if err != nil {
					return err
				}
				ztunnelPod := ambientutil.IsZtunnelPod(kubeClient, podName, ns)
				if !ztunnelPod {
					return fmt.Errorf("workloads command is only supported by Ztunnel proxies: %v", podName)
				}
				podNames = []string{podName}
				podNamespace = ns
			} else {
				var err error
				podNames, podNamespace, err = ctx.InferPodsFromTypedResource("daemonset/ztunnel", ctx.IstioNamespace())

            LocalRepositoryManager llm =
                    system.newLocalRepositoryManager(rsession, new LocalRepository(localRepository));
            rsession.setLocalRepositoryManager(llm);
            // active proxies
            // TODO
            // active profiles

            //        DefaultSession defaultSession = new DefaultSession(
            //                rsession,
            //                system,

## Version 5.0.0-alpha.8

_2022-06-08_

 *  Fix: Change how `H2_PRIOR_KNOWLEDGE` works with HTTP proxies. Previously OkHttp assumed the
    proxy itself was a prior knowledge HTTP/2 server. With this update, OkHttp attempts a `CONNECT`
    tunnel just as it would with HTTPS. For prior knowledge with proxies OkHttp's is now consistent
    with these curl arguments:

    ```
    curl \
      --http2-prior-knowledge \

         "type": "timeseries"
      },
      {
         "datasource": {
            "type": "datasource",
            "uid": "-- Mixed --"
         },
         "description": "Count of active and pending proxies managed by each instance.\nPending is expected to converge to zero.\n",
         "gridPos": {
            "h": 10,
            "w": 8,
            "x": 8,
            "y": 14
         },
         "id": 13,

        for (Server server : settings.getServers()) {
            request.addServer(new org.apache.maven.settings.Server(server));
        }

        //  <proxies>
        //    <proxy>
        //      <active>true</active>
        //      <protocol>http</protocol>
        //      <host>proxy.somewhere.com</host>
        //      <port>8080</port>

    that can monitor, rewrite, and retry calls. The [interceptors doc][interceptors] is a full
    introduction to this new API.

 *  New: APIs to iterate and selectively clear the response cache.
 *  New: Support for SOCKS proxies.
 *  New: Support for `TLS_FALLBACK_SCSV`.
 *  New: Update HTTP/2 support to `h2-16` and `hpack-10`.
 *  New: APIs to prevent retrying non-idempotent requests.
 *  Fix: Drop NPN support. Going forward we support ALPN only.

			}
			// Iterate all the pod.
			for _, pod := range list.Items {
				touchedPods++
				if options.XdsViaAgentsLimit != 0 && touchedPods > options.XdsViaAgentsLimit {
					fmt.Fprintf(options.MessageWriter, "Some proxies may be missing from the list"+
						" because the number of visited pod hits the limit %d,"+
						" which can be set by `--xds-via-agents-limit` flag.\n", options.XdsViaAgentsLimit)
					break GetProxyLoop
				}

                .localRepository(localRepo != null ? localRepo.getAbsolutePath() : null)
                .interactiveMode(request.isInteractiveMode())
                .offline(request.isOffline())
                .proxies(request.getProxies().stream().map(Proxy::getDelegate).collect(Collectors.toList()))
                .servers(request.getServers().stream().map(Server::getDelegate).collect(Collectors.toList()))

   */
  @Test
  fun connectTimeoutsAttemptsAlternateRoute() {
    val proxySelector = RecordingProxySelector()
    proxySelector.proxies.add(Proxy(Proxy.Type.HTTP, TestUtil.UNREACHABLE_ADDRESS_IPV4))
    proxySelector.proxies.add(server.toProxyAddress())
    server.enqueue(MockResponse(body = "success!"))
    client =
      client.newBuilder()
        .proxySelector(proxySelector)

## Proxy Configuration

Istiod's primary role - and most code - is to dynamically configure proxies (Envoy sidecars and ingress, gRPC, ztunnel, and more). This roughly consists of 3 parts:
1. Config ingestion (inputs to the system)
1. Config translation
1. Config serving (XDS)

### Config Ingestion