metadata:
  annotations: {}
  labels: {}
  name: ztunnel
  namespace: istio-system
spec:
  selector:
    matchLabels:
      app: ztunnel
  template:
    metadata:
      annotations:
        ambient.istio.io/redirection: disabled
        cni.projectcalico.org/allowedSourcePrefixes: '["0.0.0.0/0"]'
        prometheus.io/port: "15020"
        prometheus.io/scrape: "true"
        sidecar.istio.io/inject: "false"
      labels:

## Redirection

As ztunnel aims to transparently encrypt and route users traffic, we need a mechanism to capture all traffic entering and leaving "mesh" pods.
This is a security critical task: if the ztunnel can be bypassed, authorization policies can be bypassed.

Redirection must meet these requirements:

    provider: "default"

    # Configure ambient settings
    ambient:
      # If enabled, ambient redirection will be enabled
      enabled: false
      # Set ambient config dir path: defaults to /etc/ambient-config
      configDir: ""
      # If enabled, and ambient is enabled, DNS redirection will be enabled
      dnsCapture: false
      # UNSTABLE: If enabled, and ambient is enabled, enables ipv6 support

# limitations under the License.

# This script runs all *_test.go files. It is equivalent to `make test`.
# Usage: `hack/test-go.sh` or `make test`.
# Note: This script is a vestigial redirection. Please do not add "real" logic.

set -o errexit
set -o nounset
set -o pipefail

KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..

# For help output
ARGHELP=""
if [[ "$#" -gt 0 ]]; then

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# This script is a vestigial redirection.  Please do not add "real" logic.
# The "true" target of this makerule is `hack/make-rules/update.sh`.
# We should run `hack/update-all.sh` if anything fails after
# running `hack/verify-all.sh`. It is equivalent to `make update`.

// tag::maven-repo-with-ignore-gradle-metadata-redirection[]
repositories {
    maven {
        url "http://repo.mycompany.com/repo"
        metadataSources {
            mavenPom()
            artifact()
            ignoreGradleMetadataRedirection()
        }
    }
}
// end::maven-repo-with-ignore-gradle-metadata-redirection[]

// tag::authenticated-ivy-repo[]
repositories {
    ivy {

# `hack/verify-all.sh` before submit a PR. It is equivalent to `make verify`.
# Usage: `hack/verify-all.sh` or `make verify`.
# Note: This script is a vestigial redirection. Please do not add "real" logic.

set -o errexit
set -o nounset
set -o pipefail

KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..

# For help output
ARGHELP=""
if [[ -n "${KUBE_VERIFY_GIT_BRANCH:-}" ]]; then

         * If the Ivy file contains a marker telling that Gradle metadata exists
         * for this component, Gradle will <i>also</i> look for the Gradle metadata
         * file. Gradle module metadata redirection will not happen if {@code ignoreGradleMetadataRedirection()} has been used.
         */
        void ivyDescriptor();

        /**
         * Indicates that this repository may not contain metadata files,

                break;
        }
        System.setProperty("org.slf4j.simpleLogger.defaultLogLevel", value);
    }

    @Override
    public void activate() {
        // property for root logger level or System.out redirection need to be taken into account
        MavenSlf4jSimpleFriend.init();
    }

  # has no effect on outbound traffic: iptables REDIRECT is always used for
  # outbound connections.
  # If "REDIRECT", use iptables REDIRECT to NAT and redirect to Envoy.
  # The "REDIRECT" mode loses source addresses during redirection.
  # If "TPROXY", use iptables TPROXY to redirect to Envoy.
  # The "TPROXY" mode preserves both the source and destination IP
  # addresses and ports, so that they can be used for advanced filtering
  # and manipulation.