cluster/prometheus_stats                                            cluster/prometheus_stats              -        -          -               STATIC     

NAME                   ADDRESSES PORT  MATCH DESTINATION
listener/main_internal           0     ALL   Cluster: inbound-vip|8100|http|httpbin.default.svc.cluster.local

		}
		return cmp.Compare(a.Hostname, b.Hostname)
	})
	fmt.Fprintln(w, "NAMESPACE\tSERVICE NAME\tSERVICE VIP\tWAYPOINT")

	for _, svc := range svcs {
		var ip string
		if len(svc.Addresses) > 0 {
			_, ip, _ = strings.Cut(svc.Addresses[0], "/")
		}
		waypoint := serviceWaypointName(svc, zDump.Services)
		fmt.Fprintf(w, "%v\t%v\t%v\t%v\n",
			svc.Namespace, svc.Name, ip, waypoint)
	}
	return w.Flush()
}

// IPAddress represents a single IP of a single IP Family. The object is designed to be used by APIs
// that operate on IP addresses. The object is used by the Service core API for allocation of IP addresses.
// An IP address can be represented in different formats, to guarantee the uniqueness of the IP,
// the name of the object is the IP address in canonical format, four decimal digits separated

  }

  /** No SNI for literal IPv6 addresses. */
  @Test
  fun ipv6() {
    val recordedRequest = requestToHostnameViaProxy("2607:f8b0:400b:804::200e")
    assertThat(recordedRequest.requestUrl!!.host).isEqualTo("2607:f8b0:400b:804::200e")
    assertThat(recordedRequest.handshakeServerNames).isEmpty()
  }

  /** No SNI for literal IPv4 addresses. */
  @Test
  fun ipv4() {

With this in mind, Ztunnel supports two xDS resources: `Address` and `Authorization`.

### Address Type

The primary configuration consumed by Ztunnel is the [`Address` resource](../../pkg/workloadapi/workload.proto).
As the name suggests, an `Address` represents a particular IP Address.
This can be a `Service` or a `Workload`.

The address type has the following goals:

  {{- else }}
  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
  {{- end }}
  namespace: {{ .Release.Namespace }}
subsets:
- addresses:
  - ip: {{ .Values.global.remotePilotAddress }}
  ports:
  - port: 15012
    name: tcp-istiod
    protocol: TCP
  - port: 15017
    name: tcp-webhook
    protocol: TCP
---

    rather than the duration specified in the response's cache-control header.
 *  Fix: Verify certificate IP addresses in canonical form. When a server presents a TLS certificate
    containing an IP address we must match that address against the URL's IP address, even when the
    two addresses are encoded differently, such as `192.168.1.1` and `0::0:0:FFFF:C0A8:101`. Note

  {{- else }}
  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
  {{- end }}
  namespace: {{ .Release.Namespace }}
subsets:
- addresses:
  - ip: {{ .Values.global.remotePilotAddress }}
  ports:
  - port: 15012
    name: tcp-istiod
    protocol: TCP
  - port: 15017
    name: tcp-webhook
    protocol: TCP
---

      type: boolean
    - jsonPath: .spec.avoidBuggyIPs
      name: Avoid Buggy IPs
      type: boolean
    - jsonPath: .spec.addresses
      name: Addresses
      type: string
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: IPAddressPool represents a pool of IP addresses that can be allocated
          to LoadBalancer services.
        properties:
          apiVersion:

`<Address for MinIO Service>/minio/v2/metrics/cluster`.

The additional node specific metrics which include additional go metrics or process metrics are exposed at
`<Address for MinIO Node>/minio/v2/metrics/node`.