XTablesParameterProblem: "xtables parameter problem",
	XTablesVersionProblem:   "xtables version problem",
	XTablesResourceProblem:  "xtables resource problem",
}

// RealDependencies implementation of interface Dependencies, which is used in production
type RealDependencies struct {
	NetworkNamespace string
	CNIMode          bool
}

const iptablesVersionPattern = `v([0-9]+(\.[0-9]+)+)`

## Proxy implementation

In its initial implementations, the ztunnel was actually implemented in 3 different ways: a bespoke Rust implementation, a bespoke Go implementation, and in Envoy.

In the end, [after evaluation](https://docs.google.com/document/d/1c2123cKuYsBDpIon9FFdctWTUIMFweSjgwG7r8l3818/edit), the decision was to move forward with a Rust implementation.

      In this release, the ["Delta"](https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol#incremental-xds) xDS protocol is enabled by default.

      This should be an internal implementation detail, but because this controls the core configuration protocol in Istio,
      an upgrade notice is present in an abundance of caution.

                      For implementations creating other Kubernetes objects, this should be the `metadata.annotations` field on resources.
                      For other implementations, this refers to any relevant (implementation specific) "annotations" concepts.


                      An implementation may chose to add additional implementation-specific annotations as they see fit.

// See the License for the specific language governing permissions and
// limitations under the License.

package config

import (
	"fmt"
	"net/netip"
)

const (
	// Due to implementation constraints, we have to impose a limit on the
	// number of owner groups whose outgoing traffic should be redirected
	// to Envoy.
	//
	// Since all included groups will be translated into a single Iptables

	if features.EnableVtprotobuf {
		if vt, ok := msg.(vtStrictMarshal); ok {
			// Attempt to use more efficient implementation
			// "Strict" is the equivalent to Deterministic=true below
			return vt.MarshalVTStrict()
		}
	}
	// If not available, fallback to normal implementation
	return proto.MarshalOptions{Deterministic: true}.Marshal(msg)
}

// MessageToAny converts from proto message to proto Any

// See the License for the specific language governing permissions and
// limitations under the License.

package resource

import "istio.io/istio/pkg/cluster"

// Origin of a resource. This is source-implementation dependent.
type Origin interface {
	FriendlyName() string
	Namespace() Namespace
	Reference() Reference

	// FieldMap returns the flat map containing paths of the fields in the resource as keys,

apiVersion: release-notes/v2
kind: feature
area: security
releaseNotes:
  - |

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // handler specifies the underlying runtime and configuration that the CRI
  // implementation will use to handle pods of this class. The possible values
  // are specific to the node & CRI configuration.  It is assumed that all
  // handlers are available on every node, and handlers of the same name are

					suite.GatewayHTTPConformanceProfileName,
					suite.GatewayTLSConformanceProfileName,
					suite.GatewayGRPCConformanceProfileName,
					suite.MeshHTTPConformanceProfileName,
				),
				Implementation: confv1.Implementation{
					Organization: "istio",
					Project:      "istio",
					URL:          "https://istio.io/",
					Version:      istioVersion,
					Contact:      []string{"@istio/maintainers"},
				},