default   details-v1-698d88b-krdw7       10.244.2.55 ambient-worker2 None     HBONE
default   httpbin-7447985f87-t8hv7       10.244.1.40 ambient-worker  None     TCP
default   productpage-v1-675fc69cf-kkrm2 10.244.2.56 ambient-worker2 None     HBONE
default   ratings-v1-6484c4d9bb-8xc2r    10.244.2.57 ambient-worker2 None     HBONE
default   reviews-v1-5b5d6494f4-c7z5w    10.244.1.41 ambient-worker  None     HBONE

bookinfo           reviews-v1-5b5d6494f4-qwjv4                          10.244.1.37 ambient-worker        namespace-istio-waypoint            HBONE
bookinfo           reviews-v2-5b667bcbf8-q5pn2                          10.244.1.38 ambient-worker        namespace-istio-waypoint            HBONE

    end
    subgraph Server Node
        Server
        SZ["Ztunnel"]
    end
    Client--Plain-->CZ
    CZ-."HBONE (target)".->Server
    CZ--"HBONE (actual)"-->SZ
    SZ--Plain-->Server
```

### Pooling

User connections can be multiplexed over shared HBONE connections.
This is done through standard HTTP/2 pooling.
The pooling is keyed off the `{source identity, destination identity, destination ip}`.

effective policy is `PERMISSIVE` (the default), the ztunnel will open a vanilla TLS HBONE tunnel (NOTE: this is not mTLS) to the Waypoint proxy and forward the traffic over that connection without presenting a client certificate. Therefore, it is absolutely critical that the waypoint proxy not assume any identity from incoming connections, even if the ztunnel is hairpinning. In other words, all traffic over TLS HBONE tunnels must be considered to be untrusted. From there, traffic is returned to the...

{
  "workloads": {
    "network1/10.244.2.54": {
      "workloadIps": [
        "10.244.2.54"
      ],
      "waypoint": {
        "destination": "/10.96.65.117",
        "port": 15008
      },
      "protocol": "HBONE",
      "uid": "Kubernetes//Pod/bookinfo/ratings-v1-6484c4d9bb-mdxm5",
      "name": "ratings-v1-6484c4d9bb-mdxm5",
      "namespace": "bookinfo",
      "trustDomain": "cluster.local",

  name: local
  namespace: default
  serviceAccount: default
  workloadIps: ["127.0.0.1"]
  protocol: HBONE
  node: local
  network: ""
  services:
    "default/example.com":
      80: 8080
    "default/example2.com":
      80: 8080
# Define another local address, but this one uses TCP. This allows testing HBONE and TCP with one config.
- uid: cluster1//v1/Pod/default/local-tcp
  name: local-tcp
  namespace: default

			got := GetRevisionFromPodAnnotation(tc.anno)
			assert.Equal(t, tc.expected, got)
		})
	}
}

func TestFindProtocolForPort(t *testing.T) {
	http := "HTTP"
	hbone := "hbone"
	cases := []struct {
		port             corev1.ServicePort
		expectedProtocol string
	}{
		{
			port: corev1.ServicePort{
				Name:     "http",
				Protocol: corev1.ProtocolTCP,
			},

		if protocol == protocolinstance.Unsupported.String() && port.AppProtocol != nil && *port.AppProtocol == "hbone" {
			// HBONE is used for some internal code.
			protocol = string(protocolinstance.HBONE)
		}
	}
	return protocol
}

func isMeshed(pod *corev1.Pod) bool {
	return inject.FindSidecar(pod) != nil
}

Additionally, eventually consistency means we will often get some final requests trickle in before all clients are aware the Pod is shutting down.

Finally, we SHOULD tell our (HBONE) peers we are shutting down.
This can help ensure that clients do not hold onto pooled connections for too long.

			},
			Spec: gateway.GatewaySpec{
				GatewayClassName: constants.WaypointGatewayClassName,
				Listeners: []gateway.Listener{{
					Name:     "mesh",
					Port:     15008,
					Protocol: gateway.ProtocolType(protocol.HBONE),
				}},
			},
		}

		// only label if the user has provided their own value, otherwise we let istiod choose a default at runtime (service)