edge[weight=5]
  appfiles[label="application/*"]
  app -> appfiles [constraint=false]
  appfiles -> appcontents
  appfiles -> appwp
  appfiles -> ig
  appfiles -> nwc
  ztunchart[label="ztunnel",class="helm"]
  ztunnel -> ztunchart -> ztunnelds
  istiodchart[label="istiod",class="helm"]
  cpt -> istiodchart
  istiodchart -> istiod18
  istiodchart -> istiod19
  cnichart[label="cni",class="helm"]
  cni -> cnichart -> cnids

## Traffic routing

Based on the three [redirection](#redirection) paths, the ztunnel has three primary types of traffic it handles.

### Outbound

Requests leaving a pod go through the "outbound" code path on port 15001.
This is where most of Ztunnel's logic lives.

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: istio-ztunnel
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  project: default
  source:
    repoURL: 'https://istio-release.storage.googleapis.com/charts'
    targetRevision: 1.18.5
    chart: ztunnel
    helm:
      valuesObject:
        revision: rapid
  destination:
    name: ambient-cluster
    namespace: istio-system

local queries = (import './queries.libsonnet').queries({
  container: "istio-proxy",
  pod: "ztunnel-.*",
  component: "ztunnel",
  app: "ztunnel",
});

dashboard.new('Istio Ztunnel Dashboard')
+ g.dashboard.withPanels(
  grid.makeGrid([
    row.new('Process')
    + row.withPanels([
      panels.timeSeries.base('Ztunnel Versions', queries.istioBuild, 'Version number of each running instance'),

FROM ${BASE_DISTRIBUTION:-debug}

WORKDIR /

ARG istio_version

# Install ztunnel.
ARG TARGETARCH
COPY ${TARGETARCH:-amd64}/ztunnel /usr/local/bin/ztunnel

# Environment variable indicating the exact build, for debugging
ENV ISTIO_META_ISTIO_VERSION $istio_version

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: istio-operator
spec:
  profile: ambient
  components:
    ztunnel:
      enabled: true
      k8s:
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
          limits:
            cpu: 200m

apiVersion: apps/v1
kind: DaemonSet
metadata:
  annotations: {}
  labels: {}
  name: ztunnel
  namespace: istio-system
spec:
  selector:
    matchLabels:
      app: ztunnel
  template:
    metadata:
      annotations:
        ambient.istio.io/redirection: disabled
        cni.projectcalico.org/allowedSourcePrefixes: '["0.0.0.0/0"]'
        prometheus.io/port: "15020"
        prometheus.io/scrape: "true"

                  "type": "prometheus",
                  "uid": "$datasource"
               },
               "expr": "sum(istio_build{component=\"ztunnel\"}) by (tag)",
               "legendFormat": "Version ({{tag}})"
            }
         ],
         "title": "Ztunnel Versions",
         "type": "timeseries"
      },
      {
         "datasource": {
            "type": "datasource",
            "uid": "-- Mixed --"

apiVersion: release-notes/v2
kind: feature
area: installation
issue:
  - 47867

releaseNotes:
  - |

apiVersion: release-notes/v2
kind: feature
area: installation
issue: []

releaseNotes:
  - |