### Ambient

To enable ambient, you can use the ambient profile: `--set profile=ambient`.

#### Calico

For Calico, you must also modify the settings to allow source spoofing:

- if deployed by operator,  `kubectl patch felixconfigurations default --type='json' -p='[{"op": "add", "path": "/spec/workloadSourceSpoofing", "value": "Any"}]'`

   * types that contain an embedded IPv4 address.
   *
   * <p>NOTE: ISATAP addresses are explicitly excluded from this method due to their trivial
   * spoofability. With other transition addresses spoofing involves (at least) infection of one's
   * BGP routing table.
   *
   * @param ip {@link Inet6Address} to be examined for embedded IPv4 client address
   * @return {@code true} if there is an embedded IPv4 client address

 * limitations under the License.
 */
package okhttp3.internal.connection

/**
 * A RoutePlanner that will always establish a new connection, ignoring any connection pooling
 */
class ForceConnectRoutePlanner(private val delegate: RealRoutePlanner) : RoutePlanner by delegate {
  override fun plan(): RoutePlanner.Plan = delegate.planConnect() // not delegate.plan()

    end
    Client--Plain-->CZ
    CZ-."HBONE (target)".->Server
    CZ--"HBONE (actual)"-->SZ
    SZ--Plain-->Server
```

### Pooling

User connections can be multiplexed over shared HBONE connections.
This is done through standard HTTP/2 pooling.
The pooling is keyed off the `{source identity, destination identity, destination ip}`.

### Headers

Ztunnel uses the following well-known headers in HBONE:

efficiently makes your stuff load faster and saves bandwidth.

OkHttp is an HTTP client that’s efficient by default:

 * HTTP/2 support allows all requests to the same host to share a socket.
 * Connection pooling reduces request latency (if HTTP/2 isn’t available).
 * Transparent GZIP shrinks download sizes.
 * Response caching avoids the network completely for repeat requests.

    the stream only or the entire connection. With this fix OkHttp will now send HTTP/2 pings after
    a stream timeout to determine whether the connection should remain eligible for pooling.

 *  Fix: Don't call `EventListener.responseHeadersStart()` or `responseBodyStart()` until bytes have
    been received. Previously these events were incorrectly sent too early, when OkHttp was ready to

	"math"
	"net/url"
	"sort"
	"strings"
	"sync"

	"github.com/tinylib/msgp/msgp"
)

// Recycler will override the internal reuse in typed handlers.
// When this is supported, the handler will not do internal pooling of objects,
// call Recycle() when the object is no longer needed.
// The recycler should handle nil pointers.
type Recycler interface {
	Recycle()
}

// MSS is a map[string]string that can be serialized.

	}
	h.ignoreNilConn = true
	return h
}

// WithSharedResponse indicates it is unsafe to reuse the response
// when it has been returned on a handler.
// This will disable automatic response recycling/pooling.
// Typically this is used when the response sharing part of its data structure.
func (h *SingleHandler[Req, Resp]) WithSharedResponse() *SingleHandler[Req, Resp] {
	h.sharedResp = true
	return h
}

   * https://github.com/square/okhttp/issues/4258
   */
  @Test
  @Throws(Exception::class)
  fun webSocketConnectionIsReleased() {
    // This test assumes HTTP/1.1 pooling semantics.
    client =
      client.newBuilder()
        .protocols(Arrays.asList(Protocol.HTTP_1_1))
        .build()
    webServer.enqueue(
      MockResponse.Builder()

other namespace only on K8S clusters that allow 'system-node-critical' outside of kube-system. ## Ambient To enable ambient, you need to add `--set cni.ambient.enabled=true`. ### Calico For Calico, you must also modify the settings to allow source spoofing: - if deployed by operator, `kubectl patch felixconfigurations default --type='json' -p='[{"op": "add", "path": "/spec/workloadSourceSpoofi", "value": "Any"}]'` - if deployed by manifest, add env `FELIX_WORKLOADSOURCESPOOFI` with value `Any` in ...