isZtunnel := strings.HasPrefix(podName, "ztunnel")
	if client == nil {
		return isZtunnel
	}
	pod, err := client.Kube().CoreV1().Pods(podNamespace).Get(context.Background(), podName, metav1.GetOptions{})
	if err != nil {
		return isZtunnel
	}
	if v, ok := pod.Labels["app"]; ok {
		return v == "ztunnel"
	}
	return isZtunnel
}

			}
		})
	}
}

func toPod(p pod, isZtunnel bool) *v1.Pod {
	po := &v1.Pod{
		ObjectMeta: metav1.ObjectMeta{
			Name:      p.name,
			Namespace: p.namespace,
			UID:       types.UID(p.uid),
		},
		Spec: v1.PodSpec{
			ServiceAccountName: p.account,
			NodeName:           p.node,
		},
	}
	if isZtunnel {
		po.Labels = map[string]string{
			"app": "ztunnel",
		}
	}

func ConfigAffectsProxy(req *model.PushRequest, proxy *model.Proxy) bool {
	// Empty changes means "all" to get a backward compatibility.
	if len(req.ConfigsUpdated) == 0 {
		return true
	}
	if proxy.IsWaypointProxy() || proxy.IsZTunnel() {
		// Optimizations do not apply since scoping uses different mechanism
		// TODO: implement ambient aware scoping
		return true
	}

	for config := range req.ConfigsUpdated {

	return node.Type == Waypoint
}

// IsZTunnel returns true if the proxy is acting as a ztunnel in an ambient mesh.
func (node *Proxy) IsZTunnel() bool {
	return node.Type == Ztunnel
}

// IsAmbient returns true if the proxy is acting as either a ztunnel or a waypoint proxy in an ambient mesh.
func (node *Proxy) IsAmbient() bool {
	return node.IsWaypointProxy() || node.IsZTunnel()
}

	proxy.LastPushContext = s.globalPushContext()
	// First request so initialize connection id and start tracking it.
	con.SetID(connectionID(proxy.ID))
	con.node = node
	con.proxy = proxy
	if proxy.IsZTunnel() && !features.EnableAmbient {
		return fmt.Errorf("ztunnel requires PILOT_ENABLE_AMBIENT=true")
	}

	// Authorize xds clients
	if err := s.authorize(con, identities); err != nil {
		return err
	}

			for _, rr := range resource {
				configDump.Configs = append(configDump.Configs, rr.Resource)
			}
		}
		writeJSON(w, configDump, req)
		return
	}

	if con.proxy.IsZTunnel() {
		resources := s.getConfigDumpByResourceType(con, nil, []string{v3.AddressType})
		configDump := &admin.ConfigDump{}
		for _, resource := range resources {
			for _, rr := range resource {

    server.enqueue(
      MockResponse(
        code = 407,
        headers = headersOf("Proxy-Authenticate", "Basic realm=\"localhost\""),
        inTunnel = true,
      ),
    )
    server.enqueue(
      MockResponse(inTunnel = true),
    )
    server.enqueue(
      MockResponse(body = "response body"),
    )
    client =
      client.newBuilder()
        .sslSocketFactory(

    server.useHttps(handshakeCertificates.sslSocketFactory())
    val queueDispatcher = QueueDispatcher()
    queueDispatcher.enqueueResponse(MockResponse(inTunnel = true))
    queueDispatcher.enqueueResponse(MockResponse(inTunnel = true))
    queueDispatcher.enqueueResponse(MockResponse(body = "call2 response"))
    queueDispatcher.enqueueResponse(MockResponse(body = "call1 response"))

     * calls should be attempted on the socket.
     */
    @Throws(IOException::class, InterruptedException::class)
    private fun processTunnelRequests(): Boolean {
      if (!dispatcher.peek().inTunnel) return true // No tunnel requests.

      val source = raw.source().buffer()
      val sink = raw.sink().buffer()
      while (true) {
        val socketStillGood = processOneRequest(raw, source, sink)

NODE_LABELS=${KUBE_NODE_LABELS:-}
WINDOWS_NODE_LABELS=${WINDOWS_NODE_LABELS:-}
NODE_LOCAL_SSDS_EPHEMERAL=${NODE_LOCAL_SSDS_EPHEMERAL:-}
# Turning GRPC based Konnectivity testing on id advance of
# removing the SSHTunnel code.
export KUBE_ENABLE_EGRESS_VIA_KONNECTIVITY_SERVICE=true
export PREPARE_KONNECTIVITY_SERVICE="${KUBE_ENABLE_KONNECTIVITY_SERVICE:-true}"
export EGRESS_VIA_KONNECTIVITY="${KUBE_ENABLE_KONNECTIVITY_SERVICE:-true}"