// UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods
  // should be considered for eviction. Current implementation considers healthy pods,
  // as pods that have status.conditions item with type="Ready",status="True".
  //
  // Valid policies are IfHealthyBudget and AlwaysAllow.
  // If no policy is specified, the default behavior will be used,
  // which corresponds to the IfHealthyBudget policy.
  //

            privileged: false
            readOnlyRootFilesystem: true
        {{- end }}
          readinessProbe:
            failureThreshold: 30
            httpGet:
              path: /healthz/ready
              port: 15021
              scheme: HTTP
            initialDelaySeconds: 1
            periodSeconds: 2
            successThreshold: 1
            timeoutSeconds: 1
          resources:

                                http1MaxPendingRequests:
                                  description: Maximum number of requests that will
                                    be queued while waiting for a ready connection
                                    pool connection.
                                  format: int32
                                  type: integer
                                http2MaxRequests:

{{- if .Values.global.remotePilotAddress }} apiVersion: v1 kind: Service metadata: {{- if .Values.pilot.enabled }} # when local istiod is enabled, we can't use istiod service name to reach the remote control plane name: istiod-remote {{- else }} # when local istiod isn't enabled, we can use istiod service name to reach the remote control plane name: istiod {{- end }} namespace: {{ .Release.Namespace }} spec: ports: - port: 15012 name: tcp-istiod protocol: TCP - port: 443 targetPort: 15017 name: tcp-webhook...

If it is allowed, we will forward to the target destination.

#### Hairpin

In the case that the destination has a waypoint, that waypoint must have been bypassed to reach the inbound passthrough codepath.
How we handle this is [under discussion](https://docs.google.com/document/d/1uM1c3zzoehiijh1ZpZuJ1-SzuVVupenv8r5yuCaFshs/edit#heading=h.dwbqvwmg6ud3).

### Inbound

// or '#'.
message HTTPIngressRuleValue {
  // paths is a collection of paths that map requests to backends.
  repeated HTTPIngressPath paths = 1;
}

// Ingress is a collection of rules that allow inbound connections to reach the
// endpoints defined by a backend. An Ingress can be configured to give services
// externally-reachable urls, load balance traffic, terminate SSL, offer name
// based virtual hosting etc.
message Ingress {

## Interaction with controller

The controller shares the same API as the operator CLI, so it's possible to install any of the above examples as a CR
in the cluster in the istio-system namespace and the controller will react to it with the same outcome as running
`istioctl install -f <path-to-custom-resource-file>`.

## Architecture

  // Except values will be rejected if they are outside the cidr range
  // +optional
  repeated string except = 2;
}

// Ingress is a collection of rules that allow inbound connections to reach the
// endpoints defined by a backend. An Ingress can be configured to give services
// externally-reachable urls, load balance traffic, terminate SSL, offer name
// based virtual hosting etc.
message Ingress {

              "name": "backend",
              "domains": [
               "*"
              ],
              "routes": [
               {
                "match": {
                 "prefix": "/healthz/ready"
                },
                "route": {
                 "cluster": "agent"
                }
               }
              ]
             }
            ]
           },
           "http_filters": [

  // Service has set the publishNotReadyAddresses flag.
  // +optional
  optional bool ready = 1;

  // serving is identical to ready except that it is set regardless of the
  // terminating state of endpoints. This condition should be set to true for
  // a ready endpoint that is terminating. If nil, consumers should defer to
  // the ready condition.
  // +optional
  optional bool serving = 2;