## Reference

### Design details

Broadly, `istio-cni` accomplishes ambient redirection by instructing ztunnel to set up sockets within the application pod network namespace, where:

  // List of carps.
  // More info: http://kubernetes.io/docs/user-guide/carps
  repeated Carp items = 2;
}

// CarpSpec is a description of a carp
message CarpSpec {
  // Restart policy for all containers within the carp.
  // One of Always, OnFailure, Never.
  // Default to Always.
  // More info: http://kubernetes.io/docs/user-guide/carp-states#restartpolicy
  // +optional

  // +patchStrategy=merge
  repeated EphemeralContainer ephemeralContainers = 34;

  // Restart policy for all containers within the pod.
  // One of Always, OnFailure, Never. In some contexts, only a subset of those values may be permitted.
  // Default to Always.
  // More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy
  // +optional
  optional string restartPolicy = 3;

  // (generally five to fifteen minutes) or a configuration change on the server, the server will
  // respond with a 410 ResourceExpired error together with a continue token. If the client needs a
  // consistent list, it must restart their list without the continue field. Otherwise, the client may
  // send another list request with the token received with the 410 error, the server will respond with