releaseNotes:
- |
  **Updated** Prometheus telemetry behavior for inbound traffic to disable host header fallback by default. This will
  prevent traffic coming from out-of-mesh locations from potential polluting the `destination_service` dimension in
  metrics with junk data (and exploding metrics cardinality). With this change, it is possible that users relying on
  host headers for labeling the destination service for inbound traffic from out-of-mesh workloads will see that traffic

		}
	}()

	// Data inbound to the handler
	var handlerIn chan []byte
	if inboundCap > 0 {
		m.inbound = make(chan []byte, inboundCap)
		handlerIn = make(chan []byte, 1)
		go func(inbound chan []byte) {
			wg.Wait()
			defer xioutil.SafeClose(handlerIn)
			m.handleInbound(c, inbound, handlerIn)
		}(m.inbound)
	}
	// Fill outbound block.

      "type": 4,
      "connect_timeout": 1000000000,
      "lb_policy": 4,
      "LbConfig": null
    },
    "inbound|7070|tcplocal|s1tcp.none": {
      "name": "inbound|7070|tcplocal|s1tcp.none",
      "connect_timeout": 1000000000,
      "load_assignment": {
        "cluster_name": "inbound|7070|tcplocal|s1tcp.none",
        "endpoints": [
          {
            "lb_endpoints": [
              {

				{
					Name:   "tls on tls port",
					Call:   mkCall(8080, simulation.MTLS),
					Result: simulation.Result{ClusterMatched: "inbound|8080||"},
				},
				{
					Name:   "plaintext on plaintext port",
					Call:   mkCall(9090, simulation.Plaintext),
					Result: simulation.Result{ClusterMatched: "inbound|9090||"},
				},
				{
					Name: "tls on plaintext port",
					Call: mkCall(9090, simulation.MTLS),

			clusters: map[string][]string{
				"inbound|8080||": nil,
				"inbound|8081||": nil,
				"inbound|8082||": nil,
				"inbound|8083||": nil,
			},
			telemetry: map[string][]string{
				"inbound|8080||": {string(service.Hostname)},
				"inbound|8081||": {string(service.Hostname)},
				"inbound|8082||": {string(serviceAlt.Hostname)},
				"inbound|8083||": {string(serviceAlt.Hostname)},
			},
		},
		{

John Howard <******@****.***> 1612368962 -0800

ECDS NAME                                                     TYPE
istio.io/telemetry/stats/prometheus/sidecar/Inbound/HTTP      
istio.io/telemetry/stats/prometheus/sidecar/Inbound/TCP       
istio.io/telemetry/stats/prometheus/sidecar/Outbound/HTTP     
istio.io/telemetry/stats/prometheus/sidecar/Outbound/TCP      
default.display-metadata                                      envoy.extensions.filters.http.wasm.v3.Wasm

            "name": "inbound-vip|8000|http|httpbin.default.svc.cluster.local",
            "type": "EDS",
            "eds_cluster_config": {
              "eds_config": {
                "ads": {},
                "initial_fetch_timeout": "0s",
                "resource_api_version": "V3"
              },
              "service_name": "inbound-vip|8000|http|httpbin.default.svc.cluster.local"
            },

	flag.BindEnv(fs, constants.LocalExcludePorts, "d",
		"Comma separated list of inbound ports to be excluded from redirection to Envoy (optional). "+
			"Only applies when all inbound traffic (i.e. \"*\") is being redirected.",
		&cfg.InboundPortsExclude)

	flag.BindEnv(fs, constants.ExcludeInterfaces, "c",
		"Comma separated list of NIC (optional). Neither inbound nor outbound traffic will be captured.",
		&cfg.ExcludeInterfaces)

	ISTIOINREDIRECT = "ISTIO_IN_REDIRECT"
)

// Constants used in cobra/viper CLI
const (
	InboundInterceptionMode   = "istio-inbound-interception-mode"
	InboundTProxyMark         = "istio-inbound-tproxy-mark"
	InboundTProxyRouteTable   = "istio-inbound-tproxy-route-table"
	InboundPorts              = "istio-inbound-ports"
	LocalExcludePorts         = "istio-local-exclude-ports"
	ExcludeInterfaces         = "istio-exclude-interfaces"