Fundamentally, this component is responsible for the following:

- Sets up redirection with newly-started (or newly-added, previously-started) application pods such that traffic from application pods is forwarded to the local node's ztunnel pod.
- Configures required iptables, sockets, and packet routing miscellanea within the `ztunnel` and application pod network namespaces to make that happen.

This component accomplishes that in the following ways:

	if err != nil {
		return nil, fmt.Errorf("failed to get system cert pool: %w", err)
	}
	gcpCreds, err := oauth.NewApplicationDefault(ctx)
	if err != nil {
		return nil, fmt.Errorf("failed to get application default credentials: %w", err)
	}

	return []grpc.DialOption{
		grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{
			RootCAs:    systemRoots,
			MinVersion: tls.VersionTLS12,
		})),

    # see
    # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
    # This does not apply to gateway pods as they typically need a different
    # set of DNS settings than the normal application pods (e.g., in
    # multicluster scenarios).
    # NOTE: If using templates, follow the pattern in the commented example below.
    #podDNSSearchNamespaces:
    #- global

                          "on_match": {
                            "matcher": {
                              "matcher_tree": {
                                "input": {
                                  "name": "application-protocol",
                                  "typed_config": {
                                    "@type": "type.googleapis.com/envoy.extensions.matching.common_inputs.network.v3.ApplicationProtocolInput"

                          "on_match": {
                            "matcher": {
                              "matcher_tree": {
                                "input": {
                                  "name": "application-protocol",
                                  "typed_config": {
                                    "@type": "type.googleapis.com/envoy.extensions.matching.common_inputs.network.v3.ApplicationProtocolInput"

                          type: object
                        tunnel:
                          description: Configuration of tunneling TCP over other transport
                            or application layers for the host configured in the DestinationRule.
                          properties:
                            protocol:
                              description: Specifies which protocol to use for tunneling

ingressService: istio-ingress
#
defaultConfig:
  # NOTE: If you change any values in this section, make sure to make
  # the same changes in start up args in istio-ingress pods.
  #
  # TCP connection timeout between Envoy & the application, and between Envoys.
  connectTimeout: 1s
  #
  ### ADVANCED SETTINGS #############
  # Where should envoy's configuration be stored in the istio-proxy container
  configPath: "/etc/istio/proxy"

  # not an official release or release candidate, so get the commit sha
  SHORT_SHA=$(echo "${GATEWAY_VERSION}" | awk -F '-' '{ print $NF }')
  GATEWAY_VERSION=$(curl -s -L -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" "https://api.github.com/repos/kubernetes-sigs/gateway-api/commits/${SHORT_SHA}" | jq -r .sha)
fi
if [ -z "${GATEWAY_VERSION}" ]; then

  // port represents the port number of the endpoint.
  // If this is not specified, ports are not restricted and must be
  // interpreted in the context of the specific consumer.
  optional int32 port = 3;

  // The application protocol for this port.
  // This is used as a hint for implementations to offer richer behavior for protocols that they understand.
  // This field follows standard Kubernetes label syntax.
  // Valid values are either:

     of liability) contained within the Source Code Form of the Covered
     Software, except that You may alter any license notices to the extent
     required to remedy known factual inaccuracies.

3.5. Application of Additional Terms

     You may choose to offer, and to charge a fee for, warranty, support,
     indemnity or liability obligations to one or more recipients of Covered