return fmt.Errorf("could not build port forwarder for prometheus: %v", err)
	}

	if err = fw.Start(); err != nil {
		return fmt.Errorf("failure running port forward process: %v", err)
	}

	// Close the forwarder either when we exit or when an this processes is interrupted.
	defer fw.Close()
	dashboard.ClosePortForwarderOnInterrupt(fw)

	log.Debugf("port-forward to prometheus pod ready")

                          "allow_connect": true
                        },
                        "server_name": "istio-envoy",
                        "use_remote_address": false,
                        "forward_client_cert_details": "APPEND_FORWARD",
                        "set_current_client_cert_details": {
                          "subject": true,
                          "dns": true,
                          "uri": true

  // The server returns only those CIDRs that it thinks that the client can match.
  // For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP.
  // Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.
  // +optional
  repeated ServerAddressByClientCIDR serverAddressByClientCIDRs = 4;
}

Envoy will send [ADS](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/operations/dynamic_configuration#aggregated-xds-ads)
requests to the agent, which will be forwarded to the configured discovery server (general Istiod).

## CA Flow

istio-agent checks the presence of a socket file on the defined **socket path** `/var/run/secrets/workload-spiffe-uds/socket`.

  // to be.
  // +optional
  optional RollingUpdateDeployment rollingUpdate = 2;
}

// HTTPIngressPath associates a path with a backend. Incoming urls matching the
// path are forwarded to the backend.
message HTTPIngressPath {
  // Path is matched against the path of an incoming request. Currently it can
  // contain characters disallowed from the conventional "path" part of a URL

        ssi(ServiceInstances)
        swi(WorkloadInstances)
        se-->ssi
        swi-->ssi
        we-->swi
    end
    kwi-->ssi
    swi-->ksi
```

For the most part this is fairly straight forward. However, we support `ServiceEntry` selecting `Pod`, and `Service` selecting `WorkloadEntry`, which leads to cross-controller communication.

	registerStringParameter(constants.CNIEventAddress, "/var/run/istio-cni/pluginevent.sock",
		"The UDS server address which CNI plugin will forward ambient pod creation events to")
	registerStringParameter(constants.ZtunnelUDSAddress, "/var/run/ztunnel/ztunnel.sock", "The UDS server address which ztunnel will connect to")