)

// DestinationARNPrefix - destination ARN prefix as per AWS S3 specification.
const DestinationARNPrefix = "arn:aws:s3:::"

// DestinationARNMinIOPrefix - destination ARN prefix for MinIO.
const DestinationARNMinIOPrefix = "arn:minio:replication:"

// Destination - destination in ReplicationConfiguration.
type Destination struct {
	XMLName      xml.Name `xml:"Destination" json:"Destination"`

          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "{{ destination_workload }}.{{ destination_workload_namespace }} : {{ response_code }} (🔐mTLS)",

			destBucket:            "destinationbucket",...

		return rules[i].Priority > rules[j].Priority && rules[i].Destination.String() == rules[j].Destination.String()
	})

	return rules
}

// GetDestination returns destination bucket and storage class.
func (c Config) GetDestination() Destination {
	if len(c.Rules) > 0 {
		return c.Rules[0].Destination
	}
	return Destination{}
}

// Replicate returns true if the object should be replicated.

wp-->|mTLS|ztunnel
ztunnel-->|plaintext|dst[dst pod]
```

And here's an example of an authenticated request to a captured destination:

```mermaid
graph TD;
src[src pod]-->|15008|ztunnel{ztunnel}
ztunnel-->|HBONE|dwp{"destination waypoint (all policy applied here)"}
dwp{destination waypoint}-->|15008|dztunnel{destination ztunnel}
dztunnel-->|host network|dst[dst pod]

          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }}",

                    mirrors:
                      description: Specifies the destinations to mirror HTTP traffic
                        in addition to the original destination.
                      items:
                        properties:
                          destination:
                            description: Destination specifies the target of the mirror
                              operation.

As discussed in [HBONE](#hbone), this is based on the destination IP.
Additionally, we enforce the peer has a valid mesh identity (but do not assert _which_ identity, yet).

Next, we terminate the CONNECT.
From the [headers](#headers), we know the target destination.

									{
										Destination: &v1alpha32.Destination{
											Host: "productpage",
										},
										Weight: 30,
									},
									{
										Destination: &v1alpha32.Destination{
											Host: "productpage2",
										},
										Weight: 20,
									},
									{
										Destination: &v1alpha32.Destination{
											Host: "productpage3",
										},

				secretItemColumns...),
			unexpected: []string{"source", "destination", "certdata"},
		},
		{
			name:   "test JSON output with a single secret item",
			format: JSON,
			items: []SecretItem{
				{
					Name:        "olinger",
					Data:        "certdata",
					Source:      "source",
					Destination: "destination",
					SecretMeta: SecretMeta{
						Valid:        true,