## PeerAuthentication and ztunnel

                          },
                          {
                            "name": "waypoint_upstream_peer_metadata",
                            "typed_config": {
                              "@type": "type.googleapis.com/udpa.type.v1.TypedStruct",
                              "type_url": "type.googleapis.com/io.istio.http.peer_metadata.Config",
                              "value": {
                                "upstream_discovery": [

                          {
                            "name": "waypoint_downstream_peer_metadata",
                            "typed_config": {
                              "@type": "type.googleapis.com/udpa.type.v1.TypedStruct",
                              "type_url": "type.googleapis.com/io.istio.http.peer_metadata.Config",
                              "value": {
                                "downstream_discovery": [

      type: date
    name: v1
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: 'Peer authentication configuration for workloads. See more
              details at: https://istio.io/docs/reference/config/security/peer_authentication.html'
            properties:
              mtls:
                description: Mutual TLS settings for workload.

for publication.

This document outlines getting in new features after a new branch has been cut and the process for getting a PR
merged in before and after the first public release.

# Feature Freeze

One week before a release, the release branch goes into a state of code freeze. At this point only critical release
blocking bugs are addressed. Additional changes that are targeted for new features and capabilities will not be merged.

          {
           "name": "istio.metadata_exchange",
           "typed_config": {
            "@type": "type.googleapis.com/envoy.tcp.metadataexchange.config.MetadataExchange",
            "protocol": "istio-peer-exchange"
           }
          },
          {
           "name": "istio.stats",
           "typed_config": {
            "@type": "type.googleapis.com/stats.PluginConfig",

      type: date
    name: v1
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: 'Peer authentication configuration for workloads. See more
              details at: https://istio.io/docs/reference/config/security/peer_authentication.html'
            properties:
              mtls:
                description: Mutual TLS settings for workload.

As part of this, we need to pick the correct certificate to serve on behalf of the destination workload.
As discussed in [HBONE](#hbone), this is based on the destination IP.
Additionally, we enforce the peer has a valid mesh identity (but do not assert _which_ identity, yet).

Next, we terminate the CONNECT.
From the [headers](#headers), we know the target destination.

	istioHTTPPlaintext = []string{"istio", "istio-http/1.0", "istio-http/1.1", "istio-h2"}
	httpTLS            = []string{"http/1.0", "http/1.1", "h2c", "istio-http/1.0", "istio-http/1.1", "istio-h2"}
	tcpTLS             = []string{"istio-peer-exchange", "istio"}

	protDescrs = map[string][]string{
		"App: HTTP TLS":         httpTLS,
		"App: Istio HTTP Plain": istioHTTPPlaintext,
		"App: TCP TLS":          tcpTLS,

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // items is a list of schema objects.
  repeated NetworkPolicy items = 2;
}

// NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of
// fields are allowed
message NetworkPolicyPeer {
  // podSelector is a label selector which selects pods. This field follows standard label