)

// DestinationARNPrefix - destination ARN prefix as per AWS S3 specification.
const DestinationARNPrefix = "arn:aws:s3:::"

// DestinationARNMinIOPrefix - destination ARN prefix for MinIO.
const DestinationARNMinIOPrefix = "arn:minio:replication:"

// Destination - destination in ReplicationConfiguration.
type Destination struct {
	XMLName      xml.Name `xml:"Destination" json:"Destination"`

			destBucket:            "destinationbucket",...

                    retry = false;

                    // This should take care of creating destination directory now on
                    if (destination.exists() && !force) {
                        try {
                            downloaded = wagon.getIfNewer(remotePath, temp, destination.lastModified());

                            if (!downloaded) {

		return rules[i].Priority > rules[j].Priority && rules[i].Destination.String() == rules[j].Destination.String()
	})

	return rules
}

// GetDestination returns destination bucket and storage class.
func (c Config) GetDestination() Destination {
	if len(c.Rules) > 0 {
		return c.Rules[0].Destination
	}
	return Destination{}
}

// Replicate returns true if the object should be replicated.

            "text": "source",
            "value": "source"
          },
          {
            "selected": true,
            "text": "destination",
            "value": "destination"
          }
        ],
        "query": "source,destination",
        "refresh": 1,
        "regex": "",
        "skipUrlSync": false,
        "sort": 1,
        "tagValuesQuery": "",

As discussed in [HBONE](#hbone), this is based on the destination IP.
Additionally, we enforce the peer has a valid mesh identity (but do not assert _which_ identity, yet).

Next, we terminate the CONNECT.
From the [headers](#headers), we know the target destination.

									{
										Destination: &networking.Destination{
											Host: "productpage",
										},
										Weight: 30,
									},
									{
										Destination: &networking.Destination{
											Host: "productpage2",
										},
										Weight: 20,
									},
									{
										Destination: &networking.Destination{
											Host: "productpage3",
										},

    --mount "type=bind,source=${MOUNT_SOURCE},destination=/work" \
    --mount "type=volume,source=go,destination=/go" \
    --mount "type=volume,source=gocache,destination=/gocache" \
    --mount "type=volume,source=cache,destination=/home/.cache" \
    --mount "type=volume,source=crates,destination=/home/.cargo/registry" \
    --mount "type=volume,source=git-crates,destination=/home/.cargo/git" \
    ${CONDITIONAL_HOST_MOUNTS} \

wp-->|mTLS|ztunnel
ztunnel-->|plaintext|dst[dst pod]
```

And here's an example of an authenticated request to a captured destination:

```mermaid
graph TD;
src[src pod]-->|15008|ztunnel{ztunnel}
ztunnel-->|HBONE|dwp{"destination waypoint (all policy applied here)"}
dwp{destination waypoint}-->|15008|dztunnel{destination ztunnel}
dztunnel-->|host network|dst[dst pod]

		fqdn := string(model.ResolveShortnameToFQDN(dest.Destination.Host, config.Meta{Namespace: vs.Namespace}))
		if extendFQDN(fqdn) == svcHost {
			if dest.Destination.Subset != "" {
				if slices.Contains(nonmatchingSubsets, dest.Destination.Subset) {
					mismatchNotes = append(mismatchNotes, fmt.Sprintf("Route to non-matching subset %s for (%s)",
						dest.Destination.Subset,
						renderMatches(route.Match)))
					continue