- Configures required iptables, sockets, and packet routing miscellanea within the `ztunnel` and application pod network namespaces to make that happen.

This component accomplishes that in the following ways:

1. By installing a separate, very basic "CNI plugin" binary onto the node to forward low-level pod lifecycle events (CmdAdd/CmdDel/etc) from whatever node-level CNI subsystem is in use to this node agent for processing via socket.

The ztunnel is primarily a mechanism to get traffic to the waypoints, securely.

## Proxy implementation

In its initial implementations, the ztunnel was actually implemented in 3 different ways: a bespoke Rust implementation, a bespoke Go implementation, and in Envoy.

  // Required.
  optional string name = 2;
}

// Subject matches the originator of a request, as identified by the request authentication system. There are three
// ways of matching an originator; by user, group, or service account.
// +union
message Subject {
  // `kind` indicates which one of the other fields is non-empty.
  // Required
  // +unionDiscriminator

  // Required.
  optional string name = 2;
}

// Subject matches the originator of a request, as identified by the request authentication system. There are three
// ways of matching an originator; by user, group, or service account.
// +union
message Subject {
  // `kind` indicates which one of the other fields is non-empty.
  // Required
  // +unionDiscriminator

  // persistentVolumeSource is the actual volume backing the persistent volume.
  optional PersistentVolumeSource persistentVolumeSource = 2;

  // accessModes contains all ways the volume can be mounted.
  // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes
  // +optional
  repeated string accessModes = 3;

			fmt.Fprintf(writer, "   WARNING: User ID (UID) 1337 is reserved for the sidecar proxy.\n")
		}
	}

	// https://istio.io/docs/setup/kubernetes/additional-setup/requirements/
	// says "We recommend adding an explicit app label and version label to deployments."
	if !labels.HasCanonicalServiceName(pod.Labels) {
		fmt.Fprintf(writer, "Suggestion: add required service name label for Istio telemetry. "+

      # For example:
      # podAntiAffinityLabelSelector:
      # - key: security
      #   operator: In
      #   values: S1,S2
      #   topologyKey: "kubernetes.io/hostname"
      # This pod anti-affinity rule says that the pod requires not to be scheduled
      # onto a node if that node is already running a pod with label having key
      # "security" and value "S1".
      podAntiAffinityLabelSelector: []

      # For example:
      # podAntiAffinityLabelSelector:
      # - key: security
      #   operator: In
      #   values: S1,S2
      #   topologyKey: "kubernetes.io/hostname"
      # This pod anti-affinity rule says that the pod requires not to be scheduled
      # onto a node if that node is already running a pod with label having key
      # "security" and value "S1".
      podAntiAffinityLabelSelector: []

  // Required.
  optional string name = 2;
}

// Subject matches the originator of a request, as identified by the request authentication system. There are three
// ways of matching an originator; by user, group, or service account.
// +union
message Subject {
  // `kind` indicates which one of the other fields is non-empty.
  // Required
  // +unionDiscriminator

  // Required.
  optional string name = 2;
}

// Subject matches the originator of a request, as identified by the request authentication system. There are three
// ways of matching an originator; by user, group, or service account.
// +union
message Subject {
  // `kind` indicates which one of the other fields is non-empty.
  // Required
  // +unionDiscriminator