The ambient CNI agent is the only place where ambient network config and pod redirection machinery happens.

{
  "name": "k8s-pod-network",
  "plugins": [
    {
      "type": "calico",
      "etcd_endpoints": "http://10.110.0.136:6666",
      "log_level": "info",
      "mtu": 1500,
      "ipam": {
        "type": "calico-ipam"
      },
      "policy": {
        "type": "k8s"
      },
      "kubernetes": {
        "kubeconfig": "/etc/cni/net.d/calico-kubeconfig"
      }
    },
    {
      "type": "portmap",
      "snat": true,

{
  "name": "k8s-pod-network",
  "cniVersion": "0.3.1",
  "pugins": [
    {
      "type": "calico",
      "etcd_endpoints": "http://10.110.0.136:6666",
      "log_level": "info",
      "mtu": 1500,
      "ipam": {
        "type": "calico-ipam"
      },
      "policy": {
        "type": "k8s"
      },
      "kubernetes": {
        "kubeconfig": "/etc/cni/net.d/calico-kubeconfig"
      }
    },
    {

ISTIO_METAJSON_LABELS='{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'
ISTIO_META_CLUSTER_ID='Kubernetes'
ISTIO_META_DNS_CAPTURE='true'
ISTIO_META_MESH_ID=''
ISTIO_META_NETWORK=''
ISTIO_META_WORKLOAD_NAME='foo'
ISTIO_NAMESPACE='bar'
ISTIO_SERVICE='foo.bar'
ISTIO_SERVICE_CIDR='*'
ISTIO_SVC_IP='10.10.10.10'
POD_NAMESPACE='bar'
SERVICE_ACCOUNT='vm-serviceaccount'

// more information.
// StatefulSet represents a set of pods with consistent identities.
// Identities are defined as:
//   - Network: A single stable DNS and hostname.
//   - Storage: As many VolumeClaims as requested.
//
// The StatefulSet guarantees that a given network identity will always
// map to the same storage identity.
message StatefulSet {
  // +optional

{
  "cniVersion": "0.3.1",
  "name": "k8s-pod-network",
  "plugins": [
    {
      "addIf": "true",
      "bridge": "mybridge",
      "ipMasq": true,
      "ipam": {
        "gateway": "10.1.0.1",
        "routes": [
          {
            "dst": "0.0.0.0/0"
          }
        ],
        "subnet": "10.1.0.0/16",
        "type": "host-local"
      },
      "isGateway": true,
      "mtu": 1460,

ISTIO_METAJSON_LABELS='{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'
ISTIO_META_CLUSTER_ID='Kubernetes'
ISTIO_META_DNS_CAPTURE='true'
ISTIO_META_MESH_ID=''
ISTIO_META_NETWORK=''
ISTIO_META_WORKLOAD_NAME='foo'
ISTIO_NAMESPACE='bar'
ISTIO_SERVICE='foo.bar'
ISTIO_SERVICE_CIDR='*'
ISTIO_SVC_IP='fd00:10:96::1'
POD_NAMESPACE='bar'
PROXY_CONFIG_ANNOT_VALUE='bar'

  * In practice, this largely means that references are fully qualified in the API. IP Addresses (generally) have a network associated with them, node names have a cluster associated with them, etc.

See the [XDS Evolution](https://docs.google.com/document/d/1V5wkeBHbLSLMzAMbwFlFZNHdZPyUEspG4lHbnB0UaCg/edit) document for more history and details.

// match, then routed to the backend associated with the matching IngressRuleValue.
message IngressRule {
  // host is the fully qualified domain name of a network host, as defined by RFC 3986.
  // Note the following deviations from the "host" part of the
  // URI as defined in RFC 3986:
  // 1. IPs are not allowed. Currently an IngressRuleValue can only apply to

  // endpoints is a list of unique endpoints in this slice. Each slice may
  // include a maximum of 1000 endpoints.
  // +listType=atomic
  repeated Endpoint endpoints = 2;

  // ports specifies the list of network ports exposed by each endpoint in
  // this slice. Each port must have a unique name. When ports is empty, it
  // indicates that there are no defined ports. When a port is defined with a