//
	// Note that SortedList is used here because the istio sets class has no order guarantees,
	// and our unit tests will flake if rules have a nondeterministic ordering.
	// CLI: -t mangle -A ISTIO_PRERT -s 169.254.7.127 -p tcp -m tcp --dport <PROBEPORT> -j ACCEPT
	//
	// DESC: If this is one of our node-probe ports and is from our SNAT-ed/"special" hostside IP, short-circuit out here

     *   <li>If this field's value is some other thread object, we know that it's not our thread.
     *   <li>If this field's value == null because it originally belonged to another thread and that
     *       thread cleared it, we still know that it's not associated with our thread
     *   <li>If this field's value == null because it was associated with our thread and was
     *       cleared, we know that we're not executing inline any more

release has many critical bug fixes and is safe to run in production. We're eager to stabilize our
new APIs so we can get out of alpha.

 *  New: Support Java 21's virtual threads (‘OpenJDK Project Loom’). We changed OkHttp's internals
    to use `Lock` and `Condition` instead of `synchronized` for best resource utilization.

         * only way to get a TypeVariable instance for the resolved types is to create our own. The
         * created TypeVariable will not interoperate with any JDK TypeVariable. But this is OK: We
         * don't _want_ our new TypeVariable to be equal to the JDK TypeVariable because it has
         * _different bounds_ than the JDK TypeVariable. And it wouldn't make sense for our new

    // Exists to test that our framework doesn't run it:
    @SuppressWarnings("unused")
    @ExampleDerivedFeature.Require({
      ExampleDerivedFeature.DERIVED_FEATURE_1,
      ExampleDerivedFeature.DERIVED_FEATURE_2
    })
    public void testRequiringTwoExplicitDerivedFeatures() throws Exception {
      doNotActuallyRunThis();
    }

    // Exists to test that our framework doesn't run it:

    // Exists to test that our framework doesn't run it:
    @SuppressWarnings("unused")
    @ExampleDerivedFeature.Require({
      ExampleDerivedFeature.DERIVED_FEATURE_1,
      ExampleDerivedFeature.DERIVED_FEATURE_2
    })
    public void testRequiringTwoExplicitDerivedFeatures() throws Exception {
      doNotActuallyRunThis();
    }

    // Exists to test that our framework doesn't run it:

following considerations are for informational purposes only, are not
exhaustive, and do not form part of our licenses.

     Considerations for licensors: Our public licenses are
     intended for use by those authorized to give the public
     permission to use material in ways otherwise restricted by
     copyright and certain other rights. Our licenses are
     irrevocable. Licensors should read and understand the terms

	switch event.Event {
	case controllers.EventAdd:
		// pod was added to our cache
		// we get here in 2 cases:
		// 1. new pod was created on our node
		// 2. we were restarted and current existing pods are added to our cache

		// We have no good way to distinguish between these two cases from here. But we don't need to!

			return false
		}
	}

	// For each candidate pod, iterate across all init containers searching for
	// crashlooping init containers that match our criteria
	for _, container := range pod.Status.InitContainerStatuses {
		// Skip the container if the InitContainerName is not a match and our
		// InitContainerName filter is non-empty.
		if c.cfg.InitContainerName != "" && container.Name != c.cfg.InitContainerName {
			continue
		}

## Configuration protocol

Ztunnel, of course, needs to be dynamically configured in order to make decisions on how it should handle traffic.
For this purpose, we chose to use xDS transport protocol due to our expertise and existing infrastructure, and because the protocol is well suited to our needs.