John Howard <******@****.***> 1676588060 -0800

// pod IP from status is used. And only one IP is added to the mesh in current implementation.
//
// In practice this method is adding a pod IP to the host networking capture.
func AddPodToMesh(client kubernetes.Interface, pod *corev1.Pod, ip string) error {
	return addPodToMeshWithIptables(pod, ip)
}

				return false, fmt.Errorf("error getting host IP: %v", err)
			}

			// Can't set this on GKE, but needed in AWS.. so silently ignore failures
			_ = ambient.SetProc("/proc/sys/net/ipv4/conf/"+podIfname+"/rp_filter", "0")

			for _, ip := range podIPs {
				err = ambient.AddPodToMesh(client, pod, ip.IP.String())
				if err != nil {
					log.WithLabels("err", err, "pod", pod.Name, "ip", ip.IP.String()).Error("Failed to add pod to host network")

     * 
     * 1) IP Address - If a dot-quad IP string is used with getByName (or used
     * to create an NbtAddress internal to this netbios package), no query is
     * sent on the wire and the only state this object has is it's IP address
     * (but that's enough to connect to a host using *SMBSERVER for CallingName).
     * 
     * 2) IP Address, NetBIOS name, nodeType, groupName - If however a

The DNS servers would tell the browser to use some specific **IP address**. That would be the public IP address used by your server, that you configured in the DNS servers.

<img src="/img/deployment/https/https01.svg">

### TLS Handshake Start

The browser would then communicate with that IP address on **port 443** (the HTTPS port).

		Comment:  comment,
		IP:       net.IP(ip.Unmap().AsSlice()),
		Protocol: &ipProto,
		Replace:  replace,
	})
	if err != nil {
		return fmt.Errorf("failed to add IP %s with and proto %d to ipset %s: %w", ip, ipProto, name, err)
	}
	return nil
}

func (m *realDeps) deleteIP(name string, ip netip.Addr, ipProto uint8) error {
	err := netlink.IpsetDel(name, &netlink.IPSetEntry{
		IP:       net.IP(ip.Unmap().AsSlice()),

你可能拥有一个云服务器（虚拟机）或类似的东西，并且它会有一个<abbr title="That isn't Change">固定</abbr> **公共IP地址**。

在 DNS 服务器中，你可以配置一条记录（“A 记录”）以将 **你的域名** 指向你服务器的公共 **IP 地址**。

这个操作一般只需要在最开始执行一次。

!!! tip
     域名这部分发生在 HTTPS 之前，由于这一切都依赖于域名和 IP 地址，所以先在这里提一下。

### DNS

现在让我们关注真正的 HTTPS 部分。

首先，浏览器将通过 **DNS 服务器** 查询**域名的IP** 是什么，在本例中为 `someapp.example.com`。

DNS 服务器会告诉浏览器使用某个特定的 **IP 地址**。 这将是你在 DNS 服务器中为你的服务器配置的公共 IP 地址。

<img src="/img/deployment/https/https01.svg">

   * such as "::c000:201". The output does not include a Scope ID.
   *
   * @param ip {@link InetAddress} to be converted to an address string
   * @return {@code String} containing the text-formatted IP address
   * @since 10.0
   */
  public static String toAddrString(InetAddress ip) {
    checkNotNull(ip);
    if (ip instanceof Inet4Address) {
      // For IPv4, Java's formatting is good enough.

				ip = v.IP
			case *net.IPAddr:
				ip = v.IP
			}

			ipList = append(ipList, ip)
		}
	}

	return ipList
}

// mustGetLocalIP4 returns IPv4 addresses of localhost.  It panics on error.
func mustGetLocalIP4() (ipList set.StringSet) {
	ipList = set.NewStringSet()
	for _, ip := range mustGetLocalIPs() {
		if ip.To4() != nil {
			ipList.Add(ip.String())
		}
	}
	return
}

	HostProbeSNATIP = netip.MustParseAddr(env.RegisterStringVar("HOST_PROBE_SNAT_IP", DefaultHostProbeSNATIP, "").Get())
)

const (
	// to reliably identify kubelet healthprobes from inside the pod (versus standard kube-proxy traffic,
	// since the IP is normally the same), we SNAT identified host probes in the host netns to a fixed APIPA IP.
	//
	// It doesn't matter what this IP is, so long as it's not routable and doesn't collide with anything else.