### Outbound

Requests leaving a pod go through the "outbound" code path on port 15001.
This is where most of Ztunnel's logic lives.

For outbound traffic, we need to first determine where the traffic is destined to.
As Ztunnel operates at L4, we only have the destination IP/port (recovered via `SO_ORIGINAL_DST`).

	"istio.io/istio/istioctl/pkg/clioptions"
	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pkg/adsc"
	"istio.io/istio/pkg/kube"
)

const (
	// defaultExpirationSeconds is how long-lived a token to request (an hour)
	defaultExpirationSeconds = 60 * 60
)

// Audience to create tokens for
var tokenAudiences = []string{"istio-ca"}

  // FallbackToLogsOnError will use the last chunk of container log output if the termination
  // message file is empty and the container exited with an error.
  // The log output is limited to 2048 bytes or 80 lines, whichever is smaller.
  // Defaults to File.
  // Cannot be updated.
  // +optional
  optional string terminationMessagePolicy = 20;

  // Image pull policy.
  // One of Always, Never, IfNotPresent.

                        description: Path to access on the HTTP server.
                        type: string
                      port:
                        description: Port on which the endpoint lives.
                        maximum: 4294967295
                        minimum: 0
                        type: integer
                      scheme:
                        type: string

                        description: Path to access on the HTTP server.
                        type: string
                      port:
                        description: Port on which the endpoint lives.
                        type: integer
                      scheme:
                        type: string
                    required:
                    - port
                    type: object

Headers the proxy will pass on to make the request. items: properties: name: type: string value: type: string type: object type: array path: description: Path to access on the HTTP server. type: string port: description: Port on which the endpoint lives. type: integer scheme: type: string required: - port type: object initialDelaySeconds: description: Number of seconds after the container has started before readiness probes are initiated. format: int32 type: integer periodSeconds: description: How...

  comments: disable
  comments-indentation: disable
  document-end: disable
  document-start: disable
  empty-lines: disable
  empty-values: disable
  hyphens: enable
  indentation: disable
  key-duplicates: enable
  key-ordering: disable
  line-length: disable
  new-line-at-end-of-file: disable
  new-lines: enable
  octal-values: disable
  quoted-strings: disable
  trailing-spaces: disable

	os.Stdout = stdout
	assert.NoError(t, log.Configure(loggingOptions))

	assert.NoError(t, w.Close())
	out, err := io.ReadAll(r)
	assert.NoError(t, err)

	// For each level, there should be two lines, one from direct log,
	// the other one from UDS server
	wantLevels := []string{"debug", "info", "warn", "error", "debug", "info", "warn", "error"}
	gotLogs := strings.Split(
		strings.TrimSuffix(string(out), "\n"), "\n")

  repeated ValidatingWebhookConfiguration items = 2;
}

// WebhookClientConfig contains the information to make a TLS
// connection with the webhook
message WebhookClientConfig {
  // `url` gives the location of the webhook, in standard URL form
  // (`scheme://host:port/path`). Exactly one of `url` or `service`
  // must be specified.
  //
  // The `host` should not refer to a service running in the cluster; use

	}

	linkIndex := routes[0].LinkIndex
	return netlink.LinkByIndex(linkIndex)
}

// getPodNetNs finds the network namespace for a given pod. There is not a great way to do this. Network namespaces live
// under the procfs, /proc/<pid>/ns/net. In majority of cases, this is not used directly, but is rather bind mounted to