This is done through standard HTTP/2 pooling.
The pooling is keyed off the `{source identity, destination identity, destination ip}`.

### Headers

Ztunnel uses the following well-known headers in HBONE:

  istioctl admin l istiod-5c868d8bdd-pmvgg

  # Update levels of the specified loggers.
  istioctl admin log --level ads:debug,authorization:debug

  # Retrieve information about istiod logging levels for a specified revision.
  istioctl admin log --revision v1

  # Reset levels of all the loggers to default value (info).
  istioctl admin log --reset
`,
		Aliases: []string{"l"},

  istioctl proxy-config log <pod-name[.namespace]>

  # Update levels of the all loggers
  istioctl proxy-config log <pod-name[.namespace]> --level none

  # Update levels of the specified loggers.
  istioctl proxy-config log <pod-name[.namespace]> --level http:debug,redis:debug

  # Reset levels of all the loggers to default value (warning).
  istioctl proxy-config log <pod-name[.namespace]> -r
`,

# Target: clean
#-----------------------------------------------------------------------------
.PHONY: clean

clean: ## Cleans all the intermediate files and folders previously generated.
	rm -rf $(DIRS_TO_CLEAN)

#-----------------------------------------------------------------------------
# Target: docker

	log.Debugf("istio-cni CmdAdd previous result: %+v", loggedPrevResult)

	// Determine if running under k8s by checking the CNI args
	k8sArgs := K8sArgs{}
	if err := types.LoadArgs(args.Args, &k8sArgs); err != nil {
		return err
	}

	// Check if the workload is running under Kubernetes.
	podNamespace := string(k8sArgs.K8S_POD_NAMESPACE)
	podName := string(k8sArgs.K8S_POD_NAME)

  //
  // Validation requirements:
  //  1. certificate must contain one or more PEM blocks.
  //  2. All PEM blocks must have the "CERTIFICATE" label, contain no headers, and the encoded data
  //   must be a BER-encoded ASN.1 Certificate structure as described in section 4 of RFC5280.
  //  3. Non-PEM content may appear before or after the "CERTIFICATE" PEM blocks and is unvalidated,

 istioctl x ztunnel-config log

 # Update levels of the all loggers for a specific Ztunnel pod
 istioctl x ztunnel-config log <pod-name[.namespace]> --level off

 # Update levels of the specified loggers for all Ztunnl pods
 istioctl x ztunnel-config log --level access:debug,info

 # Reset levels of all the loggers to default value (warning)  for a specific Ztunnel pod.

  //
  // "Deny" specifies that a validation failure results in a denied request.
  //
  // "Warn" specifies that a validation failure is reported to the request client
  // in HTTP Warning headers, with a warning code of 299. Warnings can be sent
  // both for allowed or denied admission responses.
  //
  // "Audit" specifies that a validation failure is included in the published