}
              }
            }]
          }]
        }
      },
      {
        "name": "xds-grpc",
        "type" : "STATIC",
        "connect_timeout": "1s",
        "lb_policy": "ROUND_ROBIN",
        "load_assignment": {
          "cluster_name": "xds-grpc",
          "endpoints": [{
            "lb_endpoints": [{
              "endpoint": {
                "address":{

	ProxyNeedsPush func(proxy *model.Proxy, req *model.PushRequest) bool

	// concurrentPushLimit is a semaphore that limits the amount of concurrent XDS pushes.
	concurrentPushLimit chan struct{}
	// RequestRateLimit limits the number of new XDS requests allowed. This helps prevent thundering hurd of incoming requests.
	RequestRateLimit *rate.Limiter

				return nil, model.DefaultXdsLogDetails, nil
			}
			// Inserts Wasm pull secrets in ECDS response, which will be used at xds proxy for image pull.
			// Before forwarding to Envoy, xds proxy will remove the secret from ECDS response.
			secrets = e.GeneratePullSecrets(proxy, wasmSecrets, secretController)
		}
	}

                istio_dns_requests_total{%(podLabels)s}
              [$__rate_interval])
            )
          |||
        ),

      ztunnelXdsConnections:
        self.query(
          'XDS Connection Terminations ({{pod}})',
          |||
            sum by (pod) (
              rate(
                istio_xds_connection_terminations_total{%(podLabels)s}
              [$__rate_interval])
            )

	XDSAuth = env.Register("XDS_AUTH", true,
		"If true, will authenticate XDS clients.").Get()

	EnableXDSIdentityCheck = env.Register(
		"PILOT_ENABLE_XDS_IDENTITY_CHECK",
		true,
		"If enabled, pilot will authorize XDS clients, to ensure they are acting only as namespaces they have permissions for.",
	).Get()

	// TODO: Move this to proper API.

	"istio.io/istio/pilot/pkg/features"
	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pilot/pkg/status/distribution"
	"istio.io/istio/pilot/pkg/xds"
	v3 "istio.io/istio/pilot/pkg/xds/v3"
	xdsfake "istio.io/istio/pilot/test/xds"
	"istio.io/istio/pilot/test/xdstest"
	"istio.io/istio/pkg/adsc"
	"istio.io/istio/pkg/config"
	"istio.io/istio/pkg/config/host"
	"istio.io/istio/pkg/config/protocol"

## PeerAuthentication and ztunnel

	"fmt"
	"io"
	"strings"
	"time"

	"go.uber.org/atomic"
	"google.golang.org/grpc"
	"google.golang.org/grpc/credentials"
	"google.golang.org/grpc/credentials/insecure"
	xdscreds "google.golang.org/grpc/credentials/xds"

	"istio.io/istio/pkg/test/echo/common"
	"istio.io/istio/pkg/test/echo/proto"
)

var _ io.Closer = &Client{}

// Client of an Echo server that simplifies request/response processing for Forward commands.

//go:generate sh -c "echo '// limitations under the License.\n' >> filter_types.gen.go"
//go:generate sh -c "echo '// Code generated by filter_types.go. DO NOT EDIT.\n' >> filter_types.gen.go"
//go:generate sh -c "echo 'package xds\n\nimport (' >> filter_types.gen.go"
//go:generate sh -c "go list github.com/envoyproxy/go-control-plane/... | grep 'v3' | grep -v /pkg/ | xargs -I{} echo '\t_ \"{}\"' >> filter_types.gen.go"

		"xds_cache_reads",
		"Total number of xds cache xdsCacheReads.",
		monitoring.WithEnabled(enableStats),
	)

	xdsCacheEvictions = monitoring.NewSum(
		"xds_cache_evictions",
		"Total number of xds cache evictions.",
		monitoring.WithEnabled(enableStats),
	)

	xdsCacheSize = monitoring.NewGauge(
		"xds_cache_size",
		"Current size of xds cache",
		monitoring.WithEnabled(enableStats),
	)