In all cases, we spoof the original source IP.

### Inbound Passthrough

Traffic entering a pod that is not transmitted over HBONE  (i.e. with a destination port != 15008) is handled by the "inbound passthrough" code path, on ztunnel's port 15006.

This is fairly straightforward.

First, we need to check that this traffic is allowed.

    assertNull(converter.reverse().convert(null));

    assertEquals((Integer) 5, converter.convert("5"));
    assertEquals("5", converter.reverse().convert(5));
  }

  // Null-passthrough violates our nullness annotations, so we don't support it under J2KT.
  @J2ktIncompatible
  public void testNullIsPassedThrough() {
    Converter<String, String> nullsArePassed = sillyConverter(false);

                                Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST
                              enum:
                              - UNSPECIFIED
                              - LEAST_CONN
                              - RANDOM
                              - PASSTHROUGH
                              - ROUND_ROBIN
                              - LEAST_REQUEST

* Demoted controlplane passthrough flags apiserver-extra-args, controller-manager-extra-args, scheduler-extra-args to alpha flags ([#59882](https://github.com/kubernetes/kubernetes/pull/59882), [@kris-nova](https://github.com/kris-nova))

			if includeConfigType {
				route.Name = fmt.Sprintf("route/%s", route.Name)
			}
			if filter.Verbose {
				for _, vhosts := range route.GetVirtualHosts() {
					for _, r := range vhosts.Routes {
						if !isPassthrough(r.GetAction()) {
							fmt.Fprintf(w, "%v\t%s\t%s\t%s\t%s\n",
								route.Name,
								vhosts.Name,
								describeRouteDomains(vhosts.GetDomains()),
								describeMatch(r.GetMatch()),