}
                  ]
               },
               {
                  "matcher": {
                     "id": "byName",
                     "options": "type.googleapis.com/istio.workload.Address"
                  },
                  "properties": [
                     {
                        "id": "displayName",
                        "value": "Addresses"
                     }

)

// ServiceFilter is used to pass filter information into service based config writer print functions
type ServiceFilter struct {
	Namespace string
}

// Verify returns true if the passed workload matches the filter fields
func (wf *ServiceFilter) Verify(svc *ZtunnelService) bool {
	if wf.Namespace != "" {
		if !strings.EqualFold(svc.Namespace, wf.Namespace) {
			return false
		}
	}

	return true
}

                     "options": "destination_workload_var"
                  },
                  "properties": [
                     {
                        "id": "displayName",
                        "value": "Workload"
                     }
                  ]
               },
               {
                  "matcher": {
                     "id": "byName",
                     "options": "destination_service"

10.244.0.195:9080                                HEALTHY                  outbound|9080||reviews.default.svc.cluster.local
./var/run/secrets/workload-spiffe-uds/socket     HEALTHY                  sds-grpc
10.244.0.188:11800                               HEALTHY                  outbound|11800||skywalking-oap.skywalking.svc.cluster.local

> NOTE:  While MinIO does not implement an upper boundary on buckets, your cluster's hardware has natural limits that depend on the workload and its scaling patterns. We strongly recommend [MinIO SUBNET](https://min.io/pricing) for architecture and sizing guidance for your production use case.

## List of Amazon S3 API's not supported on MinIO

)

// PolicyFilter is used to pass filter information into service based config writer print functions
type PolicyFilter struct {
	Namespace string
}

// Verify returns true if the passed workload matches the filter fields
func (wf *PolicyFilter) Verify(pol *ZtunnelPolicy) bool {
	if wf.Namespace != "" {
		if !strings.EqualFold(pol.Namespace, wf.Namespace) {
			return false
		}
	}

	return true
}

}

// describePeerAuthentication fetches all PeerAuthentication in workload and root namespace.
// It lists the ones applied to the pod, and the current active mTLS mode.
// When the client doesn't have access to root namespace, it will only show workload namespace Peerauthentications.
func describePeerAuthentication(
	writer io.Writer,
	kubeClient kube.CLIClient,

	"istio.io/istio/istioctl/pkg/tag"
	"istio.io/istio/istioctl/pkg/util"
	"istio.io/istio/istioctl/pkg/validate"
	"istio.io/istio/istioctl/pkg/version"
	"istio.io/istio/istioctl/pkg/waypoint"
	"istio.io/istio/istioctl/pkg/workload"
	"istio.io/istio/istioctl/pkg/ztunnelconfig"
	"istio.io/istio/operator/cmd/mesh"
	"istio.io/istio/pkg/cmd"
	"istio.io/istio/pkg/collateral"
	"istio.io/istio/pkg/config/constants"
	"istio.io/istio/pkg/log"

# Ztunnel Lifecyle On Kubernetes

This document describes the lifecycle of various aspects of Ztunnel, and its relationship to workloads and the CNI, when running
as a Kubernetes DaemonSet.

At a high level, our goal is to provide complete connectivity to a workload throughout its entire lifetime.
Failing to do so can be an availability risk (if we deny traffic that should succeed) or a security risk (if we allow traffic that should be denied).

## High level overview

                    serviceAccount:
                      description: The service account associated with the workload
                        if a sidecar is present in the workload.
                      maxLength: 253
                      type: string
                    weight: