"ghcr.io/devcontainers/features/docker-outside-of-docker:1": {},
    "ghcr.io/mpriscella/features/kind:1": {}
  },
  "customizations": {
    "vscode": {
      "extensions": [
        "golang.go",
        "rust-lang.rust-analyzer",
        "eamodio.gitlens",
        "zxh404.vscode-proto3",
        "ms-azuretools.vscode-docker",
        "redhat.vscode-yaml",
        "IBM.output-colorizer"
      ],
      "settings": {

        {{- end }}
        - name: XDS_ADDRESS
          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
        - name: RUST_LOG
          value: {{ .Values.logLevel | quote }}
        - name: ISTIO_META_CLUSTER_ID
          value: {{ .Values.multiCluster.clusterName | default "Kubernetes" }}
        - name: INPOD_ENABLED
          value: "true"

  pushd "$(dirname "$2")"

  # Download and make the binary executable
  echo "Downloading ztunnel: $1 to $2"
  time ${DOWNLOAD_COMMAND} --header "${AUTH_HEADER:-}" "$1" > "$2"
  chmod +x "$2"

  # Make a copy named just "ztunnel" in the same directory (overwrite if necessary).
  echo "Copying $2 to $(dirname "$2")/${3}"
  cp -f "$2" "$(dirname "$2")/${3}"
  popd

  # Also copy it to out/$os_arch/ztunnel as that's whats used in the build

Envoy filters) that support authentication, authorization, and telemetry collection.

- [istio/ztunnel](https://github.com/istio/ztunnel). The repository contains the Rust implementation of the ztunnel
component of Ambient mesh.

## Issue management

We use GitHub to track all of our bugs and feature requests. Each issue we track has a variety of metadata:

## Proxy implementation

In its initial implementations, the ztunnel was actually implemented in 3 different ways: a bespoke Rust implementation, a bespoke Go implementation, and in Envoy.

In the end, [after evaluation](https://docs.google.com/document/d/1c2123cKuYsBDpIon9FFdctWTUIMFweSjgwG7r8l3818/edit), the decision was to move forward with a Rust implementation.

  // ratio between the target value and the current value by the current
  // number of pods.  Ergo, metrics used must decrease as the pod count is
  // increased, and vice-versa.  See the individual metric source types for
  // more information about how each type of metric must respond.
  // +optional
  repeated MetricSpec metrics = 4;
}

  optional MetricValueStatus current = 2;
}

// HPAScalingPolicy is a single policy which must hold true for a specified past interval.
message HPAScalingPolicy {
  // type is used to specify the scaling policy.
  optional string type = 1;

  // value contains the amount of change which is permitted by the policy.
  // It must be greater than zero
  optional int32 value = 2;

  // The profile must be preconfigured on the node to work.
  // Must be a descending path, relative to the kubelet's configured seccomp profile location.
  // Must only be set if type is "Localhost".
  // +optional
  optional string localhostProfile = 2;
}

// Secret holds secret data of a certain type. The total bytes of the values in
// the Data field must be less than MaxSecretSize bytes.

  // If the EndpointSlice is dervied from a Kubernetes service, this corresponds to the Service.ports[].name.
  // Name must either be an empty string or pass DNS_LABEL validation:
  // * must be no more than 63 characters long.
  // * must consist of lower case alphanumeric characters or '-'.
  // * must start and end with an alphanumeric character.

  //
  // In order to create or update a ClusterTrustBundle that sets signerName,
  // you must have the following cluster-scoped permission:
  // group=certificates.k8s.io resource=signers resourceName=<the signer name>
  // verb=attest.
  //
  // If signerName is not empty, then the ClusterTrustBundle object must be
  // named with the signer name as a prefix (translating slashes to colons).