"istio.io/istio/tools/istio-iptables/pkg/cmd"
)

const (
	redirectModeREDIRECT         = "REDIRECT"
	redirectModeTPROXY           = "TPROXY"
	defaultProxyStatusPort       = "15020"
	defaultRedirectToPort        = "15001"
	defaultNoRedirectUID         = "1337"
	defaultNoRedirectGID         = "1337"
	defaultRedirectMode          = redirectModeREDIRECT
	defaultRedirectIPCidr        = "*"
	defaultRedirectExcludeIPCidr = ""

	"istio.io/istio/pkg/kube"
	istioversion "istio.io/istio/pkg/version"
)

const (
	// Service account to create tokens in
	tokenServiceAccount = "default"
	// Get the pods with limit = 500.
	kubeClientGetPodLimit = 500
)

type ControlPlaneNotFoundError struct {
	Namespace string
}

func (c ControlPlaneNotFoundError) Error() string {
	return fmt.Sprintf("no running Istio pods in %q", c.Namespace)
}

     }
    },
    {
     "name": "0.0.0.0_5000",
     "active_state": {
      "version_info": "2023-06-20T09:07:41Z/3",
      "listener": {
       "@type": "type.googleapis.com/envoy.config.listener.v3.Listener",
       "name": "0.0.0.0_5000",
       "address": {
        "socket_address": {
         "address": "0.0.0.0",
         "port_value": 5000
        }
       },
       "filter_chains": [

are required for scraping prometheus (in most environments). podAnnotations: prometheus.io/port: "15020" prometheus.io/scrape: "true" # Additional labels to apply on the pod level podLabels: {} # Pod resource configuration resources: requests: cpu: 500m memory: 2048Mi # List of secret names to add to the service account as image pull secrets imagePullSecrets: [] # A `key: value` mapping of environment variables to add to the pod env: {} # Override for the pod imagePullPolicy imagePullPolicy: "" #...

// by dots suppressing leading zeros for IPv4 and the representation defined by RFC 5952 for IPv6.
// Valid: 192.168.1.5 or 2001:db8::1 or 2001:db8:aaaa:bbbb:cccc:dddd:eeee:1
// Invalid: 10.01.2.3 or 2001:db8:0:0:0::1
message IPAddress {
  // Standard object's metadata.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

  {{- else }}
    image: "{{ .ProxyImage }}"
  {{- end }}
    args:
    - istio-iptables
    - "-p"
    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
    - "-z"
    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
    - "-u"
    - {{ .ProxyUID | default "1337" | quote }}
    - "-m"

  {{- else }}
    image: "{{ .ProxyImage }}"
  {{- end }}
    args:
    - istio-iptables
    - "-p"
    - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }}
    - "-z"
    - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }}
    - "-u"
    - {{ .ProxyUID | default "1337" | quote }}
    - "-m"

	ChainInpodPrerouting = "ISTIO_PRERT"
	ChainHostPostrouting = "ISTIO_POSTRT"
	RouteTableInbound    = 100

	DNSCapturePort              = 15053
	ZtunnelInboundPort          = 15008
	ZtunnelOutboundPort         = 15001
	ZtunnelInboundPlaintextPort = 15006
	ProbeIPSet                  = "istio-inpod-probes"
)

var log = istiolog.RegisterScope("iptables", "iptables helper")

type Config struct {

* nat
-N ISTIO_INBOUND
-N ISTIO_REDIRECT
-N ISTIO_IN_REDIRECT
-N ISTIO_OUTPUT
-A ISTIO_INBOUND -p tcp --dport 15008 -j RETURN
-A ISTIO_REDIRECT -p tcp -j REDIRECT --to-ports 15001
-A ISTIO_IN_REDIRECT -p tcp -j REDIRECT --to-ports 15006
-A PREROUTING -p tcp -j ISTIO_INBOUND
-A ISTIO_INBOUND -p tcp --dport 15020 -j RETURN
-A ISTIO_INBOUND -p tcp --dport 15021 -j RETURN
-A ISTIO_INBOUND -p tcp --dport 15090 -j RETURN

    seccompProfile: {}

    resources:
      requests:
        cpu: 100m
        memory: 100Mi

    resourceQuotas:
      enabled: false
      pods: 5000

    # The number of pods that can be unavailable during rolling update (see
    # `updateStrategy.rollingUpdate.maxUnavailable` here: