// However, this only impacts the DNS response. If we were to send all
						// endpoints, cross network routing would break, as we do passthrough LB and
						// don't go through the network gateway. While we could, hypothetically, send
						// "network-local" endpoints, this would still make enabling DNS give vastly
						// different load balancing than without, so its probably best to filter.

				}
			}

			epNetwork := istioEndpoint.Network
			epCluster := istioEndpoint.Locality.ClusterID
			gateways := b.selectNetworkGateways(epNetwork, epCluster)

			// Check if the endpoint is directly reachable. It's considered directly reachable if
			// the endpoint is either on the local network or on a remote network that can be reached
			// directly from the local network.
			if b.proxy.InNetwork(epNetwork) || len(gateways) == 0 {

// restricted by network (via ISTIO_META_REQUESTED_NETWORK_VIEW).
// If not set, we assume that the proxy wants to see endpoints in any network.
func (node *Proxy) GetView() ProxyView {
	return newProxyView(node)
}

// InNetwork returns true if the proxy is on the given network, or if either
// the proxy's network or the given network is unspecified ("").

		return false
	}
	// Only send endpoints from the networks in the network view requested by the proxy.
	// The default network view assigned to the Proxy is nil, in that case match any network.
	if !b.proxyView.IsVisible(ep) {
		// Endpoint's network doesn't match the set of networks that the proxy wants to see.
		return false
	}

 * subtype of {@code Network} that provides methods for adding and removing nodes and edges. If you
 * do not need to mutate a network (e.g. if you write a method than runs a read-only algorithm on
 * the network), you should use the non-mutating {@link Network} interface, or an {@link
 * ImmutableNetwork}.
 *
 * <p>You can create an immutable copy of an existing {@code Network} using {@link
 * ImmutableNetwork#copyOf(Network)}:

 * subtype of {@code Network} that provides methods for adding and removing nodes and edges. If you
 * do not need to mutate a network (e.g. if you write a method than runs a read-only algorithm on
 * the network), you should use the non-mutating {@link Network} interface, or an {@link
 * ImmutableNetwork}.
 *
 * <p>You can create an immutable copy of an existing {@code Network} using {@link
 * ImmutableNetwork#copyOf(Network)}:

type namedRangerEntry struct {
	name    network.ID
	network net.IPNet
}

// Network returns the IPNet for the network
func (n namedRangerEntry) Network() net.IPNet {
	return n.network
}

// onNetworkChange is fired if the default network is changed either via the namespace label or mesh-networks
func (c *Controller) onNetworkChange() {

	"istio.io/istio/pkg/cluster"
	"istio.io/istio/pkg/network"
	"istio.io/istio/pkg/slices"
	"istio.io/istio/pkg/util/istiomultierror"
	netutil "istio.io/istio/pkg/util/net"
	"istio.io/istio/pkg/util/sets"
)

// NetworkGateway is the gateway of a network
type NetworkGateway struct {
	// Network is the ID of the network where this Gateway resides.
	Network network.ID

apiVersion: release-notes/v2
kind: feature
area: installation
issue:
- 25500
releaseNotes:
- |

kind: DaemonSet
metadata:
  name: kube-network-policies
  namespace: kube-system
  labels:
    tier: node
    app: kube-network-policies
    k8s-app: kube-network-policies
    addonmanager.kubernetes.io/mode: Reconcile
spec:
  selector:
    matchLabels:
      app: kube-network-policies
  template:
    metadata:
      labels:
        tier: node
        app: kube-network-policies
        k8s-app: kube-network-policies