"periodSeconds"
"successThreshold"
"failureThreshold"
"tcpSocket"
"httpGet"
"exec"
"scheme"
"command"
"annotations"
"endpoints"
"location"
"ingress"
"outgress"
"outboundTrafficPolicy"
"captureMode"
"defaultEndpoint"
"gateways"
"delegate"
"redirect"
"rewrite"
"timeout"
"retries"
"fault"
"mirror"
"mirrorPercentage"
"corsPolicy"
"headers"
"mirrorPercent"
"namespace"

spec:
  egress:
    - hosts:
        - "ns1/*"
  ingress:
    - port:
        number: 9080
        protocol: HTTP
        name: http-admin
      defaultEndpoint: 127.0.0.1:8080
      captureMode: IPTABLES
  workloadSelector:
    labels:

		} else {
			errs = appendErrors(errs, ValidateUnixAddress(strings.TrimPrefix(bind, UnixAddressPrefix)))
		}

		if captureMode != networking.CaptureMode_DEFAULT && captureMode != networking.CaptureMode_NONE {
			errs = appendErrors(errs, fmt.Errorf("sidecar: captureMode must be DEFAULT/NONE for unix domain socket listeners"))
		}
	} else {
		errs = appendErrors(errs,
			ValidateProtocol(port.Protocol),

					Port:     int(i.Port.Number),
					Protocol: protocol.Parse(i.Port.Protocol),
				},
				TargetPort: i.Port.Number, // No targetPort support in the API
			}
			bindtoPort := getBindToPort(i.CaptureMode, lb.node)
			// Skip ports we cannot bind to
			if !lb.node.CanBindToPort(bindtoPort, port.TargetPort) {
				log.Warnf("buildInboundListeners: skipping privileged sidecar port %d for node %s as it is an unprivileged proxy",

	IstioProxySHA string `json:"ISTIO_PROXY_SHA,omitempty"`
}

// TrafficInterceptionMode indicates how traffic to/from the workload is captured and
// sent to Envoy. This should not be confused with the CaptureMode in the API that indicates
// how the user wants traffic to be intercepted for the listener. TrafficInterceptionMode is
// always derived from the Proxy metadata
type TrafficInterceptionMode string

		if noneMode {
			// do not care what the listener's capture mode setting is. The proxy does not use iptables
			bind.bindToPort = true
		} else if egressListener.IstioListener != nil {
			if egressListener.IstioListener.CaptureMode == networking.CaptureMode_NONE {
				// proxy uses iptables redirect or tproxy. IF mode is not set
				// for older proxies, it defaults to iptables redirect.  If the

                        to which the listener should be bound to.
                      type: string
                    captureMode:
                      description: |-
                        When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not).

                        Valid Options: DEFAULT, IPTABLES, NONE

                        to which the listener should be bound to.
                      type: string
                    captureMode:
                      description: |-
                        When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not).

                        Valid Options: DEFAULT, IPTABLES, NONE

					Hosts: []string{"default/*"},
					Port: &networking.SidecarPort{
						Number:   15080,
						Protocol: "HTTP_PROXY",
						Name:     "15080",
					},
					Bind:        "127.0.0.1",
					CaptureMode: networking.CaptureMode_NONE,
				},
			},
		},
	}
	services := []*model.Service{buildService("httpbin.com", wildcardIPv4, protocol.HTTP, tnow.Add(1*time.Second))}

                        to which the listener should be bound to.
                      type: string
                    captureMode:
                      description: When the bind address is an IP, the captureMode
                        option dictates how traffic to the listener is expected to
                        be captured (or not).
                      enum: