}
		})
	}
}

func toPod(p pod, isZtunnel bool) *v1.Pod {
	po := &v1.Pod{
		ObjectMeta: metav1.ObjectMeta{
			Name:      p.name,
			Namespace: p.namespace,
			UID:       types.UID(p.uid),
		},
		Spec: v1.PodSpec{
			ServiceAccountName: p.account,
			NodeName:           p.node,
		},
	}
	if isZtunnel {
		po.Labels = map[string]string{
			"app": "ztunnel",
		}
	}

	return node.Type == Waypoint
}

// IsZTunnel returns true if the proxy is acting as a ztunnel in an ambient mesh.
func (node *Proxy) IsZTunnel() bool {
	return node.Type == Ztunnel
}

// IsAmbient returns true if the proxy is acting as either a ztunnel or a waypoint proxy in an ambient mesh.
func (node *Proxy) IsAmbient() bool {
	return node.IsWaypointProxy() || node.IsZTunnel()
}

	proxy.LastPushContext = s.globalPushContext()
	// First request so initialize connection id and start tracking it.
	con.SetID(connectionID(proxy.ID))
	con.node = node
	con.proxy = proxy
	if proxy.IsZTunnel() && !features.EnableAmbient {
		return fmt.Errorf("ztunnel requires PILOT_ENABLE_AMBIENT=true")
	}

	// Authorize xds clients
	if err := s.authorize(con, identities); err != nil {
		return err
	}

			for _, rr := range resource {
				configDump.Configs = append(configDump.Configs, rr.Resource)
			}
		}
		writeJSON(w, configDump, req)
		return
	}

	if con.proxy.IsZTunnel() {
		resources := s.getConfigDumpByResourceType(con, nil, []string{v3.AddressType})
		configDump := &admin.ConfigDump{}
		for _, resource := range resources {
			for _, rr := range resource {

  constructor(
    code: Int = 200,
    headers: Headers = headersOf(),
    body: String = "",
    inTunnel: Boolean = false,
    socketPolicy: SocketPolicy = KeepOpen,
  ) : this(
    Builder()
      .apply {
        this.code = code
        this.headers.addAll(headers)
        if (inTunnel) inTunnel()
        this.body(body)
        this.socketPolicy = socketPolicy
      },
  )

     * calls should be attempted on the socket.
     */
    @Throws(IOException::class, InterruptedException::class)
    private fun processTunnelRequests(): Boolean {
      if (!dispatcher.peek().inTunnel) return true // No tunnel requests.

      val source = raw.source().buffer()
      val sink = raw.sink().buffer()
      while (true) {
        val socketStillGood = processOneRequest(raw, source, sink)

	public final fun headers (Lokhttp3/Headers;)Lmockwebserver3/MockResponse$Builder;
	public final fun headersDelay (JLjava/util/concurrent/TimeUnit;)Lmockwebserver3/MockResponse$Builder;
	public final fun inTunnel ()Lmockwebserver3/MockResponse$Builder;
	public final fun removeHeader (Ljava/lang/String;)Lmockwebserver3/MockResponse$Builder;
	public final fun setBody (Lmockwebserver3/MockResponseBody;)V
	public final fun setCode (I)V

NODE_LABELS=${KUBE_NODE_LABELS:-}
WINDOWS_NODE_LABELS=${WINDOWS_NODE_LABELS:-}
NODE_LOCAL_SSDS_EPHEMERAL=${NODE_LOCAL_SSDS_EPHEMERAL:-}
# Turning GRPC based Konnectivity testing on id advance of
# removing the SSHTunnel code.
export KUBE_ENABLE_EGRESS_VIA_KONNECTIVITY_SERVICE=true
export PREPARE_KONNECTIVITY_SERVICE="${KUBE_ENABLE_KONNECTIVITY_SERVICE:-true}"
export EGRESS_VIA_KONNECTIVITY="${KUBE_ENABLE_KONNECTIVITY_SERVICE:-true}"

    This is only relevant for duplex request bodies, because they are written concurrently when
    reading the response body.

 *  New: `MockResponse.inTunnel()` is a new `mockwebserver3` API to configure responses that are
    served while creating a proxy tunnel. This obsoletes both the `tunnelProxy` argument on