// match, then routed to the backend associated with the matching IngressRuleValue.
message IngressRule {
  // host is the fully qualified domain name of a network host, as defined by RFC 3986.
  // Note the following deviations from the "host" part of the
  // URI as defined in RFC 3986:
  // 1. IPs are not allowed. Currently an IngressRuleValue can only apply to

```mermaid
graph TD;
src[src pod]-->|15008|ztunnel{ztunnel}
ztunnel-->|HBONE|dwp{"destination waypoint (all policy applied here)"}
dwp{destination waypoint}-->|15008|dztunnel{destination ztunnel}
dztunnel-->|host network|dst[dst pod]

// match, then routed to the backend associated with the matching IngressRuleValue.
message IngressRule {
  // host is the fully qualified domain name of a network host, as defined by RFC 3986.
  // Note the following deviations from the "host" part of the
  // URI as defined in RFC 3986:
  // 1. IPs are not allowed. Currently an IngressRuleValue can only apply to

  // endpoints is a list of unique endpoints in this slice. Each slice may
  // include a maximum of 1000 endpoints.
  // +listType=atomic
  repeated Endpoint endpoints = 2;

  // ports specifies the list of network ports exposed by each endpoint in
  // this slice. Each port must have a unique name. When ports is empty, it
  // indicates that there are no defined ports. When a port is defined with a

      "workloadName": "istiod-test",
      "workloadType": "deployment",
      "canonicalName": "istiod",
      "canonicalRevision": "latest",
      "network": "network2",
      "node": "ambient-worker",
      "status": "Healthy",
      "clusterId": "Kubernetes"
    },
    "network3/10.244.1.39": {
      "workloadIps": [
        "10.244.1.39"
      ],
      "waypoint": {
        "destination": "/10.96.65.117",

		grep -Pv 'envoy/extensions/transport_sockets/tls/' |\
		grep -Pv 'envoy/service/discovery/v3' |\
		grep -Pv 'envoy/extensions/wasm/' |\
		grep -Pv 'envoy/extensions/filters/(http|network)/wasm/' |\
		grep -Pv 'istio\.io/api/(annotation|label|mcp|mesh|networking|security/v1alpha1|type)' |\
		(! grep -P '^k8s.io|^sigs.k8s.io/gateway-api|cel|antlr|jwx/jwk|envoy/|istio.io/api')

go-gen:
	@mkdir -p /tmp/bin

Jonh Wendell <******@****.***> 1694535031 -0400

	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"strings"
	"sync"
	"time"

	"istio.io/istio/cni/pkg/constants"
	"istio.io/istio/pkg/log"
	"istio.io/istio/pkg/network"
	"istio.io/istio/pkg/uds"
)

var pluginLog = log.RegisterScope("cni", "CNI network plugin")

type UDSLogger struct {
	mu            sync.Mutex
	loggingServer *http.Server
}

type cniLog struct {
	Level string    `json:"level"`

    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "Cni"
data:
  # The CNI network configuration to add to the plugin chain on each node.  The special
  # values in this config will be automatically populated.
  cni_network_config: |-
        {
          "cniVersion": "0.3.1",
          "name": "istio-cni",
          "type": "istio-cni",

        fieldRef:
          fieldPath: spec.nodeName
    - name: ISTIO_META_INTERCEPTION_MODE
      value: "{{ .ProxyConfig.InterceptionMode.String }}"
    {{- if .Values.global.network }}
    - name: ISTIO_META_NETWORK
      value: "{{ .Values.global.network }}"
    {{- end }}
    {{- if .DeploymentMeta.Name }}
    - name: ISTIO_META_WORKLOAD_NAME
      value: "{{ .DeploymentMeta.Name }}"
    {{ end }}