"on_new_connection": [
                          {
                            "object_key": "envoy.filters.listener.original_dst.local_ip",
                            "format_string": {
                              "text_format_source": {
                                "inline_string": "%FILTER_STATE(envoy.filters.listener.original_dst.local_ip:PLAIN)%"

                    "@type": "type.googleapis.com/envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer"
                  }
                }
              }
            },
            "metadata": {
              "filter_metadata": {
                "istio": {
                  "services": [
                    {
                      "namespace": "default",
                      "name": "ratings",

# Downloaded from https://github.com/metallb/metallb/raw/v0.13.12/config/manifests/metallb-native.yaml
# With quay.io hub replaced with gcr.io/istio-testing
# And probes tuned to startup faster
apiVersion: v1
kind: Namespace
metadata:
  labels:
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/warn: privileged
  name: metallb-system
---
apiVersion: apiextensions.k8s.io/v1

			return nil, err
		}
		if listenerTyped.Name == model.VirtualInboundListenerName {
			for _, filterChain := range listenerTyped.FilterChains {
				for _, filter := range filterChain.Filters {
					hcm := &hcm.HttpConnectionManager{}
					if err := filter.GetTypedConfig().UnmarshalTo(hcm); err == nil {
						return hcm, nil
					}
				}
			}
		}

                    "@type": "type.googleapis.com/envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer"
                  }
                }
              }
            },
            "metadata": {
              "filter_metadata": {
                "istio": {
                  "services": [
                    {
                      "namespace": "default",
                      "name": "ratings",

  // by sending a graceful termination signal to the containers in the pod. After that 30 seconds,
  // the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup,
  // remove the pod from the API. In the presence of network partitions, this object may still
  // exist after this timestamp, until an administrator or automated process can determine the
  // resource is fully terminated.

                                        },
                                        "health_status": "HEALTHY",
                                        "metadata": {
                                            "filter_metadata": {
                                                "envoy.transport_socket_match": {
                                                    "tlsMode": "istio"
                                                },