// - No fractional digits will be emitted
// - The exponent (or suffix) is as large as possible.
//
// The sign will be omitted unless the number is negative.
//
// Examples:
//
// - 1.5 will be serialized as "1500m"
// - 1.5Gi will be serialized as "1536Mi"
//
// Note that the quantity will NEVER be internally represented by a
// floating point number. That is the whole point of this exercise.
//

* All traffic *ingressing* a pod on port 15008 in the mesh is assumed to be HBONE, and should be redirected to the node-local ztunnel on port 15008 (more on this later).
* All other traffic *ingressing* a pod in the mesh should be redirected to the node-local ztunnel on port 15006, regardless of intended original destination port.

	ChainInpodPrerouting = "ISTIO_PRERT"
	ChainHostPostrouting = "ISTIO_POSTRT"
	RouteTableInbound    = 100

	DNSCapturePort              = 15053
	ZtunnelInboundPort          = 15008
	ZtunnelOutboundPort         = 15001
	ZtunnelInboundPlaintextPort = 15006
	ProbeIPSet                  = "istio-inpod-probes"
)

var log = istiolog.RegisterScope("iptables", "iptables helper")

type Config struct {

    // After 1000ms the client will attempt a ping 2, but we don't process it. That'll cause the
    // client to fail at 1500ms when it's time to send ping 3 because pong 2 hasn't been received.
    taskFaker.advanceUntil(ns(1000L))
    taskFaker.advanceUntil(ns(1500L))
    client.listener.assertFailure(
      SocketTimeoutException::class.java,

      "namespace": "bookinfo",
      "hostname": "namespace-istio-waypoint.bookinfo.svc.cluster.local",
      "vips": [
        "/10.96.65.117"
      ],
      "ports": {
        "15008": 15008,
        "15021": 15021
      },
      "endpoints": {
        "Kubernetes//Pod/bookinfo/namespace-istio-waypoint-d94944bf6-z89g2:/10.244.2.52": {

)

const (
	jsonOutput             = "json"
	yamlOutput             = "yaml"
	summaryOutput          = "short"
	prometheusOutput       = "prom"
	prometheusMergedOutput = "prom-merged"

	defaultProxyAdminPort = 15000
)

var (
	fqdn, direction, subset string
	port                    int
	verboseProxyConfig      bool
	waypointProxyConfig     bool

	address, listenerType, statsType string

	routeName string

    hub: ""
    tag: ""
    variant: ""

    # Can be a full hub/image:tag
    image: pilot
    traceSampling: 1.0

    # Resources for a small pilot install
    resources:
      requests:
        cpu: 500m
        memory: 2048Mi

    # Set to `type: RuntimeDefault` to use the default profile if available.
    seccompProfile: {}

    # Whether to use an existing CNI installation
    cni:
      enabled: false

  {{- else }}
    image: "{{ .ProxyImage }}"
  {{- end }}
    args:
    - istio-iptables
    - "-p"
    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
    - "-z"
    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
    - "-u"
    - {{ .ProxyUID | default "1337" | quote }}
    - "-m"
    - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"

  {{- else }}
    image: "{{ .ProxyImage }}"
  {{- end }}
    args:
    - istio-iptables
    - "-p"
    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
    - "-z"
    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
    - "-u"
    - {{ .ProxyUID | default "1337" | quote }}
    - "-m"
    - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}"

      brokenPodLabelValue: "true"

    # Set to `type: RuntimeDefault` to use the default profile if available.
    seccompProfile: {}

    resources:
      requests:
        cpu: 100m
        memory: 100Mi

    resourceQuotas:
      enabled: false
      pods: 5000

    # The number of pods that can be unavailable during rolling update (see