axc("Auto Export Controller")

    mcfg("Mesh Config")
    dfc("Default Revision Controller")
```

As you can see, the landscape of controllers is pretty extensive at this point.

[Service Discovery](#ServiceDiscovery) and [Config Store](#ConfigStore) were already discussed above, so do not need more explanation here.

#### Mesh Config

defaultConfig:
  discoveryAddress: istiod-rev-1.istio-system.svc:15012
  proxyMetadata:
    CANONICAL_REVISION: latest
    CANONICAL_SERVICE: foo
    CLUSTER_MESH_CONFIG_VALUE: foo
    ISTIO_META_CLUSTER_ID: Kubernetes
    ISTIO_META_DNS_CAPTURE: "true"
    ISTIO_META_MESH_ID: ""
    ISTIO_META_NETWORK: ""
    ISTIO_META_WORKLOAD_NAME: foo
    ISTIO_METAJSON_LABELS: '{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'

defaultConfig:
  discoveryAddress: istiod-rev-1.istio-system.svc:15012
  proxyMetadata:
    CANONICAL_REVISION: latest
    CANONICAL_SERVICE: foo
    CLUSTER_MESH_CONFIG_VALUE: foo
    ISTIO_META_CLUSTER_ID: Kubernetes
    ISTIO_META_DNS_CAPTURE: "true"
    ISTIO_META_MESH_ID: ""
    ISTIO_META_NETWORK: ""
    ISTIO_META_WORKLOAD_NAME: foo
    ISTIO_METAJSON_LABELS: '{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'

defaultConfig:
  proxyMetadata:
    CANONICAL_REVISION: latest
    CANONICAL_SERVICE: foo
    ISTIO_META_CLUSTER_ID: Kubernetes
    ISTIO_META_DNS_CAPTURE: "true"
    ISTIO_META_MESH_ID: ""
    ISTIO_META_NETWORK: ""
    ISTIO_META_WORKLOAD_NAME: foo
    ISTIO_METAJSON_LABELS: '{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'
    POD_NAMESPACE: bar
    SERVICE_ACCOUNT: vm-serviceaccount
    TRUST_DOMAIN: ""

ISTIO_LOCAL_EXCLUDE_PORTS='22,15090,15021,15020'
ISTIO_METAJSON_LABELS='{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'
ISTIO_META_CLUSTER_ID='Kubernetes'
ISTIO_META_DNS_CAPTURE='true'
ISTIO_META_MESH_ID=''
ISTIO_META_NETWORK=''
ISTIO_META_WORKLOAD_NAME='foo'
ISTIO_NAMESPACE='bar'
ISTIO_SERVICE='foo.bar'
ISTIO_SERVICE_CIDR='*'
ISTIO_SVC_IP='10.10.10.10'
POD_NAMESPACE='bar'
SERVICE_ACCOUNT='vm-serviceaccount'

- watches k8s resource for existing pods, so that pods that have already been started can be moved in or out of the ambient mesh.
- sends UDS events to ztunnel via a socket whenever a pod is enabled for ambient mesh (whether from CNI plugin or node watcher), instructing ztunnel to create the "tube" socket.

To avoid this, the project attempts to minimize additions to the `values.yaml` API where possible.

If the change is a dynamic runtime configuration, it probably belongs in the [MeshConfig API](https://github.com/istio/api/blob/master/mesh/v1alpha1/config.proto).
This allows configuration without re-installing or restarting deployments.

*   `tf.experimental.dtensor`

    *   Deprecated `dtensor.run_on` in favor of `dtensor.default_mesh` to correctly indicate that the context does not override the mesh that the ops and functions will run on, it only sets a fallback default mesh.

As ztunnel aims to transparently encrypt and route users traffic, we need a mechanism to capture all traffic entering and leaving "mesh" pods.
This is a security critical task: if the ztunnel can be bypassed, authorization policies can be bypassed.

Redirection must meet these requirements:
* All traffic *egressing* a pod in the mesh should be redirected to the node-local ztunnel on port 15001.

CANONICAL_SERVICE='foo'
CA_ADDR='istiod-rev-1.istio-system.svc:15012'
CLUSTER_MESH_CONFIG_VALUE='foo'
ISTIO_INBOUND_PORTS='*'
ISTIO_LOCAL_EXCLUDE_PORTS='22,15090,15021,15020'
ISTIO_METAJSON_LABELS='{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'
ISTIO_META_CLUSTER_ID='Kubernetes'
ISTIO_META_DNS_CAPTURE='true'
ISTIO_META_MESH_ID=''
ISTIO_META_NETWORK=''
ISTIO_META_WORKLOAD_NAME='foo'
ISTIO_NAMESPACE='bar'