without presenting a client certificate. Therefore, it is absolutely critical that the waypoint proxy not assume any identity from incoming connections, even if the ztunnel is hairpinning. In other words, all traffic over TLS HBONE tunnels must be considered to be untrusted. From there, traffic is returned to the ztunnel (still over the TLS HBONE tunnel) and forwarded to the destination workload.

The following diagram illustrates the flow of unauthenticated traffic with a `PERMISSIVE` policy:...

	}

	return kubeconfig{
		Full:     string(fullYaml),
		Redacted: string(redacted),
	}, nil
}

// writeKubeConfigFile will rewrite/replace the kubeconfig used by the CNI plugin.
// We are the only consumers of this file and it resides in our owned rundir on the host node,
// so we are good to simply write it out if our watched svcacct token changes.
func writeKubeConfigFile(cfg *config.InstallConfig) error {

if "%unit%" == "k" goto kilo
if "%unit%" == "K" goto kilo
if "%unit%" == "m" goto mega
if "%unit%" == "M" goto mega
if "%unit%" == "g" goto giga
if "%unit%" == "G" goto giga

rem no unit found, must be bytes; consider the whole value
set conv=%value%
rem convert to KB
set /a conv=%conv% / 1024
:kilo
rem convert to MB
set /a conv=%conv% / 1024
goto mega
:giga
rem convert to MB
set /a conv=%conv% * 1024

import javax.annotation.CheckForNull;
import org.checkerframework.checker.nullness.qual.NonNull;
import org.checkerframework.checker.nullness.qual.Nullable;

/**
 * A strategy for determining whether two instances are considered equivalent, and for computing
 * hash codes in a manner consistent with that equivalence. Two examples of equivalences are the
 * {@linkplain #identity() identity equivalence} and the {@linkplain #equals "equals" equivalence}.
 *

 *       ImmutableMap.get} returns {@code @Nullable E} because the method can return {@code null}
 *       even on an {@code ImmutableMap<K, @NonNull String>}.
 * </ul>
 *
 * <p>Consumers of this annotation include:
 *
 * <ul>
 *   <li>Kotlin, for which it makes the type-variable usage (a) a Kotlin platform type when the type

 *       ImmutableMap.get} returns {@code @Nullable E} because the method can return {@code null}
 *       even on an {@code ImmutableMap<K, @NonNull String>}.
 * </ul>
 *
 * <p>Consumers of this annotation include:
 *
 * <ul>
 *   <li>Kotlin, for which it makes the type-variable usage (a) a Kotlin platform type when the type

 *       ImmutableMap.get} returns {@code @Nullable E} because the method can return {@code null}
 *       even on an {@code ImmutableMap<K, @NonNull String>}.
 * </ul>
 *
 * <p>Consumers of this annotation include:
 *
 * <ul>
 *   <li>Kotlin, for which it makes the type-variable usage (a) a Kotlin platform type when the type

 *       ImmutableMap.get} returns {@code @Nullable E} because the method can return {@code null}
 *       even on an {@code ImmutableMap<K, @NonNull String>}.
 * </ul>
 *
 * <p>Consumers of this annotation include:
 *
 * <ul>
 *   <li>Kotlin, for which it makes the type-variable usage (a) a Kotlin platform type when the type

 *       ImmutableMap.get} returns {@code @Nullable E} because the method can return {@code null}
 *       even on an {@code ImmutableMap<K, @NonNull String>}.
 * </ul>
 *
 * <p>Consumers of this annotation include:
 *
 * <ul>
 *   <li>Kotlin, for which it makes the type-variable usage (a) a Kotlin platform type when the type

 *       ImmutableMap.get} returns {@code @Nullable E} because the method can return {@code null}
 *       even on an {@code ImmutableMap<K, @NonNull String>}.
 * </ul>
 *
 * <p>Consumers of this annotation include:
 *
 * <ul>
 *   <li>Kotlin, for which it makes the type-variable usage (a) a Kotlin platform type when the type