This is fairly straightforward.

First, we need to check that this traffic is allowed.
Traffic may be denied by RBAC policies (especially from a `STRICT` mode enforcement, which denies plaintext traffic).

If it is allowed, we will forward to the target destination.

#### Hairpin

						}
					}
				}()
			}
			var valuesConfig string
			var sidecarTemplate inject.RawTemplates
			var meshConfig *meshconfig.MeshConfig
			rev := opts.Revision
			// if the revision is "default", render templates with an empty revision
			if rev == util.DefaultRevisionName {
				rev = ""
			}
			injectorAddress := centralOpts.Xds
			index := strings.IndexByte(injectorAddress, ':')
			if index != -1 {

rWebho.neverInjectSelector | trim | indent 6 }} injectedAnnotations: {{- range $key, $val := .Values.sidecarInjectorWebho.injectedAnnotations }} "{{ $key }}": {{ $val | quote }} {{- end }} {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined". This should make it obvious that their installation is...

	Revision string
	// Components is a list of strings specifying which component's manifests to be generated.
	Components []string
	// Filter is the list of components to render
	Filter []string
}

var kubeClientFunc func() (kube.CLIClient, error)

func (a *ManifestGenerateArgs) String() string {
	var b strings.Builder
	b.WriteString("InFilenames:   " + fmt.Sprint(a.InFilenames) + "\n")

    injectedAnnotations:
      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
      "{{ $key }}": {{ $val | quote }}
      {{- end }}
    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".

			if err != nil {
				return err
			}

			// render PeerAuthentication info
			fmt.Fprintf(writer, "--------------------\n")
			err = describePeerAuthentication(writer, kubeClient, configClient, ns, klabels.Set(pod.ObjectMeta.Labels), ctx.IstioNamespace())
			if err != nil {
				return err
			}

			// TODO find sidecar configs that select this workload and render them

			// Now look for ingress gateways

	istioInjectionWebhookSuffix = "sidecar-injector.istio.io"

	vwhBaseTemplateName = "istiod-default-validator"

	operatorNamespace = "operator.istio.io"
)

// tagWebhookConfig holds config needed to render a tag webhook.
type tagWebhookConfig struct {
	Tag            string
	Revision       string
	URL            string
	Path           string
	CABundle       string
	IstioNamespace string

        control plane version: 1.0.0
        data plane version: 1.0.0 (100 proxies)
        $ kubectl version
        Client Version: v1.0.0
        Kustomize Version: v1.0.0
        Server Version: v1.0.0
      render: Text
    validations:
      required: true
  - type: textarea
    id: additional-info
    attributes:
      label: Additional Information
      description: |

    injectedAnnotations:
      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
      "{{ $key }}": {{ $val | quote }}
      {{- end }}
    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".