"name": "outbound|9080|v1|productpage.default.svc.cluster.local",
            "type": "EDS",
            "eds_cluster_config": {
              "eds_config": {
                "ads": {},
                "initial_fetch_timeout": "0s",
                "resource_api_version": "V3"
              },
              "service_name": "outbound|9080|v1|productpage.default.svc.cluster.local"
            },

                    }
                ]
            }
        ],
        "policy": {
            "overprovisioningFactor": 140
        }
    },
    {
        "clusterName": "outbound|9402||cert-manager-istio-csr-metrics.cert-manager.svc.cluster.local",
        "endpoints": [
            {
                "locality": {},
                "lbEndpoints": [
                    {

            portValue: 15020
        healthCheckConfig: {}
      healthStatus: HEALTHY
      loadBalancingWeight: 1
    locality: {}
  policy:
    overprovisioningFactor: 140
- clusterName: outbound|9402||cert-manager-istio-csr-metrics.cert-manager.svc.cluster.local
  endpoints:
  - lbEndpoints:
    - endpoint:
        address:
          socketAddress:
            address: 10.244.0.156

## Traffic routing

Based on the three [redirection](#redirection) paths, the ztunnel has three primary types of traffic it handles.

### Outbound

Requests leaving a pod go through the "outbound" code path on port 15001.
This is where most of Ztunnel's logic lives.

For outbound traffic, we need to first determine where the traffic is destined to.

		)
	}

	// CLI: -A ISTIO_OUTPUT -m connmark --mark 0x111/0xfff -j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff
	//
	// DESC: Propagate/restore connmark (if we had one) for outbound
	iptablesBuilder.AppendRule(
		iptableslog.UndefinedCommand, ChainInpodOutput, iptablesconstants.MANGLE,
		"-m", "connmark",
		"--mark", inpodTproxyMark,
		"-j", "CONNMARK",
		"--restore-mark",

    point were invalid certificates accepted.
 *  New: `OkHttpClient.Builder.minWebSocketMessageToCompress()` configures a threshold for
    compressing outbound web socket messages. Configure this with 0L to always compress outbound
    messages and `Long.MAX_VALUE` to never compress outbound messages. The default is 1024L which
    compresses messages of size 1 KiB and larger. (Inbound messages are compressed or not based on

			"Total number of internode bytes received by current MinIO server instance",
			nil, nil),
		prometheus.CounterValue,
		float64(connStats.internodeInputBytes),
	)

	// Network Sent/Received Bytes (Outbound)
	ch <- prometheus.MustNewConstMetric(
		prometheus.NewDesc(
			prometheus.BuildFQName(s3Namespace, "tx", "bytes_total"),
			"Total number of s3 bytes sent by current MinIO server instance",
			nil, nil),

   * servers it should be the agreed-upon extensions immediately.
   */
  private var extensions: WebSocketExtensions?,
  /** If compression is negotiated, outbound messages of this size and larger will be compressed. */
  private var minimumDeflateSize: Long,
  private val webSocketCloseTimeout: Long,
) : WebSocket, WebSocketReader.FrameCallback {
  private val key: String

			}
		}),
		ValidArgsFunction: completion.ValidPodsNameArgs(ctx),
	}

	common.attach(cmd)
	cmd.PersistentFlags().StringVar(&direction, "direction", "", "Filter workloads by direction (inbound or outbound)")
	cmd.PersistentFlags().BoolVar(&raw, "raw", false, "If set, show IP addresses instead of names")
	cmd.PersistentFlags().StringVar(&workloadsNamespace, "workload-namespace", "",
		"Filter workloads by namespace field")

  boolean tooHigh(@ParametricNullness T t) {
    if (!hasUpperBound()) {
      return false;
    }
    // The cast is safe because of the hasUpperBound() check.
    T ubound = uncheckedCastNullableTToT(getUpperEndpoint());
    int cmp = comparator.compare(t, ubound);
    return cmp > 0 | (cmp == 0 & getUpperBoundType() == OPEN);
  }

  boolean contains(@ParametricNullness T t) {
    return !tooLow(t) && !tooHigh(t);
  }