}
	i, err := inodeForFd(n)
	if err != nil {
		n.Close()
		return nil, err
	}
	return &NetnsWrapper{innerNetns: n, inode: i}, nil
}

func NetnsSet(n NetnsFd) error {
	if err := unix.Setns(int(n.Fd()), unix.CLONE_NEWNET); err != nil {
		return fmt.Errorf("Error switching to ns fd %v: %v", n.Fd(), err)
	}
	return nil
}

// inspired by netns.Do() but with an existing fd.
func NetnsDo(fdable NetnsFd, toRun func() error) error {

     behalf of any Contributor. You must make it absolutely clear that any
     such warranty, support, indemnity, or liability obligation is offered by
     You alone, and You hereby agree to indemnify every Contributor for any
     liability incurred by such Contributor as a result of warranty, support,
     indemnity or liability terms You offer. You may include additional

  // +optional
  repeated string hosts = 1;

  // secretName is the name of the secret used to terminate TLS traffic on
  // port 443. Field is left optional to allow TLS routing based on SNI
  // hostname alone. If the SNI host in a listener conflicts with the "Host"
  // header field used by an IngressRule, the SNI host is used for termination
  // and value of the "Host" header is used for routing.
  // +optional

     of any Contributor. You must make it absolutely clear that any such
     warranty, support, indemnity, or liability obligation is offered by You
     alone, and You hereby agree to indemnify every Contributor for any
     liability incurred by such Contributor as a result of warranty, support,
     indemnity or liability terms You offer. You may include additional

     of any Contributor. You must make it absolutely clear that any such
     warranty, support, indemnity, or liability obligation is offered by You
     alone, and You hereby agree to indemnify every Contributor for any
     liability incurred by such Contributor as a result of warranty, support,
     indemnity or liability terms You offer. You may include additional

TODO: fill in implementation details of how redirection is actually implemented.

## HBONE

Along with pass-through traffic, Ztunnel supports the "HBONE" (HTTP-Based Overlay Network) protocol.

  // +optional
  repeated string hosts = 1;

  // secretName is the name of the secret used to terminate TLS traffic on
  // port 443. Field is left optional to allow TLS routing based on SNI
  // hostname alone. If the SNI host in a listener conflicts with the "Host"
  // header field used by an IngressRule, the SNI host is used for termination
  // and value of the Host header is used for routing.
  // +optional

  // keys that it understands (e.g. "company.com/zone", "company.com/region").
  // When a driver is initialized on a node, it provides the same topology keys
  // along with values. Kubelet will expose these topology keys as labels
  // on its own node object.
  // When Kubernetes does topology aware provisioning, it can use this list to

# * Building all docker images (generally in CI). In this case we want to build everything at once, so they share work
# * Building a single docker image (generally during dev). In this case we just want to build the single binary alone
BUILD_ALL ?= true
define build-linux
.PHONY: $(TARGET_OUT_LINUX)/$(shell basename $(1))
ifeq ($(BUILD_ALL),true)
$(TARGET_OUT_LINUX)/$(shell basename $(1)): build-linux
	@:
else

type. enum: - ANY - ROUTE - REDIRECT - DIRECT_RESPONSE type: string name: description: The Route objects generated by default are named as default. type: string type: object type: object type: object type: object patch: description: The patch to apply along with the operation. properties: filterClass: description: Determines the filter insertion order. enum: - UNSPECIFIED - AUTHN - AUTHZ - STATS type: string operation: description: Determines how the patch should be applied. enum: - INVALID - MERGE -...