meshConfig:
  defaultConfig:
    proxyMetadata:
      # Enable Istio agent to handle DNS requests for known hosts
      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf

meshConfig:
  defaultConfig:
    proxyMetadata:
      # Enable Istio agent to handle DNS requests for known hosts
      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf

```mermaid
graph LR
    subgraph Client Node
        Client
        CZ["Ztunnel"]
    end
    subgraph Server Node
        Server
        SZ["Ztunnel"]
    end
    Client--Plain-->CZ
    CZ-."HBONE (target)".->Server
    CZ--"HBONE (actual)"-->SZ
    SZ--Plain-->Server
```

### Pooling

User connections can be multiplexed over shared HBONE connections.

option go_package = "k8s.io/api/apiserverinternal/v1alpha1";

// An API server instance reports the version it can decode and the version it
// encodes objects to when persisting objects in the backend.
message ServerStorageVersion {
  // The ID of the reporting API server.
  optional string apiServerID = 1;

  // The API server encodes the object to this version when persisting it in
  // the backend (e.g., etcd).

  optional bool allowVolumeExpansion = 6;

  // volumeBindingMode indicates how PersistentVolumeClaims should be
  // provisioned and bound.  When unset, VolumeBindingImmediate is used.
  // This field is only honored by servers that enable the VolumeScheduling feature.
  // +optional
  optional string volumeBindingMode = 7;

  // allowedTopologies restrict the node topologies where volumes can be dynamically provisioned.

  optional bool allowVolumeExpansion = 6;

  // volumeBindingMode indicates how PersistentVolumeClaims should be
  // provisioned and bound.  When unset, VolumeBindingImmediate is used.
  // This field is only honored by servers that enable the VolumeScheduling feature.
  // +optional
  optional string volumeBindingMode = 7;

  // allowedTopologies restrict the node topologies where volumes can be dynamically provisioned.

  // is populated only for the CSIMigration feature. It contains
  // translated fields from a pod's inline VolumeSource to a
  // PersistentVolumeSpec. This field is alpha-level and is only
  // honored by servers that enabled the CSIMigration feature.
  // +optional
  optional k8s.io.api.core.v1.PersistentVolumeSpec inlineVolumeSpec = 2;
}

// VolumeAttachmentSpec is the specification of a VolumeAttachment request.

meshConfig:
  defaultConfig:
    proxyMetadata:
      # Enable Istio agent to handle DNS requests for known hosts
      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf

as the support for external CAs is more mature than external discovery servers. This supports some additional
configuration, a `CredentialFetcher` which allows fetching a token from places other than a file (for example, a local
metadata server), and a `TokenExchanger` which allows exchanging a token for another form to match the CA server requirements.

						},
					},
				},
				&v1alpha3.Gateway{
					ObjectMeta: metav1.ObjectMeta{
						Name:      "fake-gw",
						Namespace: "default",
					},
					Spec: v1alpha32.Gateway{
						Servers: []*v1alpha32.Server{
							{
								Port: &v1alpha32.Port{
									Number:   80,
									Name:     "default",
									Protocol: "HTTP",
								},
								Hosts: []string{
									"productpage.exapple.com",