// scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2)
  // violate MaxSkew(1).
  // - if MaxSkew is 2, incoming pod can be scheduled onto any zone.
  // When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence
  // to topologies that satisfy it.
  // It's a required field. Default value is 1 and 0 is not allowed.

  optional string schedule = 1;

  // The time zone name for the given schedule, see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones.
  // If not specified, this will default to the time zone of the kube-controller-manager process.
  // The set of valid time zone names and the time zone offset is loaded from the system-wide time zone

rm -rf work
mkdir work
go build -o work/mkzip mkzip.go # build now for correct paths in build errors
cd work
mkdir zoneinfo
curl -sS -L -O https://www.iana.org/time-zones/repository/releases/tzcode$CODE.tar.gz
curl -sS -L -O https://www.iana.org/time-zones/repository/releases/tzdata$DATA.tar.gz
tar xzf tzcode$CODE.tar.gz
tar xzf tzdata$DATA.tar.gz

if ! make CFLAGS=-DSTD_INSPIRED AWK=awk TZDIR=zoneinfo posix_only >make.out 2>&1; then

  // items is the list of endpoint slices
  repeated EndpointSlice items = 2;
}

// ForZone provides information about which zones should consume this endpoint.
message ForZone {
  // name represents the name of the zone.
  optional string name = 1;

  // in the zone and nodeName fields instead.
  // +optional
  map<string, string> deprecatedTopology = 5;

  // nodeName represents the name of the Node hosting this endpoint. This can
  // be used to determine endpoints local to a Node.
  // +optional
  optional string nodeName = 6;

  // zone is the name of the Zone this endpoint exists in.
  // +optional
  optional string zone = 7;

  optional string schedule = 1;

  // The time zone name for the given schedule, see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones.
  // If not specified, this will default to the time zone of the kube-controller-manager process.
  // The set of valid time zone names and the time zone offset is loaded from the system-wide time zone

```sh
firewall-cmd --get-active-zones
```

This command gets the active zone(s). Now, apply port rules to the relevant zones returned above. For example if the zone is `public`, use

```sh
firewall-cmd --zone=public --add-port=9000/tcp --permanent
```

-A ISTIO_OUTPUT -p udp --dport 53 -m owner --uid-owner 1337 -j CT --zone 1
-A ISTIO_OUTPUT -p udp --sport 15053 -m owner --uid-owner 1337 -j CT --zone 2
-A ISTIO_OUTPUT -p udp --dport 53 -m owner --gid-owner 1337 -j CT --zone 1
-A ISTIO_OUTPUT -p udp --sport 15053 -m owner --gid-owner 1337 -j CT --zone 2
-A ISTIO_OUTPUT -p udp --dport 53 -j CT --zone 2
-A PREROUTING -p udp --sport 53 -j CT --zone 1

COMMIT
* raw
-N ISTIO_OUTPUT
-N ISTIO_PRERT
-A PREROUTING -j ISTIO_PRERT
-A OUTPUT -j ISTIO_OUTPUT
-A ISTIO_OUTPUT -p udp -m mark --mark 0x539/0xfff -m udp --dport 53 -j CT --zone 1
-A ISTIO_PRERT -p udp -m mark ! --mark 0x539/0xfff -m udp --sport 53 -j CT --zone 1
COMMIT
* mangle
-N ISTIO_PRERT
-N ISTIO_OUTPUT
-A PREROUTING -j ISTIO_PRERT
-A OUTPUT -j ISTIO_OUTPUT

COMMIT
* raw
-N ISTIO_OUTPUT
-N ISTIO_PRERT
-A PREROUTING -j ISTIO_PRERT
-A OUTPUT -j ISTIO_OUTPUT
-A ISTIO_OUTPUT -p udp -m mark --mark 0x539/0xfff -m udp --dport 53 -j CT --zone 1
-A ISTIO_PRERT -p udp -m mark ! --mark 0x539/0xfff -m udp --sport 53 -j CT --zone 1
COMMIT
* mangle
-N ISTIO_PRERT
-N ISTIO_OUTPUT
-A PREROUTING -j ISTIO_PRERT
-A OUTPUT -j ISTIO_OUTPUT