fmt.Fprintln(w, "LISTENER\tCHAIN\tMATCH\tDESTINATION")
	for _, l := range listeners {
		chains := getFilterChains(l)
		lname := "envoy://" + l.GetName()
		// Avoid duplicating the listener and filter name
		if l.GetInternalListener() != nil && len(chains) == 1 && chains[0].GetName() == lname {
			lname = "internal"
		}
		for _, fc := range chains {

			name := fc.GetName()
			matches := newMatcher(fc, l)

       "name": "0.0.0.0_9080",
       "address": {
        "socket_address": {
         "address": "0.0.0.0",
         "port_value": 9080
        }
       },
       "filter_chains": [
        {
         "filter_chain_match": {
          "transport_protocol": "raw_buffer",
          "application_protocols": [
           "http/1.1",
           "h2c"
          ]
         },
         "filters": [

	iptablesBuilder := builder.NewIptablesRuleBuilder(ipbuildConfig(cfg.cfg))

	// Insert jumps to our custom chains
	// This is mostly just for visual tidiness and cleanup, as we can delete the secondary chains and jumps
	// without polluting the main table too much.

	// -t mangle -A PREROUTING -j ISTIO_PRERT
	iptablesBuilder.AppendRule(

              "address": {
                "socket_address": {
                  "address": "0.0.0.0",
                  "port_value": 15008
                }
              },
              "filter_chains": [
                {
                  "filters": [
                    {
                      "name": "envoy.filters.network.http_connection_manager",
                      "typed_config": {

            "address": {
              "socket_address": {
                "address": "0.0.0.0",
                "port_value": 15021
              }
            },
            "filter_chains": [
              {
                "filters": [
                  {
                    "name": "envoy.filters.network.http_connection_manager",
                    "typed_config": {

              "address": {
                "socket_address": {
                  "address": "0.0.0.0",
                  "port_value": 15008
                }
              },
              "filter_chains": [
                {
                  "filters": [
                    {
                      "name": "envoy.filters.network.http_connection_manager",
                      "typed_config": {

		GetValidationContext().
		GetTrustedCa().
		GetInlineBytes()

	// seems as though the most straightforward way to tell whether this is a root ca or not
	// is to check whether the inline bytes of the cert chain or the trusted ca field is zero length
	if len(certChainSecret) > 0 {
		builder.Data(string(certChainSecret))
	} else if len(caDataSecret) > 0 {
		builder.Data(string(caDataSecret))
	}

	Certificates []*CertsDump                `json:"certificates"`
}

type CertsDump struct {
	Identity  string  `json:"identity"`
	State     string  `json:"state"`
	CertChain []*Cert `json:"cert_chain"`
}

type Cert struct {
	Pem            string `json:"pem"`
	SerialNumber   string `json:"serial_number"`
	ValidFrom      string `json:"valid_from"`
	ExpirationTime string `json:"expiration_time"`

    - it will generate an iptables-save config, based on annotations/labels and other settings, and apply it.

### CmdAdd Sidecar Workflow

`CmdAdd` is triggered when there is a new pod created. This runs on the node, in a chain of CNI plugins - Istio is
run after the main CNI sets up the pod IP and networking.

1. Check k8s pod namespace against exclusion list (plugin config)

                        Valid Options: LISTENER, FILTER_CHAIN, NETWORK_FILTER, HTTP_FILTER, ROUTE_CONFIGURATION, VIRTUAL_HOST, HTTP_ROUTE, CLUSTER, EXTENSION_CONFIG, BOOTSTRAP, LISTENER_FILTER
                      enum:
                      - INVALID
                      - LISTENER
                      - FILTER_CHAIN
                      - NETWORK_FILTER
                      - HTTP_FILTER