- one end of the socket is in the application pod
- and the other end is in ztunnel's pod

and setting up iptables rules to funnel traffic thru that socket "tube" to ztunnel and back.

This effectively behaves like ztunnel is an in-pod sidecar, without actually requiring the injection of ztunnel as a sidecar into the pod manifest, or mutatating the application pod in any way.

travelersinsurance

// trust : 2014-10-16 Internet Naming Company LLC
trust

// trv : 2015-03-26 Travelers TLD, LLC
trv

// tube : 2015-06-11 Latin American Telecom LLC
tube

// tui : 2014-07-03 TUI AG
tui

// tunes : 2015-02-26 Amazon Registry Services, Inc.
tunes

// tushu : 2014-12-18 Amazon Registry Services, Inc.
tushu

tsunan.niigata.jp tsuno.kochi.jp tsuno.miyazaki.jp tsuru.yamanashi.jp tsuruga.fukui.jp tsurugashima.saitama.jp tsurugi.ishikawa.jp tsuruoka.yamagata.jp tsuruta.aomori.jp tsushima.aichi.jp tsushima.nagasaki.jp tsuwano.shimane.jp tsuyama.okayama.jp tt tt.im tube tui tula.su tuleap-partners.com tunes tunk.org tur.ar tur.br turek.pl turin.it turystyka.pl tuscany.it tushu tuva.su tuxfamily.org tv tv.bb tv.bo tv.br tv.im tv.in tv.it tv.kg tv.na tv.sd tv.tr tv.tz tvedestrand.no tvs tw tw.cn twmail.cc twmail.net...

hayas
hayamos
hayáis
hayan
habré
habrás
habrá
habremos
habréis
habrán
habría
habrías
habríamos
habríais
habrían
había
habías
habíamos
habíais
habían
hube
hubiste
hubo
hubimos
hubisteis
hubieron
hubiera
hubieras
hubiéramos
hubierais
hubieran
hubiese
hubieses
hubiésemos
hubieseis
hubiesen
habiendo
habido
habida

workloads can talk with each other and obey the Istio configuration resources, but each environment
can use different Istio versions and different configuration defaults.

`istioctl kube-inject` or the automatic sidecar injector are used to select the environment.
In the case of the sidecar injector, the namespace label `istio-env: <NAME_OF_ENV>` is used instead

**Affected Versions**:
  - kube-apiserver v1.27.0 - v1.27.2
  - kube-apiserver v1.26.0 - v1.26.5
  - kube-apiserver v1.25.0 - v1.25.10
  - kube-apiserver <= v1.24.14

**Fixed Versions**:
  - kube-apiserver v1.27.3
  - kube-apiserver v1.26.6
  - kube-apiserver v1.25.11
  - kube-apiserver v1.24.15

**Affected Versions**:
  - kube-apiserver v1.29.0 - v1.29.3
  - kube-apiserver v1.28.0 - v1.28.8
  - kube-apiserver <= v1.27.12

**Fixed Versions**:
  - kube-apiserver v1.29.4
  - kube-apiserver v1.28.9
  - kube-apiserver v1.27.13

This vulnerability was reported by tha3e1vl.

[registry.k8s.io/kube-controller-manager:v1.26.14](https://console.cloud.google.com/gcr/images/k8s-artifacts-prod/us/kube-controller-manager) | [amd64](https://console.cloud.google.com/gcr/images/k8s-artifacts-prod/us/kube-controller-manager-amd64), [arm](https://console.cloud.google.com/gcr/images/k8s-artifacts-prod/us/kube-controller-manager-arm),...

  //  1. "kubernetes.io/kube-apiserver-client": issues client certificates that can be used to authenticate to kube-apiserver.
  //   Requests for this signer are never auto-approved by kube-controller-manager, can be issued by the "csrsigning" controller in kube-controller-manager.
  //  2. "kubernetes.io/kube-apiserver-client-kubelet": issues client certificates that kubelets use to authenticate to kube-apiserver.

	client.RunAndWait(ctx.Done())
}

// Set up Kubernetes client using kubeconfig (or in-cluster config if no file provided)
func clientSetup() (kube.Client, error) {
	config, err := kube.DefaultRestConfig("", "")
	if err != nil {
		return nil, err
	}
	return kube.NewClient(kube.NewClientConfigForRestConfig(config), "")