}
              ],
              "use_original_dst": false,
              "listener_filters": [
                {
                  "name": "envoy.filters.listener.original_dst",
                  "typed_config": {
                    "@type": "type.googleapis.com/envoy.extensions.filters.listener.original_dst.v3.OriginalDst"
                  }
                }
              ],

                }
              ],
              "use_original_dst": false,
              "listener_filters": [
                {
                  "name": "envoy.filters.listener.original_dst",
                  "typed_config": {
                    "@type": "type.googleapis.com/envoy.extensions.filters.listener.original_dst.v3.OriginalDst"
                  }
                }
              ],

                }
              ],
              "listener_filters": [
                {
                  "name": "envoy.filters.listener.original_dst",
                  "typed_config": {
                    "@type": "type.googleapis.com/envoy.extensions.filters.listener.original_dst.v3.OriginalDst"
                  }
                },
                {
                  "name": "envoy.filters.listener.http_inspector",

This is where most of Ztunnel's logic lives.

For outbound traffic, we need to first determine where the traffic is destined to.
As Ztunnel operates at L4, we only have the destination IP/port (recovered via `SO_ORIGINAL_DST`).
This may be an IP of a Service, a Pod, or something outside the cluster.
Ztunnel will look up the destination from the [addresses](#address-type) it is configured with.

         "name": "0.0.0.0_80"
        }
       ],
       "listener_filters": [
        {
         "name": "envoy.filters.listener.original_dst",
         "typed_config": {
          "@type": "type.googleapis.com/envoy.extensions.filters.listener.original_dst.v3.OriginalDst"
         }
        },
        {
         "name": "envoy.filters.listener.tls_inspector",
         "typed_config": {

	ServiceAccount string `json:"serviceAccount"`
}

type InboundConnection struct {
	Src         string `json:"src"`
	OriginalDst string `json:"originalDst"`
	ActualDst   string `json:"actualDst"`
}

type OutboundConnection struct {
	Src         string `json:"src"`
	OriginalDst string `json:"originalDst"`
	ActualDst   string `json:"actualDst"`
}

type WorkloadConnection struct {
	Src         string `json:"src"`

				fmt.Fprintf(w, "%v\tInbound\t%v\t%v\t%v\n", name, lookupIP(c.ActualDst), lookupIP(c.Src), c.OriginalDst)
			}
		}
		if filter.Direction != "inbound" {
			for _, c := range wl.Connections.Outbound {
				fmt.Fprintf(w, "%v\tOutbound\t%v\t%v\t%v\n", name, lookupIP(c.Src), lookupIP(c.ActualDst), lookupIP(c.OriginalDst))
			}
		}
	}
	return w.Flush()

   * collected. If you want the original list to be eligible for garbage collection, you should
   * create and use a copy of the sub list (e.g., {@code
   * ImmutableList.copyOf(originalList.subList(...))}).
   */
  @Override
  public ImmutableList<E> subList(int fromIndex, int toIndex) {
    checkPositionIndexes(fromIndex, toIndex, size());
    int length = toIndex - fromIndex;

   * collected. If you want the original list to be eligible for garbage collection, you should
   * create and use a copy of the sub list (e.g., {@code
   * ImmutableList.copyOf(originalList.subList(...))}).
   */
  @Override
  public ImmutableList<E> subList(int fromIndex, int toIndex) {
    checkPositionIndexes(fromIndex, toIndex, size());
    int length = toIndex - fromIndex;