXX_Size() int {
+	return m.Size()
+}
+func (m *RateLimitEntry_Expression) XXX_DiscardUnknown() {
+	xxx_messageInfo_RateLimitEntry_Expression.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_RateLimitEntry_Expression proto.InternalMessageInfo
+
+func (m *RateLimitEntry_Expression) GetKey() string {
+	if m != nil {
+		return m.Key
+	}
+	return ""
+}
+
+func (m *RateLimitEntry_Expression) GetSkipIfError() bool {
+	if m != nil {
+		return m.SkipIfError
+	}
+	return false
+}
+
+func (m *RateLimitEntry_Expression) GetText() string {
+	if m != nil {
+		return m.Text
+	}
+	return ""
+}
+
+// References a rate limit extension provider from the mesh configuration.
+type ProviderRef struct {
+	// Provider name.
+	Name                 string   `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ProviderRef) Reset()         { *m = ProviderRef{} }
+func (m *ProviderRef) String() string { return proto.CompactTextString(m) }
+func (*ProviderRef) ProtoMessage()    {}
+func (*ProviderRef) Descriptor() ([]byte, []int) {
+	return fileDescriptor_7b829187ad6375d0, []int{4}
+}
+func (m *ProviderRef) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *ProviderRef) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_ProviderRef.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *ProviderRef) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ProviderRef.Merge(m, src)
+}
+func (m *ProviderRef) XXX_Size() int {
+	return m.Size()
+}
+func (m *ProviderRef) XXX_DiscardUnknown() {
+	xxx_messageInfo_ProviderRef.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ProviderRef proto.InternalMessageInfo
+
+func (m *ProviderRef) GetName() string {
+	if m != nil {
+		return m.Name
+	}
+	return ""
+}
+
+// Local rate limiting policy using a token bucket algorithm.
+type LocalRateLimit struct {
+	// The token bucket configuration to use for rate limiting requests that are
+	// processed by this filter. Each request processed by the filter consumes a
+	// single token. If the token is available, the request will be allowed. If
+	// no tokens are available, the proxy responds with 429.
+	TokenBucket *LocalRateLimit_TokenBucket `protobuf:"bytes,1,opt,name=token_bucket,json=tokenBucket,proto3" json:"token_bucket,omitempty"`
+	// Descriptor overrides. The rate limit descriptor list to use in the local
+	// rate limit to override on. The rate limit descriptor is selected by the
+	// first full match from the request descriptors. Each descriptor token bucket
+	// fill interval must be a multiple of the global token bucket's interval.
+	// The descriptors match verbatim. If a descriptor match is detected, then the
+	// descriptor bucket is used to decide whether to rate limit the request instead of
+	// the global token bucket.
+	Descriptors          []*LocalRateLimit_LocalRateLimitDescriptor `protobuf:"bytes,2,rep,name=descriptors,proto3" json:"descriptors,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                                   `json:"-"`
+	XXX_unrecognized     []byte                                     `json:"-"`
+	XXX_sizecache        int32                                      `json:"-"`
+}
+
+func (m *LocalRateLimit) Reset()         { *m = LocalRateLimit{} }
+func (m *LocalRateLimit) String() string { return proto.CompactTextString(m) }
+func (*LocalRateLimit) ProtoMessage()    {}
+func (*LocalRateLimit) Descriptor() ([]byte, []int) {
+	return fileDescriptor_7b829187ad6375d0, []int{5}
+}
+func (m *LocalRateLimit) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *LocalRateLimit) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_LocalRateLimit.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *LocalRateLimit) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_LocalRateLimit.Merge(m, src)
+}
+func (m *LocalRateLimit) XXX_Size() int {
+	return m.Size()
+}
+func (m *LocalRateLimit) XXX_DiscardUnknown() {
+	xxx_messageInfo_LocalRateLimit.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_LocalRateLimit proto.InternalMessageInfo
+
+func (m *LocalRateLimit) GetTokenBucket() *LocalRateLimit_TokenBucket {
+	if m != nil {
+		return m.TokenBucket
+	}
+	return nil
+}
+
+func (m *LocalRateLimit) GetDescriptors() []*LocalRateLimit_LocalRateLimitDescriptor {
+	if m != nil {
+		return m.Descriptors
+	}
+	return nil
+}
+
+// Configures a token bucket.
+type LocalRateLimit_TokenBucket struct {
+	// The maximum tokens that the bucket can hold. This is also the number of tokens that the bucket
+	// initially contains.
+	MaxTokens uint32 `protobuf:"varint,1,opt,name=max_tokens,json=maxTokens,proto3" json:"max_tokens,omitempty"`
+	// The number of tokens added to the bucket during each fill interval. If not specified, defaults
+	// to a single token.
+	TokensPerFill *types.UInt32Value `protobuf:"bytes,2,opt,name=tokens_per_fill,json=tokensPerFill,proto3" json:"tokens_per_fill,omitempty"`
+	// The fill interval that tokens are added to the bucket. During each fill interval
+	// `tokens_per_fill` are added to the bucket. The bucket will never contain more than
+	// `max_tokens` tokens. The interval must be >=50ms.
+	FillInterval         *types.Duration `protobuf:"bytes,3,opt,name=fill_interval,json=fillInterval,proto3" json:"fill_interval,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}        `json:"-"`
+	XXX_unrecognized     []byte          `json:"-"`
+	XXX_sizecache        int32           `json:"-"`
+}
+
+func (m *LocalRateLimit_TokenBucket) Reset()         { *m = LocalRateLimit_TokenBucket{} }
+func (m *LocalRateLimit_TokenBucket) String() string { return proto.CompactTextString(m) }
+func (*LocalRateLimit_TokenBucket) ProtoMessage()    {}
+func (*LocalRateLimit_TokenBucket) Descriptor() ([]byte, []int) {
+	return fileDescriptor_7b829187ad6375d0, []int{5, 0}
+}
+func (m *LocalRateLimit_TokenBucket) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *LocalRateLimit_TokenBucket) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_LocalRateLimit_TokenBucket.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *LocalRateLimit_TokenBucket) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_LocalRateLimit_TokenBucket.Merge(m, src)
+}
+func (m *LocalRateLimit_TokenBucket) XXX_Size() int {
+	return m.Size()
+}
+func (m *LocalRateLimit_TokenBucket) XXX_DiscardUnknown() {
+	xxx_messageInfo_LocalRateLimit_TokenBucket.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_LocalRateLimit_TokenBucket proto.InternalMessageInfo
+
+func (m *LocalRateLimit_TokenBucket) GetMaxTokens() uint32 {
+	if m != nil {
+		return m.MaxTokens
+	}
+	return 0
+}
+
+func (m *LocalRateLimit_TokenBucket) GetTokensPerFill() *types.UInt32Value {
+	if m != nil {
+		return m.TokensPerFill
+	}
+	return nil
+}
+
+func (m *LocalRateLimit_TokenBucket) GetFillInterval() *types.Duration {
+	if m != nil {
+		return m.FillInterval
+	}
+	return nil
+}
+
+// Per-descriptor local rate limit override.
+type LocalRateLimit_LocalRateLimitDescriptor struct {
+	// Override token bucket. The fill interval must be a multiple of the global
+	// token bucket.
+	TokenBucket *LocalRateLimit_TokenBucket `protobuf:"bytes,1,opt,name=token_bucket,json=tokenBucket,proto3" json:"token_bucket,omitempty"`
+	// Descriptor entries to be matched exactly.
+	Entries              []*LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry `protobuf:"bytes,2,rep,name=entries,proto3" json:"entries,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}                                                   `json:"-"`
+	XXX_unrecognized     []byte                                                     `json:"-"`
+	XXX_sizecache        int32                                                      `json:"-"`
+}
+
+func (m *LocalRateLimit_LocalRateLimitDescriptor) Reset() {
+	*m = LocalRateLimit_LocalRateLimitDescriptor{}
+}
+func (m *LocalRateLimit_LocalRateLimitDescriptor) String() string { return proto.CompactTextString(m) }
+func (*LocalRateLimit_LocalRateLimitDescriptor) ProtoMessage()    {}
+func (*LocalRateLimit_LocalRateLimitDescriptor) Descriptor() ([]byte, []int) {
+	return fileDescriptor_7b829187ad6375d0, []int{5, 1}
+}
+func (m *LocalRateLimit_LocalRateLimitDescriptor) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *LocalRateLimit_LocalRateLimitDescriptor) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_LocalRateLimit_LocalRateLimitDescriptor.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *LocalRateLimit_LocalRateLimitDescriptor) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_LocalRateLimit_LocalRateLimitDescriptor.Merge(m, src)
+}
+func (m *LocalRateLimit_LocalRateLimitDescriptor) XXX_Size() int {
+	return m.Size()
+}
+func (m *LocalRateLimit_LocalRateLimitDescriptor) XXX_DiscardUnknown() {
+	xxx_messageInfo_LocalRateLimit_LocalRateLimitDescriptor.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_LocalRateLimit_LocalRateLimitDescriptor proto.InternalMessageInfo
+
+func (m *LocalRateLimit_LocalRateLimitDescriptor) GetTokenBucket() *LocalRateLimit_TokenBucket {
+	if m != nil {
+		return m.TokenBucket
+	}
+	return nil
+}
+
+func (m *LocalRateLimit_LocalRateLimitDescriptor) GetEntries() []*LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry {
+	if m != nil {
+		return m.Entries
+	}
+	return nil
+}
+
+// A descriptor entry.
+type LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry struct {
+	Key                  string   `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	Value                string   `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) Reset() {
+	*m = LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry{}
+}
+func (m *LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) String() string {
+	return proto.CompactTextString(m)
+}
+func (*LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) ProtoMessage() {}
+func (*LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) Descriptor() ([]byte, []int) {
+	return fileDescriptor_7b829187ad6375d0, []int{5, 1, 0}
+}
+func (m *LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) XXX_Unmarshal(b []byte) error {
+	return m.Unmarshal(b)
+}
+func (m *LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	if deterministic {
+		return xxx_messageInfo_LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry.Marshal(b, m, deterministic)
+	} else {
+		b = b[:cap(b)]
+		n, err := m.MarshalToSizedBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		return b[:n], nil
+	}
+}
+func (m *LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry.Merge(m, src)
+}
+func (m *LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) XXX_Size() int {
+	return m.Size()
+}
+func (m *LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) XXX_DiscardUnknown() {
+	xxx_messageInfo_LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry proto.InternalMessageInfo
+
+func (m *LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) GetKey() string {
+	if m != nil {
+		return m.Key
+	}
+	return ""
+}
+
+func (m *LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) GetValue() string {
+	if m != nil {
+		return m.Value
+	}
+	return ""
+}
+
+func init() {
+	proto.RegisterType((*RateLimit)(nil), "istio.policy.v1alpha1.RateLimit")
+	proto.RegisterType((*RouteSelector)(nil), "istio.policy.v1alpha1.RouteSelector")
+	proto.RegisterType((*RateLimitDescriptor)(nil), "istio.policy.v1alpha1.RateLimitDescriptor")
+	proto.RegisterType((*RateLimitEntry)(nil), "istio.policy.v1alpha1.RateLimitEntry")
+	proto.RegisterType((*RateLimitEntry_RequestHeader)(nil), "istio.policy.v1alpha1.RateLimitEntry.RequestHeader")
+	proto.RegisterType((*RateLimitEntry_RequestHeaderMatch)(nil), "istio.policy.v1alpha1.RateLimitEntry.RequestHeaderMatch")
+	proto.RegisterType((*RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition)(nil), "istio.policy.v1alpha1.RateLimitEntry.RequestHeaderMatch.HeaderMatchCondition")
+	proto.RegisterType((*RateLimitEntry_ConstantEntry)(nil), "istio.policy.v1alpha1.RateLimitEntry.ConstantEntry")
+	proto.RegisterType((*RateLimitEntry_Expression)(nil), "istio.policy.v1alpha1.RateLimitEntry.Expression")
+	proto.RegisterType((*ProviderRef)(nil), "istio.policy.v1alpha1.ProviderRef")
+	proto.RegisterType((*LocalRateLimit)(nil), "istio.policy.v1alpha1.LocalRateLimit")
+	proto.RegisterType((*LocalRateLimit_TokenBucket)(nil), "istio.policy.v1alpha1.LocalRateLimit.TokenBucket")
+	proto.RegisterType((*LocalRateLimit_LocalRateLimitDescriptor)(nil), "istio.policy.v1alpha1.LocalRateLimit.LocalRateLimitDescriptor")
+	proto.RegisterType((*LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry)(nil), "istio.policy.v1alpha1.LocalRateLimit.LocalRateLimitDescriptor.DescriptorEntry")
+}
+
+func init() { proto.RegisterFile("policy/v1alpha1/ratelimit.proto", fileDescriptor_7b829187ad6375d0) }
+
+var fileDescriptor_7b829187ad6375d0 = []byte{
+	// 911 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xb4, 0x56, 0xef, 0x8e, 0xdb, 0x44,
+	0x10, 0x8f, 0x73, 0x97, 0x5c, 0x32, 0x4e, 0xae, 0x68, 0x29, 0xc8, 0x98, 0x72, 0x94, 0xa8, 0x95,
+	0xaa, 0x7e, 0x70, 0xc8, 0xdd, 0x07, 0x40, 0x2a, 0x45, 0xa4, 0x77, 0x28, 0x27, 0xdd, 0xa1, 0xb2,
+	0x94, 0x43, 0x02, 0x21, 0xb3, 0x71, 0x36, 0xc9, 0x2a, 0x8e, 0xd7, 0xac, 0x37, 0x69, 0xf2, 0x00,
+	0x7d, 0x84, 0x3e, 0x00, 0xaf, 0xc0, 0x53, 0xf0, 0x91, 0x47, 0x40, 0xf7, 0x9d, 0x77, 0x40, 0xbb,
+	0x6b, 0x27, 0xf6, 0x35, 0x11, 0xd1, 0xa1, 0x7e, 0x9b, 0xd9, 0x9d, 0xdf, 0x78, 0xe6, 0x37, 0x7f,
+	0xd6, 0xf0, 0x71, 0xcc, 0x43, 0x16, 0x2c, 0xdb, 0xf3, 0x0e, 0x09, 0xe3, 0x31, 0xe9, 0xb4, 0x05,
+	0x91, 0x34, 0x64, 0x53, 0x26, 0xbd, 0x58, 0x70, 0xc9, 0xd1, 0x7b, 0x2c, 0x91, 0x8c, 0x7b, 0xc6,
+	0xcc, 0xcb, 0xcc, 0xdc, 0x0f, 0xe5, 0x32, 0xa6, 0xed, 0x79, 0xa7, 0x4f, 0x25, 0xe9, 0xb4, 0x13,
+	0x1a, 0xd2, 0x40, 0x72, 0x61, 0x30, 0xee, 0xd1, 0x88, 0xf3, 0x51, 0x48, 0xdb, 0x5a, 0xeb, 0xcf,
+	0x86, 0xed, 0x97, 0x82, 0xc4, 0x31, 0x15, 0xc9, 0xb6, 0xfb, 0xc1, 0x4c, 0x10, 0xc9, 0x78, 0x64,
+	0xee, 0x5b, 0xff, 0x94, 0xa1, 0x8e, 0x89, 0xa4, 0x17, 0x2a, 0x0e, 0xd4, 0x85, 0xda, 0x4b, 0x2e,
+	0x26, 0x21, 0x27, 0x03, 0xc7, 0xba, 0x6f, 0x3d, 0xb2, 0x8f, 0x1f, 0x78, 0x26, 0x28, 0x15, 0x83,
+	0x97, 0xc6, 0xe0, 0xfd, 0x98, 0xda, 0x7c, 0x9f, 0xc6, 0xd2, 0x2b, 0xe1, 0x15, 0x0e, 0x3d, 0x81,
+	0x8a, 0xe0, 0x33, 0x49, 0x9d, 0x72, 0xc1, 0xc1, 0x8d, 0xac, 0x3c, 0xac, 0x6c, 0x72, 0x0e, 0x0c,
+	0x08, 0x5d, 0x80, 0x3d, 0xa0, 0x49, 0x20, 0x58, 0x2c, 0xb9, 0x48, 0x9c, 0xbd, 0xfb, 0x7b, 0x8f,
+	0xec, 0xe3, 0xc7, 0xdb, 0x7c, 0x64, 0x81, 0x9f, 0xae, 0x20, 0x38, 0x0f, 0x47, 0x4f, 0xa0, 0x3a,
+	0x0a, 0x79, 0x9f, 0x84, 0xce, 0xbe, 0x0e, 0xa6, 0xb5, 0xc5, 0xd1, 0x73, 0xc1, 0xe7, 0x6c, 0x40,
+	0x05, 0xa6, 0xc3, 0x9e, 0x85, 0x53, 0x0c, 0xfa, 0x12, 0x2a, 0x21, 0x0f, 0x48, 0xe8, 0x54, 0x34,
+	0xf8, 0xe1, 0x16, 0xf0, 0x85, 0xb2, 0x59, 0x85, 0xd2, 0xb3, 0xb0, 0x41, 0x75, 0xeb, 0x70, 0xd0,
+	0x67, 0xd1, 0x80, 0x45, 0xa3, 0x6e, 0x0d, 0xaa, 0x06, 0xd5, 0x0a, 0xa0, 0x59, 0xc8, 0x1c, 0x21,
+	0xd8, 0x8f, 0xc8, 0x94, 0x6a, 0xba, 0xeb, 0x58, 0xcb, 0xe8, 0x2e, 0x54, 0x46, 0x82, 0xcf, 0x62,
+	0x4d, 0x61, 0x1d, 0x1b, 0x45, 0x59, 0x4e, 0x58, 0x34, 0x70, 0xf6, 0x8c, 0xa5, 0x92, 0x95, 0xa5,
+	0x21, 0x7b, 0xdf, 0x58, 0x6a, 0xa5, 0x75, 0x05, 0xef, 0x6e, 0xa0, 0x06, 0x7d, 0x05, 0x07, 0x34,
+	0x92, 0x82, 0xd1, 0xc4, 0xb1, 0x34, 0xaf, 0x0f, 0xff, 0x8b, 0xd7, 0xb3, 0x48, 0x8a, 0x25, 0xce,
+	0x50, 0xad, 0x57, 0x07, 0x70, 0x58, 0xbc, 0x43, 0x97, 0x50, 0x1d, 0x53, 0x32, 0xa0, 0x22, 0xed,
+	0x97, 0x93, 0x9d, 0x5c, 0x7a, 0x98, 0xfe, 0x36, 0xa3, 0x89, 0xec, 0x69, 0x68, 0xaf, 0x84, 0x53,
+	0x27, 0xe8, 0x17, 0x68, 0x18, 0xc9, 0x9f, 0x12, 0x19, 0x8c, 0xd3, 0x1e, 0xfa, 0xfc, 0x16, 0x4e,
+	0x2f, 0x15, 0xbe, 0x57, 0xc2, 0xf6, 0x78, 0xad, 0xa2, 0xef, 0xa0, 0x16, 0xf0, 0x28, 0x91, 0x24,
+	0x92, 0x9a, 0xc6, 0x9d, 0xe3, 0x7d, 0x96, 0xa2, 0xb4, 0xa6, 0xda, 0x3d, 0x73, 0x83, 0x30, 0x00,
+	0x5d, 0xc4, 0x82, 0x26, 0x09, 0xe3, 0x51, 0xda, 0x66, 0x9f, 0xee, 0xe6, 0xf4, 0x6c, 0x85, 0xeb,
+	0x95, 0x70, 0xce, 0x8b, 0xfb, 0x33, 0x34, 0x0b, 0xb9, 0xa0, 0x77, 0x60, 0x6f, 0x42, 0x97, 0x69,
+	0x8f, 0x28, 0x71, 0xd5, 0x36, 0xe5, 0x5c, 0xdb, 0x3c, 0x80, 0xc3, 0x64, 0xc2, 0x62, 0x9f, 0x0d,
+	0x7d, 0xd2, 0x4f, 0x68, 0x9a, 0x63, 0x0d, 0x37, 0xd4, 0xe9, 0xf9, 0xf0, 0x6b, 0x7d, 0xe6, 0xfe,
+	0x5e, 0x06, 0xf4, 0x26, 0x53, 0xaa, 0x93, 0xe6, 0x24, 0x9c, 0x65, 0x8d, 0x68, 0x14, 0x34, 0x05,
+	0x08, 0x78, 0x34, 0x60, 0x6a, 0x63, 0x64, 0xd3, 0x78, 0x79, 0xdb, 0x6a, 0x78, 0x39, 0xf9, 0x59,
+	0xe6, 0x15, 0xe7, 0x3e, 0xe0, 0xbe, 0xb2, 0xe0, 0xee, 0x26, 0xa3, 0x8d, 0x53, 0xf2, 0x3e, 0x54,
+	0xe8, 0x82, 0x04, 0xd2, 0x70, 0xa0, 0x56, 0x88, 0x56, 0x91, 0x03, 0xd5, 0x58, 0xd0, 0x21, 0x5b,
+	0x98, 0x49, 0x51, 0xdd, 0x65, 0x74, 0xe4, 0xc2, 0x81, 0xe2, 0x58, 0x31, 0xa3, 0x0a, 0x55, 0xeb,
+	0x95, 0x70, 0x76, 0xd0, 0xb5, 0xa1, 0xbe, 0x0a, 0xc4, 0xfd, 0x0c, 0x9a, 0x85, 0x8a, 0x6f, 0x28,
+	0xc0, 0x8a, 0xaf, 0x72, 0x8e, 0x2f, 0xf7, 0x0a, 0x60, 0x5d, 0xd5, 0x0d, 0xa8, 0x16, 0x34, 0xb3,
+	0x12, 0x51, 0x21, 0xb8, 0xd0, 0xe8, 0x1a, 0xb6, 0x4d, 0x85, 0xce, 0xd4, 0x91, 0xca, 0x55, 0xd2,
+	0x85, 0xcc, 0xe6, 0x5c, 0xc9, 0xdd, 0x06, 0x80, 0x1a, 0xc2, 0xa5, 0xaf, 0xf6, 0x70, 0xeb, 0x13,
+	0xb0, 0x73, 0x1b, 0x6b, 0x13, 0x39, 0xad, 0xd7, 0x15, 0x38, 0x2c, 0x2e, 0x26, 0xf4, 0x02, 0x1a,
+	0x92, 0x4f, 0x68, 0xe4, 0xf7, 0x67, 0xc1, 0x84, 0xca, 0x74, 0x60, 0x3b, 0x3b, 0x6d, 0x35, 0xef,
+	0x85, 0x42, 0x76, 0x35, 0x10, 0xdb, 0x72, 0xad, 0xa0, 0x5f, 0x8b, 0x0b, 0xbb, 0xac, 0x5b, 0xe4,
+	0xe9, 0x6e, 0x4e, 0x8b, 0xea, 0x96, 0x25, 0xee, 0xfe, 0x61, 0x81, 0x9d, 0xfb, 0x3c, 0xfa, 0x08,
+	0x60, 0x4a, 0x16, 0xbe, 0x0e, 0x22, 0xd1, 0x59, 0x34, 0x71, 0x7d, 0x4a, 0x16, 0xda, 0x26, 0x41,
+	0xa7, 0x70, 0xc7, 0x5c, 0xf9, 0x31, 0x15, 0xfe, 0x90, 0x85, 0x61, 0xba, 0x45, 0xee, 0x79, 0xe6,
+	0x2d, 0xf4, 0xb2, 0xb7, 0xd0, 0xfb, 0xe1, 0x3c, 0x92, 0x27, 0xc7, 0x57, 0xaa, 0x72, 0xb8, 0x69,
+	0x40, 0xcf, 0xa9, 0xf8, 0x86, 0x85, 0x21, 0x7a, 0x0a, 0x4d, 0x05, 0xf5, 0x59, 0x24, 0xa9, 0x98,
+	0x93, 0x30, 0x5d, 0x17, 0x1f, 0xbc, 0xe1, 0xe3, 0x34, 0x7d, 0x4f, 0x71, 0x43, 0xd9, 0x9f, 0xa7,
+	0xe6, 0xee, 0xeb, 0x32, 0x38, 0xdb, 0xd2, 0x7b, 0x4b, 0x95, 0x18, 0xaf, 0xd7, 0xbb, 0xa9, 0xc2,
+	0xb7, 0xff, 0xaf, 0x0a, 0xde, 0x5a, 0x2c, 0xbe, 0x03, 0xee, 0x17, 0x70, 0xe7, 0xc6, 0xdd, 0xae,
+	0x03, 0xd2, 0x7d, 0xfc, 0xe7, 0xf5, 0x91, 0xf5, 0xd7, 0xf5, 0x91, 0xf5, 0xf7, 0xf5, 0x91, 0xf5,
+	0xd3, 0x3d, 0x13, 0x20, 0xe3, 0x6d, 0x12, 0xb3, 0xf6, 0x8d, 0xff, 0xa3, 0x7e, 0x55, 0x93, 0x7c,
+	0xf2, 0x6f, 0x00, 0x00, 0x00, 0xff, 0xff, 0x1d, 0xaf, 0xf1, 0xec, 0x39, 0x09, 0x00, 0x00,
+}
+
+func (m *RateLimit) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *RateLimit) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RateLimit) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.Policy != nil {
+		{
+			size := m.Policy.Size()
+			i -= size
+			if _, err := m.Policy.MarshalTo(dAtA[i:]); err != nil {
+				return 0, err
+			}
+		}
+	}
+	if len(m.Descriptors) > 0 {
+		for iNdEx := len(m.Descriptors) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Descriptors[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintRatelimit(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	if m.Binding != nil {
+		{
+			size := m.Binding.Size()
+			i -= size
+			if _, err := m.Binding.MarshalTo(dAtA[i:]); err != nil {
+				return 0, err
+			}
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *RateLimit_Workload) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RateLimit_Workload) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.Workload != nil {
+		{
+			size, err := m.Workload.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintRatelimit(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+func (m *RateLimit_Route) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RateLimit_Route) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.Route != nil {
+		{
+			size, err := m.Route.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintRatelimit(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	return len(dAtA) - i, nil
+}
+func (m *RateLimit_Global) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RateLimit_Global) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.Global != nil {
+		{
+			size, err := m.Global.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintRatelimit(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
+	}
+	return len(dAtA) - i, nil
+}
+func (m *RateLimit_Local) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RateLimit_Local) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.Local != nil {
+		{
+			size, err := m.Local.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintRatelimit(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x2a
+	}
+	return len(dAtA) - i, nil
+}
+func (m *RouteSelector) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *RouteSelector) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RouteSelector) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Route) > 0 {
+		i -= len(m.Route)
+		copy(dAtA[i:], m.Route)
+		i = encodeVarintRatelimit(dAtA, i, uint64(len(m.Route)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.Kind) > 0 {
+		i -= len(m.Kind)
+		copy(dAtA[i:], m.Kind)
+		i = encodeVarintRatelimit(dAtA, i, uint64(len(m.Kind)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Group) > 0 {
+		i -= len(m.Group)
+		copy(dAtA[i:], m.Group)
+		i = encodeVarintRatelimit(dAtA, i, uint64(len(m.Group)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = encodeVarintRatelimit(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *RateLimitDescriptor) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *RateLimitDescriptor) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RateLimitDescriptor) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Entries) > 0 {
+		for iNdEx := len(m.Entries) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Entries[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintRatelimit(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *RateLimitEntry) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *RateLimitEntry) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RateLimitEntry) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.EntryType != nil {
+		{
+			size := m.EntryType.Size()
+			i -= size
+			if _, err := m.EntryType.MarshalTo(dAtA[i:]); err != nil {
+				return 0, err
+			}
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *RateLimitEntry_Header) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RateLimitEntry_Header) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.Header != nil {
+		{
+			size, err := m.Header.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintRatelimit(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+func (m *RateLimitEntry_HeaderMatch) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RateLimitEntry_HeaderMatch) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.HeaderMatch != nil {
+		{
+			size, err := m.HeaderMatch.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintRatelimit(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	return len(dAtA) - i, nil
+}
+func (m *RateLimitEntry_Constant) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RateLimitEntry_Constant) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.Constant != nil {
+		{
+			size, err := m.Constant.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintRatelimit(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
+	}
+	return len(dAtA) - i, nil
+}
+func (m *RateLimitEntry_Expression_) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RateLimitEntry_Expression_) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.Expression != nil {
+		{
+			size, err := m.Expression.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintRatelimit(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x22
+	}
+	return len(dAtA) - i, nil
+}
+func (m *RateLimitEntry_RequestHeader) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *RateLimitEntry_RequestHeader) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RateLimitEntry_RequestHeader) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.SkipIfAbsent {
+		i--
+		if m.SkipIfAbsent {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = encodeVarintRatelimit(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Key) > 0 {
+		i -= len(m.Key)
+		copy(dAtA[i:], m.Key)
+		i = encodeVarintRatelimit(dAtA, i, uint64(len(m.Key)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *RateLimitEntry_RequestHeaderMatch) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *RateLimitEntry_RequestHeaderMatch) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RateLimitEntry_RequestHeaderMatch) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Conditions) > 0 {
+		for iNdEx := len(m.Conditions) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Conditions[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintRatelimit(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	if len(m.Value) > 0 {
+		i -= len(m.Value)
+		copy(dAtA[i:], m.Value)
+		i = encodeVarintRatelimit(dAtA, i, uint64(len(m.Value)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.Condition != nil {
+		{
+			size := m.Condition.Size()
+			i -= size
+			if _, err := m.Condition.MarshalTo(dAtA[i:]); err != nil {
+				return 0, err
+			}
+		}
+	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = encodeVarintRatelimit(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Exact) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Exact) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	i -= len(m.Exact)
+	copy(dAtA[i:], m.Exact)
+	i = encodeVarintRatelimit(dAtA, i, uint64(len(m.Exact)))
+	i--
+	dAtA[i] = 0x12
+	return len(dAtA) - i, nil
+}
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Prefix) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Prefix) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	i -= len(m.Prefix)
+	copy(dAtA[i:], m.Prefix)
+	i = encodeVarintRatelimit(dAtA, i, uint64(len(m.Prefix)))
+	i--
+	dAtA[i] = 0x1a
+	return len(dAtA) - i, nil
+}
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Present) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Present) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	i--
+	if m.Present {
+		dAtA[i] = 1
+	} else {
+		dAtA[i] = 0
+	}
+	i--
+	dAtA[i] = 0x20
+	return len(dAtA) - i, nil
+}
+func (m *RateLimitEntry_ConstantEntry) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *RateLimitEntry_ConstantEntry) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RateLimitEntry_ConstantEntry) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Value) > 0 {
+		i -= len(m.Value)
+		copy(dAtA[i:], m.Value)
+		i = encodeVarintRatelimit(dAtA, i, uint64(len(m.Value)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Key) > 0 {
+		i -= len(m.Key)
+		copy(dAtA[i:], m.Key)
+		i = encodeVarintRatelimit(dAtA, i, uint64(len(m.Key)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *RateLimitEntry_Expression) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *RateLimitEntry_Expression) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *RateLimitEntry_Expression) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Text) > 0 {
+		i -= len(m.Text)
+		copy(dAtA[i:], m.Text)
+		i = encodeVarintRatelimit(dAtA, i, uint64(len(m.Text)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.SkipIfError {
+		i--
+		if m.SkipIfError {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x10
+	}
+	if len(m.Key) > 0 {
+		i -= len(m.Key)
+		copy(dAtA[i:], m.Key)
+		i = encodeVarintRatelimit(dAtA, i, uint64(len(m.Key)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ProviderRef) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ProviderRef) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *ProviderRef) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = encodeVarintRatelimit(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *LocalRateLimit) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *LocalRateLimit) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *LocalRateLimit) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Descriptors) > 0 {
+		for iNdEx := len(m.Descriptors) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Descriptors[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintRatelimit(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if m.TokenBucket != nil {
+		{
+			size, err := m.TokenBucket.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintRatelimit(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *LocalRateLimit_TokenBucket) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *LocalRateLimit_TokenBucket) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *LocalRateLimit_TokenBucket) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if m.FillInterval != nil {
+		{
+			size, err := m.FillInterval.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintRatelimit(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.TokensPerFill != nil {
+		{
+			size, err := m.TokensPerFill.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintRatelimit(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.MaxTokens != 0 {
+		i = encodeVarintRatelimit(dAtA, i, uint64(m.MaxTokens))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *LocalRateLimit_LocalRateLimitDescriptor) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *LocalRateLimit_LocalRateLimitDescriptor) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *LocalRateLimit_LocalRateLimitDescriptor) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Entries) > 0 {
+		for iNdEx := len(m.Entries) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.Entries[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintRatelimit(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if m.TokenBucket != nil {
+		{
+			size, err := m.TokenBucket.MarshalToSizedBuffer(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = encodeVarintRatelimit(dAtA, i, uint64(size))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBuffer(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) MarshalTo(dAtA []byte) (int, error) {
+	size := m.Size()
+	return m.MarshalToSizedBuffer(dAtA[:size])
+}
+
+func (m *LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) MarshalToSizedBuffer(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.XXX_unrecognized != nil {
+		i -= len(m.XXX_unrecognized)
+		copy(dAtA[i:], m.XXX_unrecognized)
+	}
+	if len(m.Value) > 0 {
+		i -= len(m.Value)
+		copy(dAtA[i:], m.Value)
+		i = encodeVarintRatelimit(dAtA, i, uint64(len(m.Value)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Key) > 0 {
+		i -= len(m.Key)
+		copy(dAtA[i:], m.Key)
+		i = encodeVarintRatelimit(dAtA, i, uint64(len(m.Key)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func encodeVarintRatelimit(dAtA []byte, offset int, v uint64) int {
+	offset -= sovRatelimit(v)
+	base := offset
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return base
+}
+func (m *RateLimit) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Binding != nil {
+		n += m.Binding.Size()
+	}
+	if len(m.Descriptors) > 0 {
+		for _, e := range m.Descriptors {
+			l = e.Size()
+			n += 1 + l + sovRatelimit(uint64(l))
+		}
+	}
+	if m.Policy != nil {
+		n += m.Policy.Size()
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *RateLimit_Workload) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Workload != nil {
+		l = m.Workload.Size()
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	return n
+}
+func (m *RateLimit_Route) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Route != nil {
+		l = m.Route.Size()
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	return n
+}
+func (m *RateLimit_Global) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Global != nil {
+		l = m.Global.Size()
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	return n
+}
+func (m *RateLimit_Local) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Local != nil {
+		l = m.Local.Size()
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	return n
+}
+func (m *RouteSelector) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	l = len(m.Group)
+	if l > 0 {
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	l = len(m.Kind)
+	if l > 0 {
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	l = len(m.Route)
+	if l > 0 {
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *RateLimitDescriptor) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Entries) > 0 {
+		for _, e := range m.Entries {
+			l = e.Size()
+			n += 1 + l + sovRatelimit(uint64(l))
+		}
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *RateLimitEntry) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.EntryType != nil {
+		n += m.EntryType.Size()
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *RateLimitEntry_Header) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Header != nil {
+		l = m.Header.Size()
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	return n
+}
+func (m *RateLimitEntry_HeaderMatch) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.HeaderMatch != nil {
+		l = m.HeaderMatch.Size()
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	return n
+}
+func (m *RateLimitEntry_Constant) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Constant != nil {
+		l = m.Constant.Size()
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	return n
+}
+func (m *RateLimitEntry_Expression_) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Expression != nil {
+		l = m.Expression.Size()
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	return n
+}
+func (m *RateLimitEntry_RequestHeader) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Key)
+	if l > 0 {
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	if m.SkipIfAbsent {
+		n += 2
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *RateLimitEntry_RequestHeaderMatch) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Value)
+	if l > 0 {
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	if len(m.Conditions) > 0 {
+		for _, e := range m.Conditions {
+			l = e.Size()
+			n += 1 + l + sovRatelimit(uint64(l))
+		}
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	if m.Condition != nil {
+		n += m.Condition.Size()
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Exact) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Exact)
+	n += 1 + l + sovRatelimit(uint64(l))
+	return n
+}
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Prefix) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Prefix)
+	n += 1 + l + sovRatelimit(uint64(l))
+	return n
+}
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Present) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += 2
+	return n
+}
+func (m *RateLimitEntry_ConstantEntry) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Key)
+	if l > 0 {
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	l = len(m.Value)
+	if l > 0 {
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *RateLimitEntry_Expression) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Key)
+	if l > 0 {
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	if m.SkipIfError {
+		n += 2
+	}
+	l = len(m.Text)
+	if l > 0 {
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *ProviderRef) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *LocalRateLimit) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.TokenBucket != nil {
+		l = m.TokenBucket.Size()
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	if len(m.Descriptors) > 0 {
+		for _, e := range m.Descriptors {
+			l = e.Size()
+			n += 1 + l + sovRatelimit(uint64(l))
+		}
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *LocalRateLimit_TokenBucket) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.MaxTokens != 0 {
+		n += 1 + sovRatelimit(uint64(m.MaxTokens))
+	}
+	if m.TokensPerFill != nil {
+		l = m.TokensPerFill.Size()
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	if m.FillInterval != nil {
+		l = m.FillInterval.Size()
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *LocalRateLimit_LocalRateLimitDescriptor) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.TokenBucket != nil {
+		l = m.TokenBucket.Size()
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	if len(m.Entries) > 0 {
+		for _, e := range m.Entries {
+			l = e.Size()
+			n += 1 + l + sovRatelimit(uint64(l))
+		}
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func (m *LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) Size() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Key)
+	if l > 0 {
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	l = len(m.Value)
+	if l > 0 {
+		n += 1 + l + sovRatelimit(uint64(l))
+	}
+	if m.XXX_unrecognized != nil {
+		n += len(m.XXX_unrecognized)
+	}
+	return n
+}
+
+func sovRatelimit(x uint64) (n int) {
+	return (math_bits.Len64(x|1) + 6) / 7
+}
+func sozRatelimit(x uint64) (n int) {
+	return sovRatelimit(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (m *RateLimit) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowRatelimit
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RateLimit: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RateLimit: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Workload", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &v1beta1.WorkloadSelector{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Binding = &RateLimit_Workload{v}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Route", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &RouteSelector{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Binding = &RateLimit_Route{v}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Descriptors", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Descriptors = append(m.Descriptors, &RateLimitDescriptor{})
+			if err := m.Descriptors[len(m.Descriptors)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Global", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &ProviderRef{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Policy = &RateLimit_Global{v}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Local", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &LocalRateLimit{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.Policy = &RateLimit_Local{v}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipRatelimit(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RouteSelector) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowRatelimit
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RouteSelector: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RouteSelector: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Group", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Group = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kind", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kind = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Route", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Route = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipRatelimit(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RateLimitDescriptor) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowRatelimit
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RateLimitDescriptor: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RateLimitDescriptor: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Entries", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Entries = append(m.Entries, &RateLimitEntry{})
+			if err := m.Entries[len(m.Entries)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipRatelimit(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RateLimitEntry) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowRatelimit
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RateLimitEntry: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RateLimitEntry: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Header", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &RateLimitEntry_RequestHeader{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.EntryType = &RateLimitEntry_Header{v}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field HeaderMatch", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &RateLimitEntry_RequestHeaderMatch{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.EntryType = &RateLimitEntry_HeaderMatch{v}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Constant", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &RateLimitEntry_ConstantEntry{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.EntryType = &RateLimitEntry_Constant{v}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Expression", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			v := &RateLimitEntry_Expression{}
+			if err := v.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			m.EntryType = &RateLimitEntry_Expression_{v}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipRatelimit(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RateLimitEntry_RequestHeader) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowRatelimit
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RequestHeader: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RequestHeader: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Key", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Key = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SkipIfAbsent", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.SkipIfAbsent = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := skipRatelimit(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RateLimitEntry_RequestHeaderMatch) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowRatelimit
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RequestHeaderMatch: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RequestHeaderMatch: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Value = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Conditions", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Conditions = append(m.Conditions, &RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition{})
+			if err := m.Conditions[len(m.Conditions)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipRatelimit(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowRatelimit
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: HeaderMatchCondition: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: HeaderMatchCondition: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Exact", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Condition = &RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Exact{string(dAtA[iNdEx:postIndex])}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Prefix", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Condition = &RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Prefix{string(dAtA[iNdEx:postIndex])}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Present", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			b := bool(v != 0)
+			m.Condition = &RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition_Present{b}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipRatelimit(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RateLimitEntry_ConstantEntry) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowRatelimit
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ConstantEntry: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ConstantEntry: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Key", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Key = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Value = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipRatelimit(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RateLimitEntry_Expression) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowRatelimit
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Expression: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Expression: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Key", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Key = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SkipIfError", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.SkipIfError = bool(v != 0)
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Text", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Text = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipRatelimit(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ProviderRef) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowRatelimit
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ProviderRef: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ProviderRef: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipRatelimit(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *LocalRateLimit) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowRatelimit
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: LocalRateLimit: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: LocalRateLimit: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TokenBucket", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.TokenBucket == nil {
+				m.TokenBucket = &LocalRateLimit_TokenBucket{}
+			}
+			if err := m.TokenBucket.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Descriptors", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Descriptors = append(m.Descriptors, &LocalRateLimit_LocalRateLimitDescriptor{})
+			if err := m.Descriptors[len(m.Descriptors)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipRatelimit(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *LocalRateLimit_TokenBucket) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowRatelimit
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TokenBucket: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TokenBucket: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MaxTokens", wireType)
+			}
+			m.MaxTokens = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.MaxTokens |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TokensPerFill", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.TokensPerFill == nil {
+				m.TokensPerFill = &types.UInt32Value{}
+			}
+			if err := m.TokensPerFill.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FillInterval", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.FillInterval == nil {
+				m.FillInterval = &types.Duration{}
+			}
+			if err := m.FillInterval.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipRatelimit(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *LocalRateLimit_LocalRateLimitDescriptor) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowRatelimit
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: LocalRateLimitDescriptor: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: LocalRateLimitDescriptor: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TokenBucket", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.TokenBucket == nil {
+				m.TokenBucket = &LocalRateLimit_TokenBucket{}
+			}
+			if err := m.TokenBucket.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Entries", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Entries = append(m.Entries, &LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry{})
+			if err := m.Entries[len(m.Entries)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipRatelimit(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowRatelimit
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DescriptorEntry: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DescriptorEntry: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Key", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Key = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Value", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Value = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipRatelimit(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return ErrInvalidLengthRatelimit
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipRatelimit(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	depth := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowRatelimit
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+		case 1:
+			iNdEx += 8
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowRatelimit
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if length < 0 {
+				return 0, ErrInvalidLengthRatelimit
+			}
+			iNdEx += length
+		case 3:
+			depth++
+		case 4:
+			if depth == 0 {
+				return 0, ErrUnexpectedEndOfGroupRatelimit
+			}
+			depth--
+		case 5:
+			iNdEx += 4
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+		if iNdEx < 0 {
+			return 0, ErrInvalidLengthRatelimit
+		}
+		if depth == 0 {
+			return iNdEx, nil
+		}
+	}
+	return 0, io.ErrUnexpectedEOF
+}
+
+var (
+	ErrInvalidLengthRatelimit        = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowRatelimit          = fmt.Errorf("proto: integer overflow")
+	ErrUnexpectedEndOfGroupRatelimit = fmt.Errorf("proto: unexpected end of group")
+)
diff --git a/policy/v1alpha1/ratelimit.pb.html b/policy/v1alpha1/ratelimit.pb.html
new file mode 100644
index 00000000000..86f078ae5c5
--- /dev/null
+++ b/policy/v1alpha1/ratelimit.pb.html
@@ -0,0 +1,761 @@
+---
+title: istio.policy.v1alpha1
+layout: protoc-gen-docs
+generator: protoc-gen-docs
+number_of_entries: 15
+---
+<h2 id="RateLimit">RateLimit</h2>
+<section>
+<p>$schema: istio.policy.v1alpha1.RateLimit
+$title: Rate limiting
+$description: Rate limiting configuration
+$location: https://istio.io/docs/reference/config/policy/ratelimit.html
+$aliases: [/docs/reference/config/policy/v1alpha1/ratelimit]</p>
+
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+<th>Required</th>
+</tr>
+</thead>
+<tbody>
+<tr id="RateLimit-workload" class="oneof oneof-start">
+<td><code>workload</code></td>
+<td><code><a href="https://istio.io/docs/reference/config/type/workload-selector.html#WorkloadSelector">WorkloadSelector (oneof)</a></code></td>
+<td>
+<p>Optional. The workload selector decides where to apply the server-side rate limit in the same namespace.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="RateLimit-route" class="oneof">
+<td><code>route</code></td>
+<td><code><a href="#RouteSelector">RouteSelector (oneof)</a></code></td>
+<td>
+<p>Optional. The route selector decides which client route rules enforce the client-side rate limit.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="RateLimit-descriptors">
+<td><code>descriptors</code></td>
+<td><code><a href="#RateLimitDescriptor">RateLimitDescriptor[]</a></code></td>
+<td>
+<p>Optional. Specifies a set of descriptors that are evaluated against the
+rate limit policy.  The rate limit applies if any of the generated
+descriptors trigger a limit.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="RateLimit-global" class="oneof oneof-start">
+<td><code>global</code></td>
+<td><code><a href="#ProviderRef">ProviderRef (oneof)</a></code></td>
+<td>
+<p>Global rate limiting provider reference.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="RateLimit-local" class="oneof">
+<td><code>local</code></td>
+<td><code><a href="#LocalRateLimit">LocalRateLimit (oneof)</a></code></td>
+<td>
+<p>Local rate limit policy.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="RouteSelector">RouteSelector</h2>
+<section>
+<p>Route selector references a client networking resource to overlay the rate
+limit filter application. This can be a service, a virtual service, or a
+gateway resource. Route name designation is optional.
+If no route name is provided, the rate limit applies to all routes. However,
+the rate limit for a named route takes priority over the rate limit for the
+entire resource.</p>
+
+<p>For example, a selector addressing a Kubernetes service:</p>
+
+<pre><code class="language-yaml">name: foo
+group: core
+kind: Service
+</code></pre>
+
+<p>This selector references an HTTPRoute from a Kubernetes gateway:</p>
+
+<pre><code class="language-yaml">name: foo
+group: networking.x-k8s.io
+kind: HTTPRoute
+</code></pre>
+
+<p>This selector references an individual route from a VirtualService:</p>
+
+<pre><code class="language-yaml">name: foo
+group: networking.istio.io
+kind: VirtualService
+route: blah
+</code></pre>
+
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+<th>Required</th>
+</tr>
+</thead>
+<tbody>
+<tr id="RouteSelector-name">
+<td><code>name</code></td>
+<td><code>string</code></td>
+<td>
+<p>Resource name.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="RouteSelector-group">
+<td><code>group</code></td>
+<td><code>string</code></td>
+<td>
+<p>Resource API group.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="RouteSelector-kind">
+<td><code>kind</code></td>
+<td><code>string</code></td>
+<td>
+<p>Resource kind.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="RouteSelector-route">
+<td><code>route</code></td>
+<td><code>string</code></td>
+<td>
+<p>Optional. Individual route rule name within the resource.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="RateLimitDescriptor">RateLimitDescriptor</h2>
+<section>
+<p>RateLimitDescriptor is an ordered sequence of entries used for classification of requests.</p>
+
+<p>The following descriptor produces the sequence <code>[(path, /), (uid, john)]</code> for a request to <code>/</code>
+with a header <code>user-id</code> set to <code>john</code>:</p>
+
+<pre><code class="language-yaml">entries:
+- header:
+    key: path
+    name: :path
+- header:
+    key: uid
+    name: user-id
+</code></pre>
+
+<p>The following descriptor produces the client SPIFFE service account URI:</p>
+
+<pre><code class="language-yaml">entries:
+- expression:
+    key: client-id
+    text: connection.uri_san_peer_certificate
+</code></pre>
+
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+<th>Required</th>
+</tr>
+</thead>
+<tbody>
+<tr id="RateLimitDescriptor-entries">
+<td><code>entries</code></td>
+<td><code><a href="#RateLimitEntry">RateLimitEntry[]</a></code></td>
+<td>
+</td>
+<td>
+No
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="RateLimitEntry">RateLimitEntry</h2>
+<section>
+<p>RateLimitEntry is a property of the request used for classification of requests.</p>
+
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+<th>Required</th>
+</tr>
+</thead>
+<tbody>
+<tr id="RateLimitEntry-header" class="oneof oneof-start">
+<td><code>header</code></td>
+<td><code><a href="#RateLimitEntry-RequestHeader">RequestHeader (oneof)</a></code></td>
+<td>
+<p>Entry obtained from a header value.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="RateLimitEntry-header_match" class="oneof">
+<td><code>headerMatch</code></td>
+<td><code><a href="#RateLimitEntry-RequestHeaderMatch">RequestHeaderMatch (oneof)</a></code></td>
+<td>
+<p>Entry obtained by testing a header value against exact value, prefix, etc.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="RateLimitEntry-constant" class="oneof">
+<td><code>constant</code></td>
+<td><code><a href="#RateLimitEntry-ConstantEntry">ConstantEntry (oneof)</a></code></td>
+<td>
+<p>Constant entry key and value.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="RateLimitEntry-expression" class="oneof">
+<td><code>expression</code></td>
+<td><code><a href="#RateLimitEntry-Expression">Expression (oneof)</a></code></td>
+<td>
+<p>CEL expression entry.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="ProviderRef">ProviderRef</h2>
+<section>
+<p>References a rate limit extension provider from the mesh configuration.</p>
+
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+<th>Required</th>
+</tr>
+</thead>
+<tbody>
+<tr id="ProviderRef-name">
+<td><code>name</code></td>
+<td><code>string</code></td>
+<td>
+<p>Provider name.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="LocalRateLimit">LocalRateLimit</h2>
+<section>
+<p>Local rate limiting policy using a token bucket algorithm.</p>
+
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+<th>Required</th>
+</tr>
+</thead>
+<tbody>
+<tr id="LocalRateLimit-token_bucket">
+<td><code>tokenBucket</code></td>
+<td><code><a href="#LocalRateLimit-TokenBucket">TokenBucket</a></code></td>
+<td>
+<p>The token bucket configuration to use for rate limiting requests that are
+processed by this filter. Each request processed by the filter consumes a
+single token. If the token is available, the request will be allowed. If
+no tokens are available, the proxy responds with 429.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="LocalRateLimit-descriptors">
+<td><code>descriptors</code></td>
+<td><code><a href="#LocalRateLimit-LocalRateLimitDescriptor">LocalRateLimitDescriptor[]</a></code></td>
+<td>
+<p>Descriptor overrides. The rate limit descriptor list to use in the local
+rate limit to override on. The rate limit descriptor is selected by the
+first full match from the request descriptors. Each descriptor token bucket
+fill interval must be a multiple of the global token bucket&rsquo;s interval.
+The descriptors match verbatim. If a descriptor match is detected, then the
+descriptor bucket is used to decide whether to rate limit the request instead of
+the global token bucket.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="RateLimitEntry-RequestHeader">RateLimitEntry.RequestHeader</h2>
+<section>
+<p>Entry obtained a request header value.</p>
+
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+<th>Required</th>
+</tr>
+</thead>
+<tbody>
+<tr id="RateLimitEntry-RequestHeader-key">
+<td><code>key</code></td>
+<td><code>string</code></td>
+<td>
+<p>Descriptor entry key.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="RateLimitEntry-RequestHeader-name">
+<td><code>name</code></td>
+<td><code>string</code></td>
+<td>
+<p>Request header name. The value of the header is used as the entry value.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="RateLimitEntry-RequestHeader-skip_if_absent">
+<td><code>skipIfAbsent</code></td>
+<td><code>bool</code></td>
+<td>
+<p>When true, the descriptor entry is omitted from the descriptor if the header is absent.
+By default, the entire descriptor is skipped and the rate limit is not applied.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="RateLimitEntry-RequestHeaderMatch">RateLimitEntry.RequestHeaderMatch</h2>
+<section>
+<p>Entry obtained by testing a request header value.</p>
+
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+<th>Required</th>
+</tr>
+</thead>
+<tbody>
+<tr id="RateLimitEntry-RequestHeaderMatch-value">
+<td><code>value</code></td>
+<td><code>string</code></td>
+<td>
+<p>Descriptor entry value. The key is always <code>header_match</code>.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="RateLimitEntry-RequestHeaderMatch-conditions">
+<td><code>conditions</code></td>
+<td><code><a href="#RateLimitEntry-RequestHeaderMatch-HeaderMatchCondition">HeaderMatchCondition[]</a></code></td>
+<td>
+<p>The request matches when it matches all conditions.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="RateLimitEntry-ConstantEntry">RateLimitEntry.ConstantEntry</h2>
+<section>
+<p>Constant entry.</p>
+
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+<th>Required</th>
+</tr>
+</thead>
+<tbody>
+<tr id="RateLimitEntry-ConstantEntry-key">
+<td><code>key</code></td>
+<td><code>string</code></td>
+<td>
+<p>Descriptor entry key.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="RateLimitEntry-ConstantEntry-value">
+<td><code>value</code></td>
+<td><code>string</code></td>
+<td>
+<p>Descriptor entry value.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="RateLimitEntry-Expression">RateLimitEntry.Expression</h2>
+<section>
+<p>CEL expression.
+For example, the expression <code>filter_state['wasm.downstream_peer'].labels['app'].value</code>
+produces the <code>app</code> label value for the downstream peer.
+See https://istio.io/latest/docs/tasks/observability/metrics/customize-metrics/#use-expressions-for-values.</p>
+
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+<th>Required</th>
+</tr>
+</thead>
+<tbody>
+<tr id="RateLimitEntry-Expression-key">
+<td><code>key</code></td>
+<td><code>string</code></td>
+<td>
+<p>Descriptor entry key.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="RateLimitEntry-Expression-skip_if_error">
+<td><code>skipIfError</code></td>
+<td><code>bool</code></td>
+<td>
+<p>If set to true, the descriptor entry is omitted if the expression evaluates to an error.
+By default, the rate limit is not applied for this descriptor when an expression produces an error.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="RateLimitEntry-Expression-text">
+<td><code>text</code></td>
+<td><code>string</code></td>
+<td>
+<p>Descriptor expression.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="RateLimitEntry-RequestHeaderMatch-HeaderMatchCondition">RateLimitEntry.RequestHeaderMatch.HeaderMatchCondition</h2>
+<section>
+<p>Header match condition evaluates a request header against one of the patterns.
+Use <code>:authority</code> header to refer to HTTP/1.1 Host header and <code>:method</code>
+header to refer to HTTP method.</p>
+
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+<th>Required</th>
+</tr>
+</thead>
+<tbody>
+<tr id="RateLimitEntry-RequestHeaderMatch-HeaderMatchCondition-name">
+<td><code>name</code></td>
+<td><code>string</code></td>
+<td>
+<p>Header name.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="RateLimitEntry-RequestHeaderMatch-HeaderMatchCondition-exact" class="oneof oneof-start">
+<td><code>exact</code></td>
+<td><code>string (oneof)</code></td>
+<td>
+<p>The header value must match exactly.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="RateLimitEntry-RequestHeaderMatch-HeaderMatchCondition-prefix" class="oneof">
+<td><code>prefix</code></td>
+<td><code>string (oneof)</code></td>
+<td>
+<p>The header value must start with the given value.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="RateLimitEntry-RequestHeaderMatch-HeaderMatchCondition-present" class="oneof">
+<td><code>present</code></td>
+<td><code>bool (oneof)</code></td>
+<td>
+<p>If specified as true, the header matches when it is present in the request.
+If specified as false, the header matches when it is absent from the request.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="LocalRateLimit-TokenBucket">LocalRateLimit.TokenBucket</h2>
+<section>
+<p>Configures a token bucket.</p>
+
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+<th>Required</th>
+</tr>
+</thead>
+<tbody>
+<tr id="LocalRateLimit-TokenBucket-max_tokens">
+<td><code>maxTokens</code></td>
+<td><code>uint32</code></td>
+<td>
+<p>The maximum tokens that the bucket can hold. This is also the number of tokens that the bucket
+initially contains.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="LocalRateLimit-TokenBucket-tokens_per_fill">
+<td><code>tokensPerFill</code></td>
+<td><code><a href="#google-protobuf-UInt32Value">UInt32Value</a></code></td>
+<td>
+<p>The number of tokens added to the bucket during each fill interval. If not specified, defaults
+to a single token.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="LocalRateLimit-TokenBucket-fill_interval">
+<td><code>fillInterval</code></td>
+<td><code><a href="https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#duration">Duration</a></code></td>
+<td>
+<p>The fill interval that tokens are added to the bucket. During each fill interval
+<code>tokens_per_fill</code> are added to the bucket. The bucket will never contain more than
+<code>max_tokens</code> tokens. The interval must be &gt;=50ms.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="LocalRateLimit-LocalRateLimitDescriptor">LocalRateLimit.LocalRateLimitDescriptor</h2>
+<section>
+<p>Per-descriptor local rate limit override.</p>
+
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+<th>Required</th>
+</tr>
+</thead>
+<tbody>
+<tr id="LocalRateLimit-LocalRateLimitDescriptor-token_bucket">
+<td><code>tokenBucket</code></td>
+<td><code><a href="#LocalRateLimit-TokenBucket">TokenBucket</a></code></td>
+<td>
+<p>Override token bucket. The fill interval must be a multiple of the global
+token bucket.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="LocalRateLimit-LocalRateLimitDescriptor-entries">
+<td><code>entries</code></td>
+<td><code><a href="#LocalRateLimit-LocalRateLimitDescriptor-DescriptorEntry">DescriptorEntry[]</a></code></td>
+<td>
+<p>Descriptor entries to be matched exactly.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="LocalRateLimit-LocalRateLimitDescriptor-DescriptorEntry">LocalRateLimit.LocalRateLimitDescriptor.DescriptorEntry</h2>
+<section>
+<p>A descriptor entry.</p>
+
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+<th>Required</th>
+</tr>
+</thead>
+<tbody>
+<tr id="LocalRateLimit-LocalRateLimitDescriptor-DescriptorEntry-key">
+<td><code>key</code></td>
+<td><code>string</code></td>
+<td>
+</td>
+<td>
+No
+</td>
+</tr>
+<tr id="LocalRateLimit-LocalRateLimitDescriptor-DescriptorEntry-value">
+<td><code>value</code></td>
+<td><code>string</code></td>
+<td>
+</td>
+<td>
+No
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="google-protobuf-UInt32Value">google.protobuf.UInt32Value</h2>
+<section>
+<p>Wrapper message for <code>uint32</code>.</p>
+
+<p>The JSON representation for <code>UInt32Value</code> is JSON number.</p>
+
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+<th>Required</th>
+</tr>
+</thead>
+<tbody>
+<tr id="google-protobuf-UInt32Value-value">
+<td><code>value</code></td>
+<td><code>uint32</code></td>
+<td>
+<p>The uint32 value.</p>
+
+</td>
+<td>
+No
+</td>
+</tr>
+</tbody>
+</table>
+</section>
diff --git a/policy/v1alpha1/ratelimit.proto b/policy/v1alpha1/ratelimit.proto
new file mode 100644
index 00000000000..eebe1643859
--- /dev/null
+++ b/policy/v1alpha1/ratelimit.proto
@@ -0,0 +1,261 @@
+// Copyright Istio Authors
+//
+//   Licensed under the Apache License, Version 2.0 (the "License");
+//   you may not use this file except in compliance with the License.
+//   You may obtain a copy of the License at
+//
+//       http://www.apache.org/licenses/LICENSE-2.0
+//
+//   Unless required by applicable law or agreed to in writing, software
+//   distributed under the License is distributed on an "AS IS" BASIS,
+//   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//   See the License for the specific language governing permissions and
+//   limitations under the License.
+
+syntax = "proto3";
+
+import "type/v1beta1/selector.proto";
+import "google/protobuf/wrappers.proto";
+import "google/protobuf/duration.proto";
+
+option go_package = "istio.io/api/policy/v1alpha1";
+
+package istio.policy.v1alpha1;
+
+// $schema: istio.policy.v1alpha1.RateLimit
+// $title: Rate limiting
+// $description: Rate limiting configuration
+// $location: https://istio.io/docs/reference/config/policy/ratelimit.html
+// $aliases: [/docs/reference/config/policy/v1alpha1/ratelimit]
+//
+// <!-- crd generation tags
+// +cue-gen:Policy:groupName:policy.istio.io
+// +cue-gen:Policy:version:v1alpha1
+// +cue-gen:Policy:storageVersion
+// +cue-gen:Policy:annotations:helm.sh/resource-policy=keep
+// +cue-gen:Policy:labels:app=istio-pilot,chart=istio,istio=policy,heritage=Tiller,release=istio
+// +cue-gen:Policy:subresource:status
+// +cue-gen:Policy:scope:Namespaced
+// +cue-gen:Policy:resource:categories=istio-io,policy-istio-io,shortNames=policy,plural=telemetries
+// +cue-gen:Policy:preserveUnknownFields:false
+// +cue-gen:Policy:printerColumn:name=Age,type=date,JSONPath=.metadata.creationTimestamp,description="CreationTimestamp is a timestamp
+// representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations.
+// Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+// Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata"
+// -->
+//
+// <!-- go code generation tags
+// +kubetype-gen
+// +kubetype-gen:groupVersion=policy.istio.io/v1alpha1
+// +genclient
+// +k8s:deepcopy-gen=true
+// -->
+message RateLimit {
+  oneof binding {
+    // Optional. The workload selector decides where to apply the server-side rate limit in the same namespace.
+    istio.type.v1beta1.WorkloadSelector workload = 1;
+    // Optional. The route selector decides which client route rules enforce the client-side rate limit.
+    RouteSelector route = 2;
+  }
+  // Optional. Specifies a set of descriptors that are evaluated against the
+  // rate limit policy.  The rate limit applies if any of the generated
+  // descriptors trigger a limit.
+  repeated RateLimitDescriptor descriptors = 3;
+
+  oneof policy {
+    // Global rate limiting provider reference.
+    ProviderRef global = 4;
+    // Local rate limit policy.
+    LocalRateLimit local = 5;
+  }
+}
+
+// Route selector references a client networking resource to overlay the rate
+// limit filter application. This can be a service, a virtual service, or a
+// gateway resource. Route name designation is optional.
+// If no route name is provided, the rate limit applies to all routes. However,
+// the rate limit for a named route takes priority over the rate limit for the
+// entire resource.
+//
+// For example, a selector addressing a Kubernetes service:
+// ```yaml
+// name: foo
+// group: core
+// kind: Service
+// ```
+//
+// This selector references an HTTPRoute from a Kubernetes gateway:
+// ```yaml
+// name: foo
+// group: networking.x-k8s.io
+// kind: HTTPRoute
+// ```
+//
+// This selector references an individual route from a VirtualService:
+// ```yaml
+// name: foo
+// group: networking.istio.io
+// kind: VirtualService
+// route: blah
+// ```
+message RouteSelector {
+  // Resource name.
+  string name = 1;
+  // Resource API group.
+  string group = 2;
+  // Resource kind.
+  string kind = 3;
+  // Optional. Individual route rule name within the resource.
+  string route = 4;
+}
+
+// RateLimitDescriptor is an ordered sequence of entries used for classification of requests.
+//
+// The following descriptor produces the sequence `[(path, /), (uid, john)]` for a request to `/`
+// with a header `user-id` set to `john`:
+// ```yaml
+// entries:
+// - header:
+//     key: path
+//     name: :path
+// - header:
+//     key: uid
+//     name: user-id
+// ```
+//
+// The following descriptor produces the client SPIFFE service account URI:
+// ```yaml
+// entries:
+// - expression:
+//     key: client-id
+//     text: connection.uri_san_peer_certificate
+// ```
+message RateLimitDescriptor {
+  repeated RateLimitEntry entries = 1;
+}
+
+// RateLimitEntry is a property of the request used for classification of requests.
+message RateLimitEntry {
+  // Entry obtained a request header value.
+  message RequestHeader {
+    // Descriptor entry key.
+    string key = 1;
+    // Request header name. The value of the header is used as the entry value.
+    string name = 2;
+    // When true, the descriptor entry is omitted from the descriptor if the header is absent.
+    // By default, the entire descriptor is skipped and the rate limit is not applied.
+    bool skip_if_absent = 3;
+  }
+  // Entry obtained by testing a request header value.
+  message RequestHeaderMatch {
+    // Descriptor entry value. The key is always `header_match`.
+    string value = 1;
+
+    // Header match condition evaluates a request header against one of the patterns.
+    // Use `:authority` header to refer to HTTP/1.1 Host header and `:method`
+    // header to refer to HTTP method.
+    message HeaderMatchCondition {
+      // Header name.
+      string name = 1;
+
+      oneof condition {
+        // The header value must match exactly.
+        string exact = 2;
+        // The header value must start with the given value.
+        string prefix = 3;
+        // If specified as true, the header matches when it is present in the request.
+        // If specified as false, the header matches when it is absent from the request.
+        bool present = 4;
+      }
+    }
+
+    // The request matches when it matches all conditions.
+    repeated HeaderMatchCondition conditions = 3;
+  }
+  // Constant entry.
+  message ConstantEntry {
+    // Descriptor entry key.
+    string key = 1;
+    // Descriptor entry value.
+    string value = 2;
+  }
+  // CEL expression.
+  // For example, the expression `filter_state['wasm.downstream_peer'].labels['app'].value`
+  // produces the `app` label value for the downstream peer.
+  // See https://istio.io/latest/docs/tasks/observability/metrics/customize-metrics/#use-expressions-for-values.
+  message Expression {
+    // Descriptor entry key.
+    string key = 1;
+    // If set to true, the descriptor entry is omitted if the expression evaluates to an error.
+    // By default, the rate limit is not applied for this descriptor when an expression produces an error.
+    bool skip_if_error = 2;
+    // Descriptor expression.
+    string text = 3;
+  }
+  oneof entry_type {
+    // Entry obtained from a header value.
+    RequestHeader header = 1;
+    // Entry obtained by testing a header value against exact value, prefix, etc.
+    RequestHeaderMatch header_match = 2;
+    // Constant entry key and value.
+    ConstantEntry constant = 3;
+    // CEL expression entry.
+    Expression expression = 4;
+  }
+}
+
+// References a rate limit extension provider from the mesh configuration.
+message ProviderRef {
+  // Provider name.
+  string name = 1;
+}
+
+// Local rate limiting policy using a token bucket algorithm.
+message LocalRateLimit {
+  // Configures a token bucket.
+  message TokenBucket {
+    // The maximum tokens that the bucket can hold. This is also the number of tokens that the bucket
+    // initially contains.
+    uint32 max_tokens = 1;
+
+    // The number of tokens added to the bucket during each fill interval. If not specified, defaults
+    // to a single token.
+    google.protobuf.UInt32Value tokens_per_fill = 2;
+
+    // The fill interval that tokens are added to the bucket. During each fill interval
+    // `tokens_per_fill` are added to the bucket. The bucket will never contain more than
+    // `max_tokens` tokens. The interval must be >=50ms.
+    google.protobuf.Duration fill_interval = 3;
+  }
+
+  // The token bucket configuration to use for rate limiting requests that are
+  // processed by this filter. Each request processed by the filter consumes a
+  // single token. If the token is available, the request will be allowed. If
+  // no tokens are available, the proxy responds with 429.
+  TokenBucket token_bucket = 1;
+
+  // Per-descriptor local rate limit override.
+  message LocalRateLimitDescriptor {
+    // Override token bucket. The fill interval must be a multiple of the global
+    // token bucket.
+    TokenBucket token_bucket = 1;
+
+    // A descriptor entry.
+    message DescriptorEntry {
+      string key = 1;
+      string value = 2;
+    }
+
+    // Descriptor entries to be matched exactly.
+    repeated DescriptorEntry entries = 2;
+  }
+
+  // Descriptor overrides. The rate limit descriptor list to use in the local
+  // rate limit to override on. The rate limit descriptor is selected by the
+  // first full match from the request descriptors. Each descriptor token bucket
+  // fill interval must be a multiple of the global token bucket's interval.
+  // The descriptors match verbatim. If a descriptor match is detected, then the
+  // descriptor bucket is used to decide whether to rate limit the request instead of
+  // the global token bucket.
+  repeated LocalRateLimitDescriptor descriptors = 2;
+}
diff --git a/policy/v1alpha1/ratelimit_deepcopy.gen.go b/policy/v1alpha1/ratelimit_deepcopy.gen.go
new file mode 100644
index 00000000000..75df2492b1d
--- /dev/null
+++ b/policy/v1alpha1/ratelimit_deepcopy.gen.go
@@ -0,0 +1,311 @@
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: policy/v1alpha1/ratelimit.proto
+
+package v1alpha1
+
+import (
+	fmt "fmt"
+	proto "github.com/gogo/protobuf/proto"
+	_ "github.com/gogo/protobuf/types"
+	_ "istio.io/api/type/v1beta1"
+	math "math"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// DeepCopyInto supports using RateLimit within kubernetes types, where deepcopy-gen is used.
+func (in *RateLimit) DeepCopyInto(out *RateLimit) {
+	p := proto.Clone(in).(*RateLimit)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimit. Required by controller-gen.
+func (in *RateLimit) DeepCopy() *RateLimit {
+	if in == nil {
+		return nil
+	}
+	out := new(RateLimit)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new RateLimit. Required by controller-gen.
+func (in *RateLimit) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using RouteSelector within kubernetes types, where deepcopy-gen is used.
+func (in *RouteSelector) DeepCopyInto(out *RouteSelector) {
+	p := proto.Clone(in).(*RouteSelector)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RouteSelector. Required by controller-gen.
+func (in *RouteSelector) DeepCopy() *RouteSelector {
+	if in == nil {
+		return nil
+	}
+	out := new(RouteSelector)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new RouteSelector. Required by controller-gen.
+func (in *RouteSelector) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using RateLimitDescriptor within kubernetes types, where deepcopy-gen is used.
+func (in *RateLimitDescriptor) DeepCopyInto(out *RateLimitDescriptor) {
+	p := proto.Clone(in).(*RateLimitDescriptor)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitDescriptor. Required by controller-gen.
+func (in *RateLimitDescriptor) DeepCopy() *RateLimitDescriptor {
+	if in == nil {
+		return nil
+	}
+	out := new(RateLimitDescriptor)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitDescriptor. Required by controller-gen.
+func (in *RateLimitDescriptor) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using RateLimitEntry within kubernetes types, where deepcopy-gen is used.
+func (in *RateLimitEntry) DeepCopyInto(out *RateLimitEntry) {
+	p := proto.Clone(in).(*RateLimitEntry)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitEntry. Required by controller-gen.
+func (in *RateLimitEntry) DeepCopy() *RateLimitEntry {
+	if in == nil {
+		return nil
+	}
+	out := new(RateLimitEntry)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitEntry. Required by controller-gen.
+func (in *RateLimitEntry) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using RateLimitEntry_RequestHeader within kubernetes types, where deepcopy-gen is used.
+func (in *RateLimitEntry_RequestHeader) DeepCopyInto(out *RateLimitEntry_RequestHeader) {
+	p := proto.Clone(in).(*RateLimitEntry_RequestHeader)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitEntry_RequestHeader. Required by controller-gen.
+func (in *RateLimitEntry_RequestHeader) DeepCopy() *RateLimitEntry_RequestHeader {
+	if in == nil {
+		return nil
+	}
+	out := new(RateLimitEntry_RequestHeader)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitEntry_RequestHeader. Required by controller-gen.
+func (in *RateLimitEntry_RequestHeader) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using RateLimitEntry_RequestHeaderMatch within kubernetes types, where deepcopy-gen is used.
+func (in *RateLimitEntry_RequestHeaderMatch) DeepCopyInto(out *RateLimitEntry_RequestHeaderMatch) {
+	p := proto.Clone(in).(*RateLimitEntry_RequestHeaderMatch)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitEntry_RequestHeaderMatch. Required by controller-gen.
+func (in *RateLimitEntry_RequestHeaderMatch) DeepCopy() *RateLimitEntry_RequestHeaderMatch {
+	if in == nil {
+		return nil
+	}
+	out := new(RateLimitEntry_RequestHeaderMatch)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitEntry_RequestHeaderMatch. Required by controller-gen.
+func (in *RateLimitEntry_RequestHeaderMatch) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition within kubernetes types, where deepcopy-gen is used.
+func (in *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) DeepCopyInto(out *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) {
+	p := proto.Clone(in).(*RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition. Required by controller-gen.
+func (in *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) DeepCopy() *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition {
+	if in == nil {
+		return nil
+	}
+	out := new(RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition. Required by controller-gen.
+func (in *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using RateLimitEntry_ConstantEntry within kubernetes types, where deepcopy-gen is used.
+func (in *RateLimitEntry_ConstantEntry) DeepCopyInto(out *RateLimitEntry_ConstantEntry) {
+	p := proto.Clone(in).(*RateLimitEntry_ConstantEntry)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitEntry_ConstantEntry. Required by controller-gen.
+func (in *RateLimitEntry_ConstantEntry) DeepCopy() *RateLimitEntry_ConstantEntry {
+	if in == nil {
+		return nil
+	}
+	out := new(RateLimitEntry_ConstantEntry)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitEntry_ConstantEntry. Required by controller-gen.
+func (in *RateLimitEntry_ConstantEntry) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using RateLimitEntry_Expression within kubernetes types, where deepcopy-gen is used.
+func (in *RateLimitEntry_Expression) DeepCopyInto(out *RateLimitEntry_Expression) {
+	p := proto.Clone(in).(*RateLimitEntry_Expression)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitEntry_Expression. Required by controller-gen.
+func (in *RateLimitEntry_Expression) DeepCopy() *RateLimitEntry_Expression {
+	if in == nil {
+		return nil
+	}
+	out := new(RateLimitEntry_Expression)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitEntry_Expression. Required by controller-gen.
+func (in *RateLimitEntry_Expression) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using ProviderRef within kubernetes types, where deepcopy-gen is used.
+func (in *ProviderRef) DeepCopyInto(out *ProviderRef) {
+	p := proto.Clone(in).(*ProviderRef)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProviderRef. Required by controller-gen.
+func (in *ProviderRef) DeepCopy() *ProviderRef {
+	if in == nil {
+		return nil
+	}
+	out := new(ProviderRef)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new ProviderRef. Required by controller-gen.
+func (in *ProviderRef) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using LocalRateLimit within kubernetes types, where deepcopy-gen is used.
+func (in *LocalRateLimit) DeepCopyInto(out *LocalRateLimit) {
+	p := proto.Clone(in).(*LocalRateLimit)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LocalRateLimit. Required by controller-gen.
+func (in *LocalRateLimit) DeepCopy() *LocalRateLimit {
+	if in == nil {
+		return nil
+	}
+	out := new(LocalRateLimit)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new LocalRateLimit. Required by controller-gen.
+func (in *LocalRateLimit) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using LocalRateLimit_TokenBucket within kubernetes types, where deepcopy-gen is used.
+func (in *LocalRateLimit_TokenBucket) DeepCopyInto(out *LocalRateLimit_TokenBucket) {
+	p := proto.Clone(in).(*LocalRateLimit_TokenBucket)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LocalRateLimit_TokenBucket. Required by controller-gen.
+func (in *LocalRateLimit_TokenBucket) DeepCopy() *LocalRateLimit_TokenBucket {
+	if in == nil {
+		return nil
+	}
+	out := new(LocalRateLimit_TokenBucket)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new LocalRateLimit_TokenBucket. Required by controller-gen.
+func (in *LocalRateLimit_TokenBucket) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using LocalRateLimit_LocalRateLimitDescriptor within kubernetes types, where deepcopy-gen is used.
+func (in *LocalRateLimit_LocalRateLimitDescriptor) DeepCopyInto(out *LocalRateLimit_LocalRateLimitDescriptor) {
+	p := proto.Clone(in).(*LocalRateLimit_LocalRateLimitDescriptor)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LocalRateLimit_LocalRateLimitDescriptor. Required by controller-gen.
+func (in *LocalRateLimit_LocalRateLimitDescriptor) DeepCopy() *LocalRateLimit_LocalRateLimitDescriptor {
+	if in == nil {
+		return nil
+	}
+	out := new(LocalRateLimit_LocalRateLimitDescriptor)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new LocalRateLimit_LocalRateLimitDescriptor. Required by controller-gen.
+func (in *LocalRateLimit_LocalRateLimitDescriptor) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry within kubernetes types, where deepcopy-gen is used.
+func (in *LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) DeepCopyInto(out *LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) {
+	p := proto.Clone(in).(*LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry. Required by controller-gen.
+func (in *LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) DeepCopy() *LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry {
+	if in == nil {
+		return nil
+	}
+	out := new(LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry. Required by controller-gen.
+func (in *LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
diff --git a/policy/v1alpha1/ratelimit_json.gen.go b/policy/v1alpha1/ratelimit_json.gen.go
new file mode 100644
index 00000000000..7fb613ca964
--- /dev/null
+++ b/policy/v1alpha1/ratelimit_json.gen.go
@@ -0,0 +1,178 @@
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: policy/v1alpha1/ratelimit.proto
+
+package v1alpha1
+
+import (
+	bytes "bytes"
+	fmt "fmt"
+	github_com_gogo_protobuf_jsonpb "github.com/gogo/protobuf/jsonpb"
+	proto "github.com/gogo/protobuf/proto"
+	_ "github.com/gogo/protobuf/types"
+	_ "istio.io/api/type/v1beta1"
+	math "math"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// MarshalJSON is a custom marshaler for RateLimit
+func (this *RateLimit) MarshalJSON() ([]byte, error) {
+	str, err := RatelimitMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for RateLimit
+func (this *RateLimit) UnmarshalJSON(b []byte) error {
+	return RatelimitUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for RouteSelector
+func (this *RouteSelector) MarshalJSON() ([]byte, error) {
+	str, err := RatelimitMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for RouteSelector
+func (this *RouteSelector) UnmarshalJSON(b []byte) error {
+	return RatelimitUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for RateLimitDescriptor
+func (this *RateLimitDescriptor) MarshalJSON() ([]byte, error) {
+	str, err := RatelimitMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for RateLimitDescriptor
+func (this *RateLimitDescriptor) UnmarshalJSON(b []byte) error {
+	return RatelimitUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for RateLimitEntry
+func (this *RateLimitEntry) MarshalJSON() ([]byte, error) {
+	str, err := RatelimitMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for RateLimitEntry
+func (this *RateLimitEntry) UnmarshalJSON(b []byte) error {
+	return RatelimitUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for RateLimitEntry_RequestHeader
+func (this *RateLimitEntry_RequestHeader) MarshalJSON() ([]byte, error) {
+	str, err := RatelimitMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for RateLimitEntry_RequestHeader
+func (this *RateLimitEntry_RequestHeader) UnmarshalJSON(b []byte) error {
+	return RatelimitUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for RateLimitEntry_RequestHeaderMatch
+func (this *RateLimitEntry_RequestHeaderMatch) MarshalJSON() ([]byte, error) {
+	str, err := RatelimitMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for RateLimitEntry_RequestHeaderMatch
+func (this *RateLimitEntry_RequestHeaderMatch) UnmarshalJSON(b []byte) error {
+	return RatelimitUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition
+func (this *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) MarshalJSON() ([]byte, error) {
+	str, err := RatelimitMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition
+func (this *RateLimitEntry_RequestHeaderMatch_HeaderMatchCondition) UnmarshalJSON(b []byte) error {
+	return RatelimitUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for RateLimitEntry_ConstantEntry
+func (this *RateLimitEntry_ConstantEntry) MarshalJSON() ([]byte, error) {
+	str, err := RatelimitMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for RateLimitEntry_ConstantEntry
+func (this *RateLimitEntry_ConstantEntry) UnmarshalJSON(b []byte) error {
+	return RatelimitUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for RateLimitEntry_Expression
+func (this *RateLimitEntry_Expression) MarshalJSON() ([]byte, error) {
+	str, err := RatelimitMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for RateLimitEntry_Expression
+func (this *RateLimitEntry_Expression) UnmarshalJSON(b []byte) error {
+	return RatelimitUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for ProviderRef
+func (this *ProviderRef) MarshalJSON() ([]byte, error) {
+	str, err := RatelimitMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for ProviderRef
+func (this *ProviderRef) UnmarshalJSON(b []byte) error {
+	return RatelimitUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for LocalRateLimit
+func (this *LocalRateLimit) MarshalJSON() ([]byte, error) {
+	str, err := RatelimitMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for LocalRateLimit
+func (this *LocalRateLimit) UnmarshalJSON(b []byte) error {
+	return RatelimitUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for LocalRateLimit_TokenBucket
+func (this *LocalRateLimit_TokenBucket) MarshalJSON() ([]byte, error) {
+	str, err := RatelimitMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for LocalRateLimit_TokenBucket
+func (this *LocalRateLimit_TokenBucket) UnmarshalJSON(b []byte) error {
+	return RatelimitUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for LocalRateLimit_LocalRateLimitDescriptor
+func (this *LocalRateLimit_LocalRateLimitDescriptor) MarshalJSON() ([]byte, error) {
+	str, err := RatelimitMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for LocalRateLimit_LocalRateLimitDescriptor
+func (this *LocalRateLimit_LocalRateLimitDescriptor) UnmarshalJSON(b []byte) error {
+	return RatelimitUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry
+func (this *LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) MarshalJSON() ([]byte, error) {
+	str, err := RatelimitMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry
+func (this *LocalRateLimit_LocalRateLimitDescriptor_DescriptorEntry) UnmarshalJSON(b []byte) error {
+	return RatelimitUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+var (
+	RatelimitMarshaler   = &github_com_gogo_protobuf_jsonpb.Marshaler{}
+	RatelimitUnmarshaler = &github_com_gogo_protobuf_jsonpb.Unmarshaler{AllowUnknownFields: true}
+)
diff --git a/python/istio_api/mesh/v1alpha1/config_pb2.py b/python/istio_api/mesh/v1alpha1/config_pb2.py
index b0d9d71567b..733870532e2 100644
--- a/python/istio_api/mesh/v1alpha1/config_pb2.py
+++ b/python/istio_api/mesh/v1alpha1/config_pb2.py
@@ -26,7 +26,7 @@
   package='istio.mesh.v1alpha1',
   syntax='proto3',
   serialized_options=_b('Z\032istio.io/api/mesh/v1alpha1'),
-  serialized_pb=_b('\n\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x1egoogle/protobuf/wrappers.proto\x1a\x19mesh/v1alpha1/proxy.proto\x1a*networking/v1alpha3/destination_rule.proto\x1a\x34k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto\"\xf0\x41\n\nMeshConfig\x12*\n\x11proxy_listen_port\x18\x04 \x01(\x05R\x0fproxyListenPort\x12&\n\x0fproxy_http_port\x18\x05 \x01(\x05R\rproxyHttpPort\x12\x42\n\x0f\x63onnect_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.DurationR\x0e\x63onnectTimeout\x12W\n\x1aprotocol_detection_timeout\x18* \x01(\x0b\x32\x19.google.protobuf.DurationR\x18protocolDetectionTimeout\x12o\n\rtcp_keepalive\x18\x1c \x01(\x0b\x32J.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings.TcpKeepaliveR\x0ctcpKeepalive\x12#\n\ringress_class\x18\x07 \x01(\tR\x0cingressClass\x12\'\n\x0fingress_service\x18\x08 \x01(\tR\x0eingressService\x12m\n\x17ingress_controller_mode\x18\t \x01(\x0e\x32\x35.istio.mesh.v1alpha1.MeshConfig.IngressControllerModeR\x15ingressControllerMode\x12)\n\x10ingress_selector\x18\x34 \x01(\tR\x0fingressSelector\x12%\n\x0e\x65nable_tracing\x18\x0c \x01(\x08R\renableTracing\x12&\n\x0f\x61\x63\x63\x65ss_log_file\x18\r \x01(\tR\raccessLogFile\x12*\n\x11\x61\x63\x63\x65ss_log_format\x18\x18 \x01(\tR\x0f\x61\x63\x63\x65ssLogFormat\x12\x61\n\x13\x61\x63\x63\x65ss_log_encoding\x18\x1b \x01(\x0e\x32\x31.istio.mesh.v1alpha1.MeshConfig.AccessLogEncodingR\x11\x61\x63\x63\x65ssLogEncoding\x12\x44\n\x1f\x65nable_envoy_access_log_service\x18( \x01(\x08R\x1b\x65nableEnvoyAccessLogService\x12;\n\x1a\x64isable_envoy_listener_log\x18\x38 \x01(\x08R\x17\x64isableEnvoyListenerLog\x12G\n\x0e\x64\x65\x66\x61ult_config\x18\x0e \x01(\x0b\x32 .istio.mesh.v1alpha1.ProxyConfigR\rdefaultConfig\x12m\n\x17outbound_traffic_policy\x18\x11 \x01(\x0b\x32\x35.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicyR\x15outboundTrafficPolicy\x12H\n\x0e\x63onfig_sources\x18\x16 \x03(\x0b\x32!.istio.mesh.v1alpha1.ConfigSourceR\rconfigSources\x12\x44\n\x10\x65nable_auto_mtls\x18+ \x01(\x0b\x32\x1a.google.protobuf.BoolValueR\x0e\x65nableAutoMtls\x12!\n\x0ctrust_domain\x18\x1a \x01(\tR\x0btrustDomain\x12\x30\n\x14trust_domain_aliases\x18. \x03(\tR\x12trustDomainAliases\x12X\n\x0f\x63\x61_certificates\x18: \x03(\x0b\x32/.istio.mesh.v1alpha1.MeshConfig.CertificateDataR\x0e\x63\x61\x43\x65rtificates\x12\x39\n\x19\x64\x65\x66\x61ult_service_export_to\x18\x1f \x03(\tR\x16\x64\x65\x66\x61ultServiceExportTo\x12H\n!default_virtual_service_export_to\x18  \x03(\tR\x1d\x64\x65\x66\x61ultVirtualServiceExportTo\x12J\n\"default_destination_rule_export_to\x18! \x03(\tR\x1e\x64\x65\x66\x61ultDestinationRuleExportTo\x12%\n\x0eroot_namespace\x18\" \x01(\tR\rrootNamespace\x12\x66\n\x13locality_lb_setting\x18# \x01(\x0b\x32\x36.istio.networking.v1alpha3.LocalityLoadBalancerSettingR\x11localityLbSetting\x12\x43\n\x10\x64ns_refresh_rate\x18$ \x01(\x0b\x32\x19.google.protobuf.DurationR\x0e\x64nsRefreshRate\x12[\n\x11h2_upgrade_policy\x18) \x01(\x0e\x32/.istio.mesh.v1alpha1.MeshConfig.H2UpgradePolicyR\x0fh2UpgradePolicy\x12\x39\n\x19inbound_cluster_stat_name\x18, \x01(\tR\x16inboundClusterStatName\x12;\n\x1aoutbound_cluster_stat_name\x18- \x01(\tR\x17outboundClusterStatName\x12\x44\n\x0c\x63\x65rtificates\x18/ \x03(\x0b\x32 .istio.mesh.v1alpha1.CertificateR\x0c\x63\x65rtificates\x12Q\n\rthrift_config\x18\x31 \x01(\x0b\x32,.istio.mesh.v1alpha1.MeshConfig.ThriftConfigR\x0cthriftConfig\x12Z\n\x10service_settings\x18\x32 \x03(\x0b\x32/.istio.mesh.v1alpha1.MeshConfig.ServiceSettingsR\x0fserviceSettings\x12R\n\x17\x65nable_prometheus_merge\x18\x33 \x01(\x0b\x32\x1a.google.protobuf.BoolValueR\x15\x65nablePrometheusMerge\x12[\n\x1cverify_certificate_at_client\x18\x36 \x01(\x0b\x32\x1a.google.protobuf.BoolValueR\x19verifyCertificateAtClient\x12\x32\n\x02\x63\x61\x18\x37 \x01(\x0b\x32\".istio.mesh.v1alpha1.MeshConfig.CAR\x02\x63\x61\x12\x62\n\x13\x65xtension_providers\x18\x39 \x03(\x0b\x32\x31.istio.mesh.v1alpha1.MeshConfig.ExtensionProviderR\x12\x65xtensionProviders\x12]\n\x11\x64\x65\x66\x61ult_providers\x18< \x01(\x0b\x32\x30.istio.mesh.v1alpha1.MeshConfig.DefaultProvidersR\x10\x64\x65\x66\x61ultProviders\x12\x64\n\x13\x64iscovery_selectors\x18; \x03(\x0b\x32\x33.k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelectorR\x12\x64iscoverySelectors\x12\x65\n\x12path_normalization\x18= \x01(\x0b\x32\x36.istio.mesh.v1alpha1.MeshConfig.ProxyPathNormalizationR\x11pathNormalization\x1a\xad\x01\n\x15OutboundTrafficPolicy\x12N\n\x04mode\x18\x01 \x01(\x0e\x32:.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy.ModeR\x04mode\"D\n\x04Mode\x12\x11\n\rREGISTRY_ONLY\x10\x00\x12\r\n\tALLOW_ANY\x10\x01\"\x04\x08\x02\x10\x02*\x14VIRTUAL_SERVICE_ONLY\x1ag\n\x0f\x43\x65rtificateData\x12\x12\n\x03pem\x18\x01 \x01(\tH\x00R\x03pem\x12,\n\x11spiffe_bundle_url\x18\x02 \x01(\tH\x00R\x0fspiffeBundleUrlB\x12\n\x10\x63\x65rtificate_data\x1a}\n\x0cThriftConfig\x12$\n\x0erate_limit_url\x18\x01 \x01(\tR\x0crateLimitUrl\x12G\n\x12rate_limit_timeout\x18\x02 \x01(\x0b\x32\x19.google.protobuf.DurationR\x10rateLimitTimeout\x1a\xae\x01\n\x0fServiceSettings\x12T\n\x08settings\x18\x01 \x01(\x0b\x32\x38.istio.mesh.v1alpha1.MeshConfig.ServiceSettings.SettingsR\x08settings\x12\x14\n\x05hosts\x18\x02 \x03(\tR\x05hosts\x1a/\n\x08Settings\x12#\n\rcluster_local\x18\x01 \x01(\x08R\x0c\x63lusterLocal\x1a\xd4\x01\n\x02\x43\x41\x12\x18\n\x07\x61\x64\x64ress\x18\x01 \x01(\tR\x07\x61\x64\x64ress\x12O\n\x0ctls_settings\x18\x02 \x01(\x0b\x32,.istio.networking.v1alpha3.ClientTLSSettingsR\x0btlsSettings\x12\x42\n\x0frequest_timeout\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationR\x0erequestTimeout\x12\x1f\n\x0bistiod_side\x18\x04 \x01(\x08R\nistiodSide\x1a\xb7\x1c\n\x11\x45xtensionProvider\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\x12\x8b\x01\n\x14\x65nvoy_ext_authz_http\x18\x02 \x01(\x0b\x32X.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationHttpProviderH\x00R\x11\x65nvoyExtAuthzHttp\x12\x8b\x01\n\x14\x65nvoy_ext_authz_grpc\x18\x03 \x01(\x0b\x32X.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationGrpcProviderH\x00R\x11\x65nvoyExtAuthzGrpc\x12\x61\n\x06zipkin\x18\x04 \x01(\x0b\x32G.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.ZipkinTracingProviderH\x00R\x06zipkin\x12j\n\tlightstep\x18\x05 \x01(\x0b\x32J.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.LightstepTracingProviderH\x00R\tlightstep\x12\x64\n\x07\x64\x61tadog\x18\x06 \x01(\x0b\x32H.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.DatadogTracingProviderH\x00R\x07\x64\x61tadog\x12i\n\x0bstackdriver\x18\x07 \x01(\x0b\x32\x45.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.StackdriverProviderH\x00R\x0bstackdriver\x12r\n\nopencensus\x18\x08 \x01(\x0b\x32P.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.OpenCensusAgentTracingProviderH\x00R\nopencensus\x12m\n\nskywalking\x18\t \x01(\x0b\x32K.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.SkyWalkingTracingProviderH\x00R\nskywalking\x1a\xab\x01\n%EnvoyExternalAuthorizationRequestBody\x12*\n\x11max_request_bytes\x18\x01 \x01(\rR\x0fmaxRequestBytes\x12\x32\n\x15\x61llow_partial_message\x18\x02 \x01(\x08R\x13\x61llowPartialMessage\x12\"\n\rpack_as_bytes\x18\x03 \x01(\x08R\x0bpackAsBytes\x1a\xb2\x07\n&EnvoyExternalAuthorizationHttpProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12\x33\n\x07timeout\x18\t \x01(\x0b\x32\x19.google.protobuf.DurationR\x07timeout\x12\x1f\n\x0bpath_prefix\x18\x03 \x01(\tR\npathPrefix\x12\x1b\n\tfail_open\x18\x04 \x01(\x08R\x08\x66\x61ilOpen\x12&\n\x0fstatus_on_error\x18\x05 \x01(\tR\rstatusOnError\x12\x37\n\x18include_headers_in_check\x18\x06 \x03(\tR\x15includeHeadersInCheck\x12\x46\n include_request_headers_in_check\x18\n \x03(\tR\x1cincludeRequestHeadersInCheck\x12\xcb\x01\n#include_additional_headers_in_check\x18\x0b \x03(\x0b\x32}.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationHttpProvider.IncludeAdditionalHeadersInCheckEntryR\x1fincludeAdditionalHeadersInCheck\x12\x99\x01\n\x1dinclude_request_body_in_check\x18\x0c \x01(\x0b\x32W.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationRequestBodyR\x19includeRequestBodyInCheck\x12>\n\x1cheaders_to_upstream_on_allow\x18\x07 \x03(\tR\x18headersToUpstreamOnAllow\x12@\n\x1dheaders_to_downstream_on_deny\x18\x08 \x03(\tR\x19headersToDownstreamOnDeny\x1aR\n$IncludeAdditionalHeadersInCheckEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n\x05value\x18\x02 \x01(\tR\x05value:\x02\x38\x01\x1a\xec\x02\n&EnvoyExternalAuthorizationGrpcProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12\x33\n\x07timeout\x18\x05 \x01(\x0b\x32\x19.google.protobuf.DurationR\x07timeout\x12\x1b\n\tfail_open\x18\x03 \x01(\x08R\x08\x66\x61ilOpen\x12&\n\x0fstatus_on_error\x18\x04 \x01(\tR\rstatusOnError\x12\x99\x01\n\x1dinclude_request_body_in_check\x18\x06 \x01(\x0b\x32W.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationRequestBodyR\x19includeRequestBodyInCheck\x1ak\n\x15ZipkinTracingProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12$\n\x0emax_tag_length\x18\x03 \x01(\rR\x0cmaxTagLength\x1a\x91\x01\n\x18LightstepTracingProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12!\n\x0c\x61\x63\x63\x65ss_token\x18\x03 \x01(\tR\x0b\x61\x63\x63\x65ssToken\x12$\n\x0emax_tag_length\x18\x04 \x01(\rR\x0cmaxTagLength\x1al\n\x16\x44\x61tadogTracingProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12$\n\x0emax_tag_length\x18\x03 \x01(\rR\x0cmaxTagLength\x1al\n\x19SkyWalkingTracingProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12!\n\x0c\x61\x63\x63\x65ss_token\x18\x03 \x01(\tR\x0b\x61\x63\x63\x65ssToken\x1a\xdc\x02\n\x13StackdriverProvider\x12\x14\n\x05\x64\x65\x62ug\x18\x01 \x01(\x08R\x05\x64\x65\x62ug\x12T\n\x18max_number_of_attributes\x18\x02 \x01(\x0b\x32\x1b.google.protobuf.Int64ValueR\x15maxNumberOfAttributes\x12V\n\x19max_number_of_annotations\x18\x03 \x01(\x0b\x32\x1b.google.protobuf.Int64ValueR\x16maxNumberOfAnnotations\x12[\n\x1cmax_number_of_message_events\x18\x04 \x01(\x0b\x32\x1b.google.protobuf.Int64ValueR\x18maxNumberOfMessageEvents\x12$\n\x0emax_tag_length\x18\x05 \x01(\rR\x0cmaxTagLength\x1a\xd4\x02\n\x1eOpenCensusAgentTracingProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12w\n\x07\x63ontext\x18\x03 \x03(\x0e\x32].istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.OpenCensusAgentTracingProvider.TraceContextR\x07\x63ontext\x12$\n\x0emax_tag_length\x18\x04 \x01(\rR\x0cmaxTagLength\"e\n\x0cTraceContext\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\x15\n\x11W3C_TRACE_CONTEXT\x10\x01\x12\x0c\n\x08GRPC_BIN\x10\x02\x12\x17\n\x13\x43LOUD_TRACE_CONTEXT\x10\x03\x12\x06\n\x02\x42\x33\x10\x04\x42\n\n\x08provider\x1a,\n\x10\x44\x65\x66\x61ultProviders\x12\x18\n\x07tracing\x18\x01 \x01(\tR\x07tracing\x1a\xef\x01\n\x16ProxyPathNormalization\x12n\n\rnormalization\x18\x01 \x01(\x0e\x32H.istio.mesh.v1alpha1.MeshConfig.ProxyPathNormalization.NormalizationTypeR\rnormalization\"e\n\x11NormalizationType\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x00\x12\x08\n\x04NONE\x10\x01\x12\x08\n\x04\x42\x41SE\x10\x02\x12\x11\n\rMERGE_SLASHES\x10\x03\x12\x1c\n\x18\x44\x45\x43ODE_AND_MERGE_SLASHES\x10\x04\"J\n\x15IngressControllerMode\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\x07\n\x03OFF\x10\x01\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x02\x12\n\n\x06STRICT\x10\x03\"&\n\nAuthPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01\"\'\n\x11\x41\x63\x63\x65ssLogEncoding\x12\x08\n\x04TEXT\x10\x00\x12\x08\n\x04JSON\x10\x01\"2\n\x0fH2UpgradePolicy\x12\x12\n\x0e\x44O_NOT_UPGRADE\x10\x00\x12\x0b\n\x07UPGRADE\x10\x01J\x04\x08\x01\x10\x02J\x04\x08\x02\x10\x03J\x04\x08\x03\x10\x04J\x04\x08\x30\x10\x31J\x04\x08\x19\x10\x1aJ\x04\x08\x1e\x10\x1fJ\x04\x08\n\x10\x0bJ\x04\x08\x0b\x10\x0cJ\x04\x08\x0f\x10\x10J\x04\x08\x10\x10\x11J\x04\x08\x12\x10\x13J\x04\x08\x13\x10\x14J\x04\x08\x14\x10\x15J\x04\x08\x15\x10\x16J\x04\x08\x17\x10\x18J\x04\x08\x1d\x10\x1eJ\x04\x08\x35\x10\x36J\x04\x08%\x10&J\x04\x08&\x10\'J\x04\x08\'\x10(R\x12mixer_check_serverR\x13mixer_report_serverR\x15\x64isable_policy_checksR\x1a\x64isable_mixer_http_reportsR\x16policy_check_fail_openR%sidecar_to_telemetry_session_affinityR\x0b\x61uth_policyR\x11rds_refresh_delayR\rmixer_addressR\x1f\x65nable_client_side_policy_checkR\x0csds_uds_pathR\x11sds_refresh_delayR\x16\x65nable_sds_token_mountR\x12sds_use_k8s_sa_jwtR\x1atermination_drain_durationR\x14\x64isable_report_batchR\x18report_batch_max_entriesR\x15report_batch_max_time\"\xcb\x01\n\x0c\x43onfigSource\x12\x18\n\x07\x61\x64\x64ress\x18\x01 \x01(\tR\x07\x61\x64\x64ress\x12O\n\x0ctls_settings\x18\x02 \x01(\x0b\x32,.istio.networking.v1alpha3.ClientTLSSettingsR\x0btlsSettings\x12P\n\x14subscribed_resources\x18\x03 \x03(\x0e\x32\x1d.istio.mesh.v1alpha1.ResourceR\x13subscribedResources\"K\n\x0b\x43\x65rtificate\x12\x1f\n\x0bsecret_name\x18\x01 \x01(\tR\nsecretName\x12\x1b\n\tdns_names\x18\x02 \x03(\tR\x08\x64nsNames* \n\x08Resource\x12\x14\n\x10SERVICE_REGISTRY\x10\x00\x42\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3')
+  serialized_pb=_b('\n\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x1egoogle/protobuf/wrappers.proto\x1a\x19mesh/v1alpha1/proxy.proto\x1a*networking/v1alpha3/destination_rule.proto\x1a\x34k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto\"\xde\x43\n\nMeshConfig\x12*\n\x11proxy_listen_port\x18\x04 \x01(\x05R\x0fproxyListenPort\x12&\n\x0fproxy_http_port\x18\x05 \x01(\x05R\rproxyHttpPort\x12\x42\n\x0f\x63onnect_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.DurationR\x0e\x63onnectTimeout\x12W\n\x1aprotocol_detection_timeout\x18* \x01(\x0b\x32\x19.google.protobuf.DurationR\x18protocolDetectionTimeout\x12o\n\rtcp_keepalive\x18\x1c \x01(\x0b\x32J.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings.TcpKeepaliveR\x0ctcpKeepalive\x12#\n\ringress_class\x18\x07 \x01(\tR\x0cingressClass\x12\'\n\x0fingress_service\x18\x08 \x01(\tR\x0eingressService\x12m\n\x17ingress_controller_mode\x18\t \x01(\x0e\x32\x35.istio.mesh.v1alpha1.MeshConfig.IngressControllerModeR\x15ingressControllerMode\x12)\n\x10ingress_selector\x18\x34 \x01(\tR\x0fingressSelector\x12%\n\x0e\x65nable_tracing\x18\x0c \x01(\x08R\renableTracing\x12&\n\x0f\x61\x63\x63\x65ss_log_file\x18\r \x01(\tR\raccessLogFile\x12*\n\x11\x61\x63\x63\x65ss_log_format\x18\x18 \x01(\tR\x0f\x61\x63\x63\x65ssLogFormat\x12\x61\n\x13\x61\x63\x63\x65ss_log_encoding\x18\x1b \x01(\x0e\x32\x31.istio.mesh.v1alpha1.MeshConfig.AccessLogEncodingR\x11\x61\x63\x63\x65ssLogEncoding\x12\x44\n\x1f\x65nable_envoy_access_log_service\x18( \x01(\x08R\x1b\x65nableEnvoyAccessLogService\x12;\n\x1a\x64isable_envoy_listener_log\x18\x38 \x01(\x08R\x17\x64isableEnvoyListenerLog\x12G\n\x0e\x64\x65\x66\x61ult_config\x18\x0e \x01(\x0b\x32 .istio.mesh.v1alpha1.ProxyConfigR\rdefaultConfig\x12m\n\x17outbound_traffic_policy\x18\x11 \x01(\x0b\x32\x35.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicyR\x15outboundTrafficPolicy\x12H\n\x0e\x63onfig_sources\x18\x16 \x03(\x0b\x32!.istio.mesh.v1alpha1.ConfigSourceR\rconfigSources\x12\x44\n\x10\x65nable_auto_mtls\x18+ \x01(\x0b\x32\x1a.google.protobuf.BoolValueR\x0e\x65nableAutoMtls\x12!\n\x0ctrust_domain\x18\x1a \x01(\tR\x0btrustDomain\x12\x30\n\x14trust_domain_aliases\x18. \x03(\tR\x12trustDomainAliases\x12X\n\x0f\x63\x61_certificates\x18: \x03(\x0b\x32/.istio.mesh.v1alpha1.MeshConfig.CertificateDataR\x0e\x63\x61\x43\x65rtificates\x12\x39\n\x19\x64\x65\x66\x61ult_service_export_to\x18\x1f \x03(\tR\x16\x64\x65\x66\x61ultServiceExportTo\x12H\n!default_virtual_service_export_to\x18  \x03(\tR\x1d\x64\x65\x66\x61ultVirtualServiceExportTo\x12J\n\"default_destination_rule_export_to\x18! \x03(\tR\x1e\x64\x65\x66\x61ultDestinationRuleExportTo\x12%\n\x0eroot_namespace\x18\" \x01(\tR\rrootNamespace\x12\x66\n\x13locality_lb_setting\x18# \x01(\x0b\x32\x36.istio.networking.v1alpha3.LocalityLoadBalancerSettingR\x11localityLbSetting\x12\x43\n\x10\x64ns_refresh_rate\x18$ \x01(\x0b\x32\x19.google.protobuf.DurationR\x0e\x64nsRefreshRate\x12[\n\x11h2_upgrade_policy\x18) \x01(\x0e\x32/.istio.mesh.v1alpha1.MeshConfig.H2UpgradePolicyR\x0fh2UpgradePolicy\x12\x39\n\x19inbound_cluster_stat_name\x18, \x01(\tR\x16inboundClusterStatName\x12;\n\x1aoutbound_cluster_stat_name\x18- \x01(\tR\x17outboundClusterStatName\x12\x44\n\x0c\x63\x65rtificates\x18/ \x03(\x0b\x32 .istio.mesh.v1alpha1.CertificateR\x0c\x63\x65rtificates\x12Q\n\rthrift_config\x18\x31 \x01(\x0b\x32,.istio.mesh.v1alpha1.MeshConfig.ThriftConfigR\x0cthriftConfig\x12Z\n\x10service_settings\x18\x32 \x03(\x0b\x32/.istio.mesh.v1alpha1.MeshConfig.ServiceSettingsR\x0fserviceSettings\x12R\n\x17\x65nable_prometheus_merge\x18\x33 \x01(\x0b\x32\x1a.google.protobuf.BoolValueR\x15\x65nablePrometheusMerge\x12[\n\x1cverify_certificate_at_client\x18\x36 \x01(\x0b\x32\x1a.google.protobuf.BoolValueR\x19verifyCertificateAtClient\x12\x32\n\x02\x63\x61\x18\x37 \x01(\x0b\x32\".istio.mesh.v1alpha1.MeshConfig.CAR\x02\x63\x61\x12\x62\n\x13\x65xtension_providers\x18\x39 \x03(\x0b\x32\x31.istio.mesh.v1alpha1.MeshConfig.ExtensionProviderR\x12\x65xtensionProviders\x12]\n\x11\x64\x65\x66\x61ult_providers\x18< \x01(\x0b\x32\x30.istio.mesh.v1alpha1.MeshConfig.DefaultProvidersR\x10\x64\x65\x66\x61ultProviders\x12\x64\n\x13\x64iscovery_selectors\x18; \x03(\x0b\x32\x33.k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelectorR\x12\x64iscoverySelectors\x12\x65\n\x12path_normalization\x18= \x01(\x0b\x32\x36.istio.mesh.v1alpha1.MeshConfig.ProxyPathNormalizationR\x11pathNormalization\x1a\xad\x01\n\x15OutboundTrafficPolicy\x12N\n\x04mode\x18\x01 \x01(\x0e\x32:.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy.ModeR\x04mode\"D\n\x04Mode\x12\x11\n\rREGISTRY_ONLY\x10\x00\x12\r\n\tALLOW_ANY\x10\x01\"\x04\x08\x02\x10\x02*\x14VIRTUAL_SERVICE_ONLY\x1ag\n\x0f\x43\x65rtificateData\x12\x12\n\x03pem\x18\x01 \x01(\tH\x00R\x03pem\x12,\n\x11spiffe_bundle_url\x18\x02 \x01(\tH\x00R\x0fspiffeBundleUrlB\x12\n\x10\x63\x65rtificate_data\x1a}\n\x0cThriftConfig\x12$\n\x0erate_limit_url\x18\x01 \x01(\tR\x0crateLimitUrl\x12G\n\x12rate_limit_timeout\x18\x02 \x01(\x0b\x32\x19.google.protobuf.DurationR\x10rateLimitTimeout\x1a\xae\x01\n\x0fServiceSettings\x12T\n\x08settings\x18\x01 \x01(\x0b\x32\x38.istio.mesh.v1alpha1.MeshConfig.ServiceSettings.SettingsR\x08settings\x12\x14\n\x05hosts\x18\x02 \x03(\tR\x05hosts\x1a/\n\x08Settings\x12#\n\rcluster_local\x18\x01 \x01(\x08R\x0c\x63lusterLocal\x1a\xd4\x01\n\x02\x43\x41\x12\x18\n\x07\x61\x64\x64ress\x18\x01 \x01(\tR\x07\x61\x64\x64ress\x12O\n\x0ctls_settings\x18\x02 \x01(\x0b\x32,.istio.networking.v1alpha3.ClientTLSSettingsR\x0btlsSettings\x12\x42\n\x0frequest_timeout\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationR\x0erequestTimeout\x12\x1f\n\x0bistiod_side\x18\x04 \x01(\x08R\nistiodSide\x1a\xa5\x1e\n\x11\x45xtensionProvider\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\x12\x8b\x01\n\x14\x65nvoy_ext_authz_http\x18\x02 \x01(\x0b\x32X.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationHttpProviderH\x00R\x11\x65nvoyExtAuthzHttp\x12\x8b\x01\n\x14\x65nvoy_ext_authz_grpc\x18\x03 \x01(\x0b\x32X.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationGrpcProviderH\x00R\x11\x65nvoyExtAuthzGrpc\x12\x61\n\x06zipkin\x18\x04 \x01(\x0b\x32G.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.ZipkinTracingProviderH\x00R\x06zipkin\x12j\n\tlightstep\x18\x05 \x01(\x0b\x32J.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.LightstepTracingProviderH\x00R\tlightstep\x12\x64\n\x07\x64\x61tadog\x18\x06 \x01(\x0b\x32H.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.DatadogTracingProviderH\x00R\x07\x64\x61tadog\x12i\n\x0bstackdriver\x18\x07 \x01(\x0b\x32\x45.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.StackdriverProviderH\x00R\x0bstackdriver\x12r\n\nopencensus\x18\x08 \x01(\x0b\x32P.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.OpenCensusAgentTracingProviderH\x00R\nopencensus\x12m\n\nskywalking\x18\t \x01(\x0b\x32K.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.SkyWalkingTracingProviderH\x00R\nskywalking\x12\x64\n\nrate_limit\x18\n \x01(\x0b\x32\x43.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.RateLimitProviderH\x00R\trateLimit\x1a\xab\x01\n%EnvoyExternalAuthorizationRequestBody\x12*\n\x11max_request_bytes\x18\x01 \x01(\rR\x0fmaxRequestBytes\x12\x32\n\x15\x61llow_partial_message\x18\x02 \x01(\x08R\x13\x61llowPartialMessage\x12\"\n\rpack_as_bytes\x18\x03 \x01(\x08R\x0bpackAsBytes\x1a\xb2\x07\n&EnvoyExternalAuthorizationHttpProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12\x33\n\x07timeout\x18\t \x01(\x0b\x32\x19.google.protobuf.DurationR\x07timeout\x12\x1f\n\x0bpath_prefix\x18\x03 \x01(\tR\npathPrefix\x12\x1b\n\tfail_open\x18\x04 \x01(\x08R\x08\x66\x61ilOpen\x12&\n\x0fstatus_on_error\x18\x05 \x01(\tR\rstatusOnError\x12\x37\n\x18include_headers_in_check\x18\x06 \x03(\tR\x15includeHeadersInCheck\x12\x46\n include_request_headers_in_check\x18\n \x03(\tR\x1cincludeRequestHeadersInCheck\x12\xcb\x01\n#include_additional_headers_in_check\x18\x0b \x03(\x0b\x32}.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationHttpProvider.IncludeAdditionalHeadersInCheckEntryR\x1fincludeAdditionalHeadersInCheck\x12\x99\x01\n\x1dinclude_request_body_in_check\x18\x0c \x01(\x0b\x32W.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationRequestBodyR\x19includeRequestBodyInCheck\x12>\n\x1cheaders_to_upstream_on_allow\x18\x07 \x03(\tR\x18headersToUpstreamOnAllow\x12@\n\x1dheaders_to_downstream_on_deny\x18\x08 \x03(\tR\x19headersToDownstreamOnDeny\x1aR\n$IncludeAdditionalHeadersInCheckEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n\x05value\x18\x02 \x01(\tR\x05value:\x02\x38\x01\x1a\xec\x02\n&EnvoyExternalAuthorizationGrpcProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12\x33\n\x07timeout\x18\x05 \x01(\x0b\x32\x19.google.protobuf.DurationR\x07timeout\x12\x1b\n\tfail_open\x18\x03 \x01(\x08R\x08\x66\x61ilOpen\x12&\n\x0fstatus_on_error\x18\x04 \x01(\tR\rstatusOnError\x12\x99\x01\n\x1dinclude_request_body_in_check\x18\x06 \x01(\x0b\x32W.istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.EnvoyExternalAuthorizationRequestBodyR\x19includeRequestBodyInCheck\x1ak\n\x15ZipkinTracingProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12$\n\x0emax_tag_length\x18\x03 \x01(\rR\x0cmaxTagLength\x1a\x91\x01\n\x18LightstepTracingProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12!\n\x0c\x61\x63\x63\x65ss_token\x18\x03 \x01(\tR\x0b\x61\x63\x63\x65ssToken\x12$\n\x0emax_tag_length\x18\x04 \x01(\rR\x0cmaxTagLength\x1al\n\x16\x44\x61tadogTracingProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12$\n\x0emax_tag_length\x18\x03 \x01(\rR\x0cmaxTagLength\x1al\n\x19SkyWalkingTracingProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12!\n\x0c\x61\x63\x63\x65ss_token\x18\x03 \x01(\tR\x0b\x61\x63\x63\x65ssToken\x1a\xdc\x02\n\x13StackdriverProvider\x12\x14\n\x05\x64\x65\x62ug\x18\x01 \x01(\x08R\x05\x64\x65\x62ug\x12T\n\x18max_number_of_attributes\x18\x02 \x01(\x0b\x32\x1b.google.protobuf.Int64ValueR\x15maxNumberOfAttributes\x12V\n\x19max_number_of_annotations\x18\x03 \x01(\x0b\x32\x1b.google.protobuf.Int64ValueR\x16maxNumberOfAnnotations\x12[\n\x1cmax_number_of_message_events\x18\x04 \x01(\x0b\x32\x1b.google.protobuf.Int64ValueR\x18maxNumberOfMessageEvents\x12$\n\x0emax_tag_length\x18\x05 \x01(\rR\x0cmaxTagLength\x1a\xd4\x02\n\x1eOpenCensusAgentTracingProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12w\n\x07\x63ontext\x18\x03 \x03(\x0e\x32].istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.OpenCensusAgentTracingProvider.TraceContextR\x07\x63ontext\x12$\n\x0emax_tag_length\x18\x04 \x01(\rR\x0cmaxTagLength\"e\n\x0cTraceContext\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\x15\n\x11W3C_TRACE_CONTEXT\x10\x01\x12\x0c\n\x08GRPC_BIN\x10\x02\x12\x17\n\x13\x43LOUD_TRACE_CONTEXT\x10\x03\x12\x06\n\x02\x42\x33\x10\x04\x1a\x85\x01\n\x11RateLimitProvider\x12\x18\n\x07service\x18\x01 \x01(\tR\x07service\x12\x12\n\x04port\x18\x02 \x01(\rR\x04port\x12\x16\n\x06\x64omain\x18\x03 \x01(\tR\x06\x64omain\x12*\n\x11\x66\x61ilure_mode_deny\x18\x04 \x01(\x08R\x0f\x66\x61ilureModeDenyB\n\n\x08provider\x1a,\n\x10\x44\x65\x66\x61ultProviders\x12\x18\n\x07tracing\x18\x01 \x01(\tR\x07tracing\x1a\xef\x01\n\x16ProxyPathNormalization\x12n\n\rnormalization\x18\x01 \x01(\x0e\x32H.istio.mesh.v1alpha1.MeshConfig.ProxyPathNormalization.NormalizationTypeR\rnormalization\"e\n\x11NormalizationType\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x00\x12\x08\n\x04NONE\x10\x01\x12\x08\n\x04\x42\x41SE\x10\x02\x12\x11\n\rMERGE_SLASHES\x10\x03\x12\x1c\n\x18\x44\x45\x43ODE_AND_MERGE_SLASHES\x10\x04\"J\n\x15IngressControllerMode\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\x07\n\x03OFF\x10\x01\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x02\x12\n\n\x06STRICT\x10\x03\"&\n\nAuthPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01\"\'\n\x11\x41\x63\x63\x65ssLogEncoding\x12\x08\n\x04TEXT\x10\x00\x12\x08\n\x04JSON\x10\x01\"2\n\x0fH2UpgradePolicy\x12\x12\n\x0e\x44O_NOT_UPGRADE\x10\x00\x12\x0b\n\x07UPGRADE\x10\x01J\x04\x08\x01\x10\x02J\x04\x08\x02\x10\x03J\x04\x08\x03\x10\x04J\x04\x08\x30\x10\x31J\x04\x08\x19\x10\x1aJ\x04\x08\x1e\x10\x1fJ\x04\x08\n\x10\x0bJ\x04\x08\x0b\x10\x0cJ\x04\x08\x0f\x10\x10J\x04\x08\x10\x10\x11J\x04\x08\x12\x10\x13J\x04\x08\x13\x10\x14J\x04\x08\x14\x10\x15J\x04\x08\x15\x10\x16J\x04\x08\x17\x10\x18J\x04\x08\x1d\x10\x1eJ\x04\x08\x35\x10\x36J\x04\x08%\x10&J\x04\x08&\x10\'J\x04\x08\'\x10(R\x12mixer_check_serverR\x13mixer_report_serverR\x15\x64isable_policy_checksR\x1a\x64isable_mixer_http_reportsR\x16policy_check_fail_openR%sidecar_to_telemetry_session_affinityR\x0b\x61uth_policyR\x11rds_refresh_delayR\rmixer_addressR\x1f\x65nable_client_side_policy_checkR\x0csds_uds_pathR\x11sds_refresh_delayR\x16\x65nable_sds_token_mountR\x12sds_use_k8s_sa_jwtR\x1atermination_drain_durationR\x14\x64isable_report_batchR\x18report_batch_max_entriesR\x15report_batch_max_time\"\xcb\x01\n\x0c\x43onfigSource\x12\x18\n\x07\x61\x64\x64ress\x18\x01 \x01(\tR\x07\x61\x64\x64ress\x12O\n\x0ctls_settings\x18\x02 \x01(\x0b\x32,.istio.networking.v1alpha3.ClientTLSSettingsR\x0btlsSettings\x12P\n\x14subscribed_resources\x18\x03 \x03(\x0e\x32\x1d.istio.mesh.v1alpha1.ResourceR\x13subscribedResources\"K\n\x0b\x43\x65rtificate\x12\x1f\n\x0bsecret_name\x18\x01 \x01(\tR\nsecretName\x12\x1b\n\tdns_names\x18\x02 \x03(\tR\x08\x64nsNames* \n\x08Resource\x12\x14\n\x10SERVICE_REGISTRY\x10\x00\x42\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3')
   ,
   dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,google_dot_protobuf_dot_wrappers__pb2.DESCRIPTOR,mesh_dot_v1alpha1_dot_proxy__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_destination__rule__pb2.DESCRIPTOR,k8s_dot_io_dot_apimachinery_dot_pkg_dot_apis_dot_meta_dot_v1_dot_generated__pb2.DESCRIPTOR,])
 
@@ -43,8 +43,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=8958,
-  serialized_end=8990,
+  serialized_start=9196,
+  serialized_end=9228,
 )
 _sym_db.RegisterEnumDescriptor(_RESOURCE)
 
@@ -103,8 +103,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=7532,
-  serialized_end=7633,
+  serialized_start=7634,
+  serialized_end=7735,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_EXTENSIONPROVIDER_OPENCENSUSAGENTTRACINGPROVIDER_TRACECONTEXT)
 
@@ -137,8 +137,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=7832,
-  serialized_end=7933,
+  serialized_start=8070,
+  serialized_end=8171,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_PROXYPATHNORMALIZATION_NORMALIZATIONTYPE)
 
@@ -167,8 +167,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=7935,
-  serialized_end=8009,
+  serialized_start=8173,
+  serialized_end=8247,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_INGRESSCONTROLLERMODE)
 
@@ -189,8 +189,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=8011,
-  serialized_end=8049,
+  serialized_start=8249,
+  serialized_end=8287,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_AUTHPOLICY)
 
@@ -211,8 +211,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=8051,
-  serialized_end=8090,
+  serialized_start=8289,
+  serialized_end=8328,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_ACCESSLOGENCODING)
 
@@ -233,8 +233,8 @@
   ],
   containing_type=None,
   serialized_options=None,
-  serialized_start=8092,
-  serialized_end=8142,
+  serialized_start=8330,
+  serialized_end=8380,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_H2UPGRADEPOLICY)
 
@@ -505,8 +505,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=4975,
-  serialized_end=5146,
+  serialized_start=5077,
+  serialized_end=5248,
 )
 
 _MESHCONFIG_EXTENSIONPROVIDER_ENVOYEXTERNALAUTHORIZATIONHTTPPROVIDER_INCLUDEADDITIONALHEADERSINCHECKENTRY = _descriptor.Descriptor(
@@ -542,8 +542,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=6013,
-  serialized_end=6095,
+  serialized_start=6115,
+  serialized_end=6197,
 )
 
 _MESHCONFIG_EXTENSIONPROVIDER_ENVOYEXTERNALAUTHORIZATIONHTTPPROVIDER = _descriptor.Descriptor(
@@ -649,8 +649,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=5149,
-  serialized_end=6095,
+  serialized_start=5251,
+  serialized_end=6197,
 )
 
 _MESHCONFIG_EXTENSIONPROVIDER_ENVOYEXTERNALAUTHORIZATIONGRPCPROVIDER = _descriptor.Descriptor(
@@ -714,8 +714,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=6098,
-  serialized_end=6462,
+  serialized_start=6200,
+  serialized_end=6564,
 )
 
 _MESHCONFIG_EXTENSIONPROVIDER_ZIPKINTRACINGPROVIDER = _descriptor.Descriptor(
@@ -758,8 +758,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=6464,
-  serialized_end=6571,
+  serialized_start=6566,
+  serialized_end=6673,
 )
 
 _MESHCONFIG_EXTENSIONPROVIDER_LIGHTSTEPTRACINGPROVIDER = _descriptor.Descriptor(
@@ -809,8 +809,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=6574,
-  serialized_end=6719,
+  serialized_start=6676,
+  serialized_end=6821,
 )
 
 _MESHCONFIG_EXTENSIONPROVIDER_DATADOGTRACINGPROVIDER = _descriptor.Descriptor(
@@ -853,8 +853,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=6721,
-  serialized_end=6829,
+  serialized_start=6823,
+  serialized_end=6931,
 )
 
 _MESHCONFIG_EXTENSIONPROVIDER_SKYWALKINGTRACINGPROVIDER = _descriptor.Descriptor(
@@ -897,8 +897,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=6831,
-  serialized_end=6939,
+  serialized_start=6933,
+  serialized_end=7041,
 )
 
 _MESHCONFIG_EXTENSIONPROVIDER_STACKDRIVERPROVIDER = _descriptor.Descriptor(
@@ -955,8 +955,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=6942,
-  serialized_end=7290,
+  serialized_start=7044,
+  serialized_end=7392,
 )
 
 _MESHCONFIG_EXTENSIONPROVIDER_OPENCENSUSAGENTTRACINGPROVIDER = _descriptor.Descriptor(
@@ -1007,8 +1007,59 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=7293,
-  serialized_end=7633,
+  serialized_start=7395,
+  serialized_end=7735,
+)
+
+_MESHCONFIG_EXTENSIONPROVIDER_RATELIMITPROVIDER = _descriptor.Descriptor(
+  name='RateLimitProvider',
+  full_name='istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.RateLimitProvider',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='service', full_name='istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.RateLimitProvider.service', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='service', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='port', full_name='istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.RateLimitProvider.port', index=1,
+      number=2, type=13, cpp_type=3, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='port', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='domain', full_name='istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.RateLimitProvider.domain', index=2,
+      number=3, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='domain', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='failure_mode_deny', full_name='istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.RateLimitProvider.failure_mode_deny', index=3,
+      number=4, type=8, cpp_type=7, label=1,
+      has_default_value=False, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='failureModeDeny', file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=7738,
+  serialized_end=7871,
 )
 
 _MESHCONFIG_EXTENSIONPROVIDER = _descriptor.Descriptor(
@@ -1081,10 +1132,17 @@
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       serialized_options=None, json_name='skywalking', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='rate_limit', full_name='istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.rate_limit', index=9,
+      number=10, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='rateLimit', file=DESCRIPTOR),
   ],
   extensions=[
   ],
-  nested_types=[_MESHCONFIG_EXTENSIONPROVIDER_ENVOYEXTERNALAUTHORIZATIONREQUESTBODY, _MESHCONFIG_EXTENSIONPROVIDER_ENVOYEXTERNALAUTHORIZATIONHTTPPROVIDER, _MESHCONFIG_EXTENSIONPROVIDER_ENVOYEXTERNALAUTHORIZATIONGRPCPROVIDER, _MESHCONFIG_EXTENSIONPROVIDER_ZIPKINTRACINGPROVIDER, _MESHCONFIG_EXTENSIONPROVIDER_LIGHTSTEPTRACINGPROVIDER, _MESHCONFIG_EXTENSIONPROVIDER_DATADOGTRACINGPROVIDER, _MESHCONFIG_EXTENSIONPROVIDER_SKYWALKINGTRACINGPROVIDER, _MESHCONFIG_EXTENSIONPROVIDER_STACKDRIVERPROVIDER, _MESHCONFIG_EXTENSIONPROVIDER_OPENCENSUSAGENTTRACINGPROVIDER, ],
+  nested_types=[_MESHCONFIG_EXTENSIONPROVIDER_ENVOYEXTERNALAUTHORIZATIONREQUESTBODY, _MESHCONFIG_EXTENSIONPROVIDER_ENVOYEXTERNALAUTHORIZATIONHTTPPROVIDER, _MESHCONFIG_EXTENSIONPROVIDER_ENVOYEXTERNALAUTHORIZATIONGRPCPROVIDER, _MESHCONFIG_EXTENSIONPROVIDER_ZIPKINTRACINGPROVIDER, _MESHCONFIG_EXTENSIONPROVIDER_LIGHTSTEPTRACINGPROVIDER, _MESHCONFIG_EXTENSIONPROVIDER_DATADOGTRACINGPROVIDER, _MESHCONFIG_EXTENSIONPROVIDER_SKYWALKINGTRACINGPROVIDER, _MESHCONFIG_EXTENSIONPROVIDER_STACKDRIVERPROVIDER, _MESHCONFIG_EXTENSIONPROVIDER_OPENCENSUSAGENTTRACINGPROVIDER, _MESHCONFIG_EXTENSIONPROVIDER_RATELIMITPROVIDER, ],
   enum_types=[
   ],
   serialized_options=None,
@@ -1097,7 +1155,7 @@
       index=0, containing_type=None, fields=[]),
   ],
   serialized_start=4006,
-  serialized_end=7645,
+  serialized_end=7883,
 )
 
 _MESHCONFIG_DEFAULTPROVIDERS = _descriptor.Descriptor(
@@ -1126,8 +1184,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=7647,
-  serialized_end=7691,
+  serialized_start=7885,
+  serialized_end=7929,
 )
 
 _MESHCONFIG_PROXYPATHNORMALIZATION = _descriptor.Descriptor(
@@ -1157,8 +1215,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=7694,
-  serialized_end=7933,
+  serialized_start=7932,
+  serialized_end=8171,
 )
 
 _MESHCONFIG = _descriptor.Descriptor(
@@ -1472,7 +1530,7 @@
   oneofs=[
   ],
   serialized_start=241,
-  serialized_end=8673,
+  serialized_end=8911,
 )
 
 
@@ -1516,8 +1574,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=8676,
-  serialized_end=8879,
+  serialized_start=8914,
+  serialized_end=9117,
 )
 
 
@@ -1554,8 +1612,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=8881,
-  serialized_end=8956,
+  serialized_start=9119,
+  serialized_end=9194,
 )
 
 _MESHCONFIG_OUTBOUNDTRAFFICPOLICY.fields_by_name['mode'].enum_type = _MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE
@@ -1596,6 +1654,7 @@
 _MESHCONFIG_EXTENSIONPROVIDER_OPENCENSUSAGENTTRACINGPROVIDER.fields_by_name['context'].enum_type = _MESHCONFIG_EXTENSIONPROVIDER_OPENCENSUSAGENTTRACINGPROVIDER_TRACECONTEXT
 _MESHCONFIG_EXTENSIONPROVIDER_OPENCENSUSAGENTTRACINGPROVIDER.containing_type = _MESHCONFIG_EXTENSIONPROVIDER
 _MESHCONFIG_EXTENSIONPROVIDER_OPENCENSUSAGENTTRACINGPROVIDER_TRACECONTEXT.containing_type = _MESHCONFIG_EXTENSIONPROVIDER_OPENCENSUSAGENTTRACINGPROVIDER
+_MESHCONFIG_EXTENSIONPROVIDER_RATELIMITPROVIDER.containing_type = _MESHCONFIG_EXTENSIONPROVIDER
 _MESHCONFIG_EXTENSIONPROVIDER.fields_by_name['envoy_ext_authz_http'].message_type = _MESHCONFIG_EXTENSIONPROVIDER_ENVOYEXTERNALAUTHORIZATIONHTTPPROVIDER
 _MESHCONFIG_EXTENSIONPROVIDER.fields_by_name['envoy_ext_authz_grpc'].message_type = _MESHCONFIG_EXTENSIONPROVIDER_ENVOYEXTERNALAUTHORIZATIONGRPCPROVIDER
 _MESHCONFIG_EXTENSIONPROVIDER.fields_by_name['zipkin'].message_type = _MESHCONFIG_EXTENSIONPROVIDER_ZIPKINTRACINGPROVIDER
@@ -1604,6 +1663,7 @@
 _MESHCONFIG_EXTENSIONPROVIDER.fields_by_name['stackdriver'].message_type = _MESHCONFIG_EXTENSIONPROVIDER_STACKDRIVERPROVIDER
 _MESHCONFIG_EXTENSIONPROVIDER.fields_by_name['opencensus'].message_type = _MESHCONFIG_EXTENSIONPROVIDER_OPENCENSUSAGENTTRACINGPROVIDER
 _MESHCONFIG_EXTENSIONPROVIDER.fields_by_name['skywalking'].message_type = _MESHCONFIG_EXTENSIONPROVIDER_SKYWALKINGTRACINGPROVIDER
+_MESHCONFIG_EXTENSIONPROVIDER.fields_by_name['rate_limit'].message_type = _MESHCONFIG_EXTENSIONPROVIDER_RATELIMITPROVIDER
 _MESHCONFIG_EXTENSIONPROVIDER.containing_type = _MESHCONFIG
 _MESHCONFIG_EXTENSIONPROVIDER.oneofs_by_name['provider'].fields.append(
   _MESHCONFIG_EXTENSIONPROVIDER.fields_by_name['envoy_ext_authz_http'])
@@ -1629,6 +1689,9 @@
 _MESHCONFIG_EXTENSIONPROVIDER.oneofs_by_name['provider'].fields.append(
   _MESHCONFIG_EXTENSIONPROVIDER.fields_by_name['skywalking'])
 _MESHCONFIG_EXTENSIONPROVIDER.fields_by_name['skywalking'].containing_oneof = _MESHCONFIG_EXTENSIONPROVIDER.oneofs_by_name['provider']
+_MESHCONFIG_EXTENSIONPROVIDER.oneofs_by_name['provider'].fields.append(
+  _MESHCONFIG_EXTENSIONPROVIDER.fields_by_name['rate_limit'])
+_MESHCONFIG_EXTENSIONPROVIDER.fields_by_name['rate_limit'].containing_oneof = _MESHCONFIG_EXTENSIONPROVIDER.oneofs_by_name['provider']
 _MESHCONFIG_DEFAULTPROVIDERS.containing_type = _MESHCONFIG
 _MESHCONFIG_PROXYPATHNORMALIZATION.fields_by_name['normalization'].enum_type = _MESHCONFIG_PROXYPATHNORMALIZATION_NORMALIZATIONTYPE
 _MESHCONFIG_PROXYPATHNORMALIZATION.containing_type = _MESHCONFIG
@@ -1783,6 +1846,13 @@
       # @@protoc_insertion_point(class_scope:istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.OpenCensusAgentTracingProvider)
       })
     ,
+
+    'RateLimitProvider' : _reflection.GeneratedProtocolMessageType('RateLimitProvider', (_message.Message,), {
+      'DESCRIPTOR' : _MESHCONFIG_EXTENSIONPROVIDER_RATELIMITPROVIDER,
+      '__module__' : 'mesh.v1alpha1.config_pb2'
+      # @@protoc_insertion_point(class_scope:istio.mesh.v1alpha1.MeshConfig.ExtensionProvider.RateLimitProvider)
+      })
+    ,
     'DESCRIPTOR' : _MESHCONFIG_EXTENSIONPROVIDER,
     '__module__' : 'mesh.v1alpha1.config_pb2'
     # @@protoc_insertion_point(class_scope:istio.mesh.v1alpha1.MeshConfig.ExtensionProvider)
@@ -1824,6 +1894,7 @@
 _sym_db.RegisterMessage(MeshConfig.ExtensionProvider.SkyWalkingTracingProvider)
 _sym_db.RegisterMessage(MeshConfig.ExtensionProvider.StackdriverProvider)
 _sym_db.RegisterMessage(MeshConfig.ExtensionProvider.OpenCensusAgentTracingProvider)
+_sym_db.RegisterMessage(MeshConfig.ExtensionProvider.RateLimitProvider)
 _sym_db.RegisterMessage(MeshConfig.DefaultProviders)
 _sym_db.RegisterMessage(MeshConfig.ProxyPathNormalization)
 
diff --git a/python/istio_api/policy/v1alpha1/ratelimit_pb2.py b/python/istio_api/policy/v1alpha1/ratelimit_pb2.py
new file mode 100644
index 00000000000..c0f126ce6b6
--- /dev/null
+++ b/python/istio_api/policy/v1alpha1/ratelimit_pb2.py
@@ -0,0 +1,812 @@
+# -*- coding: utf-8 -*-
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: policy/v1alpha1/ratelimit.proto
+
+import sys
+_b=sys.version_info[0]<3 and (lambda x:x) or (lambda x:x.encode('latin1'))
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import message as _message
+from google.protobuf import reflection as _reflection
+from google.protobuf import symbol_database as _symbol_database
+# @@protoc_insertion_point(imports)
+
+_sym_db = _symbol_database.Default()
+
+
+from type.v1beta1 import selector_pb2 as type_dot_v1beta1_dot_selector__pb2
+from google.protobuf import wrappers_pb2 as google_dot_protobuf_dot_wrappers__pb2
+from google.protobuf import duration_pb2 as google_dot_protobuf_dot_duration__pb2
+
+
+DESCRIPTOR = _descriptor.FileDescriptor(
+  name='policy/v1alpha1/ratelimit.proto',
+  package='istio.policy.v1alpha1',
+  syntax='proto3',
+  serialized_options=_b('Z\034istio.io/api/policy/v1alpha1'),
+  serialized_pb=_b('\n\x1fpolicy/v1alpha1/ratelimit.proto\x12\x15istio.policy.v1alpha1\x1a\x1btype/v1beta1/selector.proto\x1a\x1egoogle/protobuf/wrappers.proto\x1a\x1egoogle/protobuf/duration.proto\"\xed\x02\n\tRateLimit\x12\x42\n\x08workload\x18\x01 \x01(\x0b\x32$.istio.type.v1beta1.WorkloadSelectorH\x00R\x08workload\x12<\n\x05route\x18\x02 \x01(\x0b\x32$.istio.policy.v1alpha1.RouteSelectorH\x00R\x05route\x12L\n\x0b\x64\x65scriptors\x18\x03 \x03(\x0b\x32*.istio.policy.v1alpha1.RateLimitDescriptorR\x0b\x64\x65scriptors\x12<\n\x06global\x18\x04 \x01(\x0b\x32\".istio.policy.v1alpha1.ProviderRefH\x01R\x06global\x12=\n\x05local\x18\x05 \x01(\x0b\x32%.istio.policy.v1alpha1.LocalRateLimitH\x01R\x05localB\t\n\x07\x62indingB\x08\n\x06policy\"c\n\rRouteSelector\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\x12\x14\n\x05group\x18\x02 \x01(\tR\x05group\x12\x12\n\x04kind\x18\x03 \x01(\tR\x04kind\x12\x14\n\x05route\x18\x04 \x01(\tR\x05route\"V\n\x13RateLimitDescriptor\x12?\n\x07\x65ntries\x18\x01 \x03(\x0b\x32%.istio.policy.v1alpha1.RateLimitEntryR\x07\x65ntries\"\x85\x07\n\x0eRateLimitEntry\x12M\n\x06header\x18\x01 \x01(\x0b\x32\x33.istio.policy.v1alpha1.RateLimitEntry.RequestHeaderH\x00R\x06header\x12]\n\x0cheader_match\x18\x02 \x01(\x0b\x32\x38.istio.policy.v1alpha1.RateLimitEntry.RequestHeaderMatchH\x00R\x0bheaderMatch\x12Q\n\x08\x63onstant\x18\x03 \x01(\x0b\x32\x33.istio.policy.v1alpha1.RateLimitEntry.ConstantEntryH\x00R\x08\x63onstant\x12R\n\nexpression\x18\x04 \x01(\x0b\x32\x30.istio.policy.v1alpha1.RateLimitEntry.ExpressionH\x00R\nexpression\x1a[\n\rRequestHeader\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x12\n\x04name\x18\x02 \x01(\tR\x04name\x12$\n\x0eskip_if_absent\x18\x03 \x01(\x08R\x0cskipIfAbsent\x1a\xa1\x02\n\x12RequestHeaderMatch\x12\x14\n\x05value\x18\x01 \x01(\tR\x05value\x12m\n\nconditions\x18\x03 \x03(\x0b\x32M.istio.policy.v1alpha1.RateLimitEntry.RequestHeaderMatch.HeaderMatchConditionR\nconditions\x1a\x85\x01\n\x14HeaderMatchCondition\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\x12\x16\n\x05\x65xact\x18\x02 \x01(\tH\x00R\x05\x65xact\x12\x18\n\x06prefix\x18\x03 \x01(\tH\x00R\x06prefix\x12\x1a\n\x07present\x18\x04 \x01(\x08H\x00R\x07presentB\x0b\n\tcondition\x1a\x37\n\rConstantEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n\x05value\x18\x02 \x01(\tR\x05value\x1aV\n\nExpression\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\"\n\rskip_if_error\x18\x02 \x01(\x08R\x0bskipIfError\x12\x12\n\x04text\x18\x03 \x01(\tR\x04textB\x0c\n\nentry_type\"!\n\x0bProviderRef\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\"\x95\x05\n\x0eLocalRateLimit\x12T\n\x0ctoken_bucket\x18\x01 \x01(\x0b\x32\x31.istio.policy.v1alpha1.LocalRateLimit.TokenBucketR\x0btokenBucket\x12`\n\x0b\x64\x65scriptors\x18\x02 \x03(\x0b\x32>.istio.policy.v1alpha1.LocalRateLimit.LocalRateLimitDescriptorR\x0b\x64\x65scriptors\x1a\xb2\x01\n\x0bTokenBucket\x12\x1d\n\nmax_tokens\x18\x01 \x01(\rR\tmaxTokens\x12\x44\n\x0ftokens_per_fill\x18\x02 \x01(\x0b\x32\x1c.google.protobuf.UInt32ValueR\rtokensPerFill\x12>\n\rfill_interval\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationR\x0c\x66illInterval\x1a\x95\x02\n\x18LocalRateLimitDescriptor\x12T\n\x0ctoken_bucket\x18\x01 \x01(\x0b\x32\x31.istio.policy.v1alpha1.LocalRateLimit.TokenBucketR\x0btokenBucket\x12h\n\x07\x65ntries\x18\x02 \x03(\x0b\x32N.istio.policy.v1alpha1.LocalRateLimit.LocalRateLimitDescriptor.DescriptorEntryR\x07\x65ntries\x1a\x39\n\x0f\x44\x65scriptorEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n\x05value\x18\x02 \x01(\tR\x05valueB\x1eZ\x1cistio.io/api/policy/v1alpha1b\x06proto3')
+  ,
+  dependencies=[type_dot_v1beta1_dot_selector__pb2.DESCRIPTOR,google_dot_protobuf_dot_wrappers__pb2.DESCRIPTOR,google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,])
+
+
+
+
+_RATELIMIT = _descriptor.Descriptor(
+  name='RateLimit',
+  full_name='istio.policy.v1alpha1.RateLimit',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='workload', full_name='istio.policy.v1alpha1.RateLimit.workload', index=0,
+      number=1, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='workload', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='route', full_name='istio.policy.v1alpha1.RateLimit.route', index=1,
+      number=2, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='route', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='descriptors', full_name='istio.policy.v1alpha1.RateLimit.descriptors', index=2,
+      number=3, type=11, cpp_type=10, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='descriptors', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='global', full_name='istio.policy.v1alpha1.RateLimit.global', index=3,
+      number=4, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='global', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='local', full_name='istio.policy.v1alpha1.RateLimit.local', index=4,
+      number=5, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='local', file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+    _descriptor.OneofDescriptor(
+      name='binding', full_name='istio.policy.v1alpha1.RateLimit.binding',
+      index=0, containing_type=None, fields=[]),
+    _descriptor.OneofDescriptor(
+      name='policy', full_name='istio.policy.v1alpha1.RateLimit.policy',
+      index=1, containing_type=None, fields=[]),
+  ],
+  serialized_start=152,
+  serialized_end=517,
+)
+
+
+_ROUTESELECTOR = _descriptor.Descriptor(
+  name='RouteSelector',
+  full_name='istio.policy.v1alpha1.RouteSelector',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='name', full_name='istio.policy.v1alpha1.RouteSelector.name', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='name', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='group', full_name='istio.policy.v1alpha1.RouteSelector.group', index=1,
+      number=2, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='group', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='kind', full_name='istio.policy.v1alpha1.RouteSelector.kind', index=2,
+      number=3, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='kind', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='route', full_name='istio.policy.v1alpha1.RouteSelector.route', index=3,
+      number=4, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='route', file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=519,
+  serialized_end=618,
+)
+
+
+_RATELIMITDESCRIPTOR = _descriptor.Descriptor(
+  name='RateLimitDescriptor',
+  full_name='istio.policy.v1alpha1.RateLimitDescriptor',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='entries', full_name='istio.policy.v1alpha1.RateLimitDescriptor.entries', index=0,
+      number=1, type=11, cpp_type=10, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='entries', file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=620,
+  serialized_end=706,
+)
+
+
+_RATELIMITENTRY_REQUESTHEADER = _descriptor.Descriptor(
+  name='RequestHeader',
+  full_name='istio.policy.v1alpha1.RateLimitEntry.RequestHeader',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='key', full_name='istio.policy.v1alpha1.RateLimitEntry.RequestHeader.key', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='key', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='name', full_name='istio.policy.v1alpha1.RateLimitEntry.RequestHeader.name', index=1,
+      number=2, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='name', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='skip_if_absent', full_name='istio.policy.v1alpha1.RateLimitEntry.RequestHeader.skip_if_absent', index=2,
+      number=3, type=8, cpp_type=7, label=1,
+      has_default_value=False, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='skipIfAbsent', file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=1068,
+  serialized_end=1159,
+)
+
+_RATELIMITENTRY_REQUESTHEADERMATCH_HEADERMATCHCONDITION = _descriptor.Descriptor(
+  name='HeaderMatchCondition',
+  full_name='istio.policy.v1alpha1.RateLimitEntry.RequestHeaderMatch.HeaderMatchCondition',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='name', full_name='istio.policy.v1alpha1.RateLimitEntry.RequestHeaderMatch.HeaderMatchCondition.name', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='name', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='exact', full_name='istio.policy.v1alpha1.RateLimitEntry.RequestHeaderMatch.HeaderMatchCondition.exact', index=1,
+      number=2, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='exact', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='prefix', full_name='istio.policy.v1alpha1.RateLimitEntry.RequestHeaderMatch.HeaderMatchCondition.prefix', index=2,
+      number=3, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='prefix', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='present', full_name='istio.policy.v1alpha1.RateLimitEntry.RequestHeaderMatch.HeaderMatchCondition.present', index=3,
+      number=4, type=8, cpp_type=7, label=1,
+      has_default_value=False, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='present', file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+    _descriptor.OneofDescriptor(
+      name='condition', full_name='istio.policy.v1alpha1.RateLimitEntry.RequestHeaderMatch.HeaderMatchCondition.condition',
+      index=0, containing_type=None, fields=[]),
+  ],
+  serialized_start=1318,
+  serialized_end=1451,
+)
+
+_RATELIMITENTRY_REQUESTHEADERMATCH = _descriptor.Descriptor(
+  name='RequestHeaderMatch',
+  full_name='istio.policy.v1alpha1.RateLimitEntry.RequestHeaderMatch',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='value', full_name='istio.policy.v1alpha1.RateLimitEntry.RequestHeaderMatch.value', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='value', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='conditions', full_name='istio.policy.v1alpha1.RateLimitEntry.RequestHeaderMatch.conditions', index=1,
+      number=3, type=11, cpp_type=10, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='conditions', file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[_RATELIMITENTRY_REQUESTHEADERMATCH_HEADERMATCHCONDITION, ],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=1162,
+  serialized_end=1451,
+)
+
+_RATELIMITENTRY_CONSTANTENTRY = _descriptor.Descriptor(
+  name='ConstantEntry',
+  full_name='istio.policy.v1alpha1.RateLimitEntry.ConstantEntry',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='key', full_name='istio.policy.v1alpha1.RateLimitEntry.ConstantEntry.key', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='key', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='value', full_name='istio.policy.v1alpha1.RateLimitEntry.ConstantEntry.value', index=1,
+      number=2, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='value', file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=1453,
+  serialized_end=1508,
+)
+
+_RATELIMITENTRY_EXPRESSION = _descriptor.Descriptor(
+  name='Expression',
+  full_name='istio.policy.v1alpha1.RateLimitEntry.Expression',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='key', full_name='istio.policy.v1alpha1.RateLimitEntry.Expression.key', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='key', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='skip_if_error', full_name='istio.policy.v1alpha1.RateLimitEntry.Expression.skip_if_error', index=1,
+      number=2, type=8, cpp_type=7, label=1,
+      has_default_value=False, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='skipIfError', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='text', full_name='istio.policy.v1alpha1.RateLimitEntry.Expression.text', index=2,
+      number=3, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='text', file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=1510,
+  serialized_end=1596,
+)
+
+_RATELIMITENTRY = _descriptor.Descriptor(
+  name='RateLimitEntry',
+  full_name='istio.policy.v1alpha1.RateLimitEntry',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='header', full_name='istio.policy.v1alpha1.RateLimitEntry.header', index=0,
+      number=1, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='header', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='header_match', full_name='istio.policy.v1alpha1.RateLimitEntry.header_match', index=1,
+      number=2, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='headerMatch', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='constant', full_name='istio.policy.v1alpha1.RateLimitEntry.constant', index=2,
+      number=3, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='constant', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='expression', full_name='istio.policy.v1alpha1.RateLimitEntry.expression', index=3,
+      number=4, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='expression', file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[_RATELIMITENTRY_REQUESTHEADER, _RATELIMITENTRY_REQUESTHEADERMATCH, _RATELIMITENTRY_CONSTANTENTRY, _RATELIMITENTRY_EXPRESSION, ],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+    _descriptor.OneofDescriptor(
+      name='entry_type', full_name='istio.policy.v1alpha1.RateLimitEntry.entry_type',
+      index=0, containing_type=None, fields=[]),
+  ],
+  serialized_start=709,
+  serialized_end=1610,
+)
+
+
+_PROVIDERREF = _descriptor.Descriptor(
+  name='ProviderRef',
+  full_name='istio.policy.v1alpha1.ProviderRef',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='name', full_name='istio.policy.v1alpha1.ProviderRef.name', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='name', file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=1612,
+  serialized_end=1645,
+)
+
+
+_LOCALRATELIMIT_TOKENBUCKET = _descriptor.Descriptor(
+  name='TokenBucket',
+  full_name='istio.policy.v1alpha1.LocalRateLimit.TokenBucket',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='max_tokens', full_name='istio.policy.v1alpha1.LocalRateLimit.TokenBucket.max_tokens', index=0,
+      number=1, type=13, cpp_type=3, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='maxTokens', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='tokens_per_fill', full_name='istio.policy.v1alpha1.LocalRateLimit.TokenBucket.tokens_per_fill', index=1,
+      number=2, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='tokensPerFill', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='fill_interval', full_name='istio.policy.v1alpha1.LocalRateLimit.TokenBucket.fill_interval', index=2,
+      number=3, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='fillInterval', file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=1851,
+  serialized_end=2029,
+)
+
+_LOCALRATELIMIT_LOCALRATELIMITDESCRIPTOR_DESCRIPTORENTRY = _descriptor.Descriptor(
+  name='DescriptorEntry',
+  full_name='istio.policy.v1alpha1.LocalRateLimit.LocalRateLimitDescriptor.DescriptorEntry',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='key', full_name='istio.policy.v1alpha1.LocalRateLimit.LocalRateLimitDescriptor.DescriptorEntry.key', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='key', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='value', full_name='istio.policy.v1alpha1.LocalRateLimit.LocalRateLimitDescriptor.DescriptorEntry.value', index=1,
+      number=2, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='value', file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=2252,
+  serialized_end=2309,
+)
+
+_LOCALRATELIMIT_LOCALRATELIMITDESCRIPTOR = _descriptor.Descriptor(
+  name='LocalRateLimitDescriptor',
+  full_name='istio.policy.v1alpha1.LocalRateLimit.LocalRateLimitDescriptor',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='token_bucket', full_name='istio.policy.v1alpha1.LocalRateLimit.LocalRateLimitDescriptor.token_bucket', index=0,
+      number=1, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='tokenBucket', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='entries', full_name='istio.policy.v1alpha1.LocalRateLimit.LocalRateLimitDescriptor.entries', index=1,
+      number=2, type=11, cpp_type=10, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='entries', file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[_LOCALRATELIMIT_LOCALRATELIMITDESCRIPTOR_DESCRIPTORENTRY, ],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=2032,
+  serialized_end=2309,
+)
+
+_LOCALRATELIMIT = _descriptor.Descriptor(
+  name='LocalRateLimit',
+  full_name='istio.policy.v1alpha1.LocalRateLimit',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='token_bucket', full_name='istio.policy.v1alpha1.LocalRateLimit.token_bucket', index=0,
+      number=1, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='tokenBucket', file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='descriptors', full_name='istio.policy.v1alpha1.LocalRateLimit.descriptors', index=1,
+      number=2, type=11, cpp_type=10, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, json_name='descriptors', file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[_LOCALRATELIMIT_TOKENBUCKET, _LOCALRATELIMIT_LOCALRATELIMITDESCRIPTOR, ],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=1648,
+  serialized_end=2309,
+)
+
+_RATELIMIT.fields_by_name['workload'].message_type = type_dot_v1beta1_dot_selector__pb2._WORKLOADSELECTOR
+_RATELIMIT.fields_by_name['route'].message_type = _ROUTESELECTOR
+_RATELIMIT.fields_by_name['descriptors'].message_type = _RATELIMITDESCRIPTOR
+_RATELIMIT.fields_by_name['global'].message_type = _PROVIDERREF
+_RATELIMIT.fields_by_name['local'].message_type = _LOCALRATELIMIT
+_RATELIMIT.oneofs_by_name['binding'].fields.append(
+  _RATELIMIT.fields_by_name['workload'])
+_RATELIMIT.fields_by_name['workload'].containing_oneof = _RATELIMIT.oneofs_by_name['binding']
+_RATELIMIT.oneofs_by_name['binding'].fields.append(
+  _RATELIMIT.fields_by_name['route'])
+_RATELIMIT.fields_by_name['route'].containing_oneof = _RATELIMIT.oneofs_by_name['binding']
+_RATELIMIT.oneofs_by_name['policy'].fields.append(
+  _RATELIMIT.fields_by_name['global'])
+_RATELIMIT.fields_by_name['global'].containing_oneof = _RATELIMIT.oneofs_by_name['policy']
+_RATELIMIT.oneofs_by_name['policy'].fields.append(
+  _RATELIMIT.fields_by_name['local'])
+_RATELIMIT.fields_by_name['local'].containing_oneof = _RATELIMIT.oneofs_by_name['policy']
+_RATELIMITDESCRIPTOR.fields_by_name['entries'].message_type = _RATELIMITENTRY
+_RATELIMITENTRY_REQUESTHEADER.containing_type = _RATELIMITENTRY
+_RATELIMITENTRY_REQUESTHEADERMATCH_HEADERMATCHCONDITION.containing_type = _RATELIMITENTRY_REQUESTHEADERMATCH
+_RATELIMITENTRY_REQUESTHEADERMATCH_HEADERMATCHCONDITION.oneofs_by_name['condition'].fields.append(
+  _RATELIMITENTRY_REQUESTHEADERMATCH_HEADERMATCHCONDITION.fields_by_name['exact'])
+_RATELIMITENTRY_REQUESTHEADERMATCH_HEADERMATCHCONDITION.fields_by_name['exact'].containing_oneof = _RATELIMITENTRY_REQUESTHEADERMATCH_HEADERMATCHCONDITION.oneofs_by_name['condition']
+_RATELIMITENTRY_REQUESTHEADERMATCH_HEADERMATCHCONDITION.oneofs_by_name['condition'].fields.append(
+  _RATELIMITENTRY_REQUESTHEADERMATCH_HEADERMATCHCONDITION.fields_by_name['prefix'])
+_RATELIMITENTRY_REQUESTHEADERMATCH_HEADERMATCHCONDITION.fields_by_name['prefix'].containing_oneof = _RATELIMITENTRY_REQUESTHEADERMATCH_HEADERMATCHCONDITION.oneofs_by_name['condition']
+_RATELIMITENTRY_REQUESTHEADERMATCH_HEADERMATCHCONDITION.oneofs_by_name['condition'].fields.append(
+  _RATELIMITENTRY_REQUESTHEADERMATCH_HEADERMATCHCONDITION.fields_by_name['present'])
+_RATELIMITENTRY_REQUESTHEADERMATCH_HEADERMATCHCONDITION.fields_by_name['present'].containing_oneof = _RATELIMITENTRY_REQUESTHEADERMATCH_HEADERMATCHCONDITION.oneofs_by_name['condition']
+_RATELIMITENTRY_REQUESTHEADERMATCH.fields_by_name['conditions'].message_type = _RATELIMITENTRY_REQUESTHEADERMATCH_HEADERMATCHCONDITION
+_RATELIMITENTRY_REQUESTHEADERMATCH.containing_type = _RATELIMITENTRY
+_RATELIMITENTRY_CONSTANTENTRY.containing_type = _RATELIMITENTRY
+_RATELIMITENTRY_EXPRESSION.containing_type = _RATELIMITENTRY
+_RATELIMITENTRY.fields_by_name['header'].message_type = _RATELIMITENTRY_REQUESTHEADER
+_RATELIMITENTRY.fields_by_name['header_match'].message_type = _RATELIMITENTRY_REQUESTHEADERMATCH
+_RATELIMITENTRY.fields_by_name['constant'].message_type = _RATELIMITENTRY_CONSTANTENTRY
+_RATELIMITENTRY.fields_by_name['expression'].message_type = _RATELIMITENTRY_EXPRESSION
+_RATELIMITENTRY.oneofs_by_name['entry_type'].fields.append(
+  _RATELIMITENTRY.fields_by_name['header'])
+_RATELIMITENTRY.fields_by_name['header'].containing_oneof = _RATELIMITENTRY.oneofs_by_name['entry_type']
+_RATELIMITENTRY.oneofs_by_name['entry_type'].fields.append(
+  _RATELIMITENTRY.fields_by_name['header_match'])
+_RATELIMITENTRY.fields_by_name['header_match'].containing_oneof = _RATELIMITENTRY.oneofs_by_name['entry_type']
+_RATELIMITENTRY.oneofs_by_name['entry_type'].fields.append(
+  _RATELIMITENTRY.fields_by_name['constant'])
+_RATELIMITENTRY.fields_by_name['constant'].containing_oneof = _RATELIMITENTRY.oneofs_by_name['entry_type']
+_RATELIMITENTRY.oneofs_by_name['entry_type'].fields.append(
+  _RATELIMITENTRY.fields_by_name['expression'])
+_RATELIMITENTRY.fields_by_name['expression'].containing_oneof = _RATELIMITENTRY.oneofs_by_name['entry_type']
+_LOCALRATELIMIT_TOKENBUCKET.fields_by_name['tokens_per_fill'].message_type = google_dot_protobuf_dot_wrappers__pb2._UINT32VALUE
+_LOCALRATELIMIT_TOKENBUCKET.fields_by_name['fill_interval'].message_type = google_dot_protobuf_dot_duration__pb2._DURATION
+_LOCALRATELIMIT_TOKENBUCKET.containing_type = _LOCALRATELIMIT
+_LOCALRATELIMIT_LOCALRATELIMITDESCRIPTOR_DESCRIPTORENTRY.containing_type = _LOCALRATELIMIT_LOCALRATELIMITDESCRIPTOR
+_LOCALRATELIMIT_LOCALRATELIMITDESCRIPTOR.fields_by_name['token_bucket'].message_type = _LOCALRATELIMIT_TOKENBUCKET
+_LOCALRATELIMIT_LOCALRATELIMITDESCRIPTOR.fields_by_name['entries'].message_type = _LOCALRATELIMIT_LOCALRATELIMITDESCRIPTOR_DESCRIPTORENTRY
+_LOCALRATELIMIT_LOCALRATELIMITDESCRIPTOR.containing_type = _LOCALRATELIMIT
+_LOCALRATELIMIT.fields_by_name['token_bucket'].message_type = _LOCALRATELIMIT_TOKENBUCKET
+_LOCALRATELIMIT.fields_by_name['descriptors'].message_type = _LOCALRATELIMIT_LOCALRATELIMITDESCRIPTOR
+DESCRIPTOR.message_types_by_name['RateLimit'] = _RATELIMIT
+DESCRIPTOR.message_types_by_name['RouteSelector'] = _ROUTESELECTOR
+DESCRIPTOR.message_types_by_name['RateLimitDescriptor'] = _RATELIMITDESCRIPTOR
+DESCRIPTOR.message_types_by_name['RateLimitEntry'] = _RATELIMITENTRY
+DESCRIPTOR.message_types_by_name['ProviderRef'] = _PROVIDERREF
+DESCRIPTOR.message_types_by_name['LocalRateLimit'] = _LOCALRATELIMIT
+_sym_db.RegisterFileDescriptor(DESCRIPTOR)
+
+RateLimit = _reflection.GeneratedProtocolMessageType('RateLimit', (_message.Message,), {
+  'DESCRIPTOR' : _RATELIMIT,
+  '__module__' : 'policy.v1alpha1.ratelimit_pb2'
+  # @@protoc_insertion_point(class_scope:istio.policy.v1alpha1.RateLimit)
+  })
+_sym_db.RegisterMessage(RateLimit)
+
+RouteSelector = _reflection.GeneratedProtocolMessageType('RouteSelector', (_message.Message,), {
+  'DESCRIPTOR' : _ROUTESELECTOR,
+  '__module__' : 'policy.v1alpha1.ratelimit_pb2'
+  # @@protoc_insertion_point(class_scope:istio.policy.v1alpha1.RouteSelector)
+  })
+_sym_db.RegisterMessage(RouteSelector)
+
+RateLimitDescriptor = _reflection.GeneratedProtocolMessageType('RateLimitDescriptor', (_message.Message,), {
+  'DESCRIPTOR' : _RATELIMITDESCRIPTOR,
+  '__module__' : 'policy.v1alpha1.ratelimit_pb2'
+  # @@protoc_insertion_point(class_scope:istio.policy.v1alpha1.RateLimitDescriptor)
+  })
+_sym_db.RegisterMessage(RateLimitDescriptor)
+
+RateLimitEntry = _reflection.GeneratedProtocolMessageType('RateLimitEntry', (_message.Message,), {
+
+  'RequestHeader' : _reflection.GeneratedProtocolMessageType('RequestHeader', (_message.Message,), {
+    'DESCRIPTOR' : _RATELIMITENTRY_REQUESTHEADER,
+    '__module__' : 'policy.v1alpha1.ratelimit_pb2'
+    # @@protoc_insertion_point(class_scope:istio.policy.v1alpha1.RateLimitEntry.RequestHeader)
+    })
+  ,
+
+  'RequestHeaderMatch' : _reflection.GeneratedProtocolMessageType('RequestHeaderMatch', (_message.Message,), {
+
+    'HeaderMatchCondition' : _reflection.GeneratedProtocolMessageType('HeaderMatchCondition', (_message.Message,), {
+      'DESCRIPTOR' : _RATELIMITENTRY_REQUESTHEADERMATCH_HEADERMATCHCONDITION,
+      '__module__' : 'policy.v1alpha1.ratelimit_pb2'
+      # @@protoc_insertion_point(class_scope:istio.policy.v1alpha1.RateLimitEntry.RequestHeaderMatch.HeaderMatchCondition)
+      })
+    ,
+    'DESCRIPTOR' : _RATELIMITENTRY_REQUESTHEADERMATCH,
+    '__module__' : 'policy.v1alpha1.ratelimit_pb2'
+    # @@protoc_insertion_point(class_scope:istio.policy.v1alpha1.RateLimitEntry.RequestHeaderMatch)
+    })
+  ,
+
+  'ConstantEntry' : _reflection.GeneratedProtocolMessageType('ConstantEntry', (_message.Message,), {
+    'DESCRIPTOR' : _RATELIMITENTRY_CONSTANTENTRY,
+    '__module__' : 'policy.v1alpha1.ratelimit_pb2'
+    # @@protoc_insertion_point(class_scope:istio.policy.v1alpha1.RateLimitEntry.ConstantEntry)
+    })
+  ,
+
+  'Expression' : _reflection.GeneratedProtocolMessageType('Expression', (_message.Message,), {
+    'DESCRIPTOR' : _RATELIMITENTRY_EXPRESSION,
+    '__module__' : 'policy.v1alpha1.ratelimit_pb2'
+    # @@protoc_insertion_point(class_scope:istio.policy.v1alpha1.RateLimitEntry.Expression)
+    })
+  ,
+  'DESCRIPTOR' : _RATELIMITENTRY,
+  '__module__' : 'policy.v1alpha1.ratelimit_pb2'
+  # @@protoc_insertion_point(class_scope:istio.policy.v1alpha1.RateLimitEntry)
+  })
+_sym_db.RegisterMessage(RateLimitEntry)
+_sym_db.RegisterMessage(RateLimitEntry.RequestHeader)
+_sym_db.RegisterMessage(RateLimitEntry.RequestHeaderMatch)
+_sym_db.RegisterMessage(RateLimitEntry.RequestHeaderMatch.HeaderMatchCondition)
+_sym_db.RegisterMessage(RateLimitEntry.ConstantEntry)
+_sym_db.RegisterMessage(RateLimitEntry.Expression)
+
+ProviderRef = _reflection.GeneratedProtocolMessageType('ProviderRef', (_message.Message,), {
+  'DESCRIPTOR' : _PROVIDERREF,
+  '__module__' : 'policy.v1alpha1.ratelimit_pb2'
+  # @@protoc_insertion_point(class_scope:istio.policy.v1alpha1.ProviderRef)
+  })
+_sym_db.RegisterMessage(ProviderRef)
+
+LocalRateLimit = _reflection.GeneratedProtocolMessageType('LocalRateLimit', (_message.Message,), {
+
+  'TokenBucket' : _reflection.GeneratedProtocolMessageType('TokenBucket', (_message.Message,), {
+    'DESCRIPTOR' : _LOCALRATELIMIT_TOKENBUCKET,
+    '__module__' : 'policy.v1alpha1.ratelimit_pb2'
+    # @@protoc_insertion_point(class_scope:istio.policy.v1alpha1.LocalRateLimit.TokenBucket)
+    })
+  ,
+
+  'LocalRateLimitDescriptor' : _reflection.GeneratedProtocolMessageType('LocalRateLimitDescriptor', (_message.Message,), {
+
+    'DescriptorEntry' : _reflection.GeneratedProtocolMessageType('DescriptorEntry', (_message.Message,), {
+      'DESCRIPTOR' : _LOCALRATELIMIT_LOCALRATELIMITDESCRIPTOR_DESCRIPTORENTRY,
+      '__module__' : 'policy.v1alpha1.ratelimit_pb2'
+      # @@protoc_insertion_point(class_scope:istio.policy.v1alpha1.LocalRateLimit.LocalRateLimitDescriptor.DescriptorEntry)
+      })
+    ,
+    'DESCRIPTOR' : _LOCALRATELIMIT_LOCALRATELIMITDESCRIPTOR,
+    '__module__' : 'policy.v1alpha1.ratelimit_pb2'
+    # @@protoc_insertion_point(class_scope:istio.policy.v1alpha1.LocalRateLimit.LocalRateLimitDescriptor)
+    })
+  ,
+  'DESCRIPTOR' : _LOCALRATELIMIT,
+  '__module__' : 'policy.v1alpha1.ratelimit_pb2'
+  # @@protoc_insertion_point(class_scope:istio.policy.v1alpha1.LocalRateLimit)
+  })
+_sym_db.RegisterMessage(LocalRateLimit)
+_sym_db.RegisterMessage(LocalRateLimit.TokenBucket)
+_sym_db.RegisterMessage(LocalRateLimit.LocalRateLimitDescriptor)
+_sym_db.RegisterMessage(LocalRateLimit.LocalRateLimitDescriptor.DescriptorEntry)
+
+
+DESCRIPTOR._options = None
+# @@protoc_insertion_point(module_scope)