optional int32 port = 3;

  // The application protocol for this port.
  // This is used as a hint for implementations to offer richer behavior for protocols that they understand.
  // This field follows standard Kubernetes label syntax.
  // Valid values are either:
  //
  // * Un-prefixed protocol names - reserved for IANA standard service names (as per

           "common_tls_context": {
            "tls_params": {
             "tls_minimum_protocol_version": "TLSv1_3",
             "tls_maximum_protocol_version": "TLSv1_3"
            },
            "alpn_protocols": [
             "h2"
            ],
            "tls_certificate_sds_secret_configs": [
             {
              "name": "default",

# Gets the download command supported by the system (currently either curl or wget)
DOWNLOAD_COMMAND=""
function set_download_command () {
  # Try curl.
  if command -v curl > /dev/null; then
    if curl --version | grep Protocols  | grep https > /dev/null; then
      DOWNLOAD_COMMAND="curl -fLSs --retry 5 --retry-delay 1 --retry-connrefused"
      return
    fi
    echo curl does not support https, will try wget for downloading files.
  else

  // appProtocol represents the application protocol for this port.
  // This field follows standard Kubernetes label syntax.
  // Un-prefixed names are reserved for IANA standard service names (as per
  // RFC-6335 and https://www.iana.org/assignments/service-names).
  // Non-standard protocols should use prefixed names such as
  // mycompany.com/my-custom-protocol.
  // +optional
  optional string appProtocol = 4;
}

		descrs = append(descrs, fmt.Sprintf("Trans: %s", match.TransportProtocol))
	}

	if len(match.ApplicationProtocols) > 0 {
		found := false
		for protDescr, protocols := range protDescrs {
			if reflect.DeepEqual(match.ApplicationProtocols, protocols) {
				found = true
				descrs = append(descrs, protDescr)
				break
			}
		}
		if !found {

# Gets the download command supported by the system (currently either curl or wget)
DOWNLOAD_COMMAND=""
function set_download_command () {
  # Try curl.
  if command -v curl > /dev/null; then
    if curl --version | grep Protocols  | grep https > /dev/null; then
      DOWNLOAD_COMMAND="curl -fLSs --retry 5 --retry-delay 1 --retry-connrefused"
      return
    fi
    echo curl does not support https, will try wget for downloading files.
  else

## Configuration protocol

Ztunnel, of course, needs to be dynamically configured in order to make decisions on how it should handle traffic.
For this purpose, we chose to use xDS transport protocol due to our expertise and existing infrastructure, and because the protocol is well suited to our needs.

                      "common_tls_context": {
                        "tls_params": {
                          "tls_minimum_protocol_version": "TLSv1_3",
                          "tls_maximum_protocol_version": "TLSv1_3"
                        },
                        "alpn_protocols": [
                          "h2"
                        ],
                        "tls_certificate_sds_secret_configs": [

                    "common_tls_context": {
                      "tls_params": {
                        "tls_minimum_protocol_version": "TLSv1_2",
                        "tls_maximum_protocol_version": "TLSv1_3"
                      },
                      "alpn_protocols": [
                        "istio-peer-exchange",
                        "istio"
                      ],

  no-important: 0
  no-mergeable-selectors: 2
  no-misspelled-properties: 2
  no-qualifying-elements: 0
  no-trailing-whitespace: 2
  no-trailing-zero: 2
  no-transition-all: 0
  no-url-domains: 2
  no-url-protocols: 2
  no-warn: 2
  one-declaration-per-line: 2
  placeholder-in-extend: 2
  placeholder-name-format: 2
  property-sort-order: 0
  property-units: 2
  pseudo-element: 2
  quotes:
    - 2
    -