// +listType=set
  // Required.
  repeated string apiGroups = 2;

  // `resources` is a list of matching resources (i.e., lowercase
  // and plural) with, if desired, subresource.  For example, [
  // "services", "nodes/status" ].  This list may not be empty.
  // "*" matches all resources and, if present, must be the only entry.
  // Required.
  // +listType=set
  repeated string resources = 3;

  // +listType=set
  // Required.
  repeated string apiGroups = 2;

  // `resources` is a list of matching resources (i.e., lowercase
  // and plural) with, if desired, subresource.  For example, [
  // "services", "nodes/status" ].  This list may not be empty.
  // "*" matches all resources and, if present, must be the only entry.
  // Required.
  // +listType=set
  repeated string resources = 3;

}

function cidr_to_ips() {
    CIDR="$1"
    # cidr_to_ips returns a list of single IPs from a CIDR. We skip 1000 (since they are likely to be allocated
    # already to other services), then pick the next 100.
    python3 - <<EOF
from ipaddress import ip_network, IPv6Network;
from itertools import islice;

net = ip_network('$CIDR')
net_bits = 128 if type(net) == IPv6Network else 32;

of resources utilization under steady load.\n\n- **vCPU / 1k rps:** shows vCPU utilization by the main Istio components normalized by 1000 requests/second. When idle or low traffic, this chart will be blank. The curve for istio-proxy refers to the services sidecars only.\n- **vCPU:** vCPU utilization by Istio components, not normalized.\n- **Memory:** memory footprint for the components. Telemetry and policy are normalized by 1k rps, and no data is shown  when there is no traffic. For ingress and istio-proxy,...

OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

// via the nodeIP
// - kubelet (node-local healthchecks, which we do not capture)
// - kube-proxy (fowarded/proxied traffic from LoadBalancer-backed services, potentially with public IPs, which we must capture)
func (cfg *IptablesConfigurator) CreateHostRulesForHealthChecks(hostSNATIP, hostSNATIPV6 *netip.Addr) error {
	// Append our rules here

      "canonicalName": "bookinfo-productpage-istio-waypoint",
      "canonicalRevision": "latest",
      "node": "ambient-worker2",
      "status": "Healthy",
      "clusterId": "Kubernetes"
    }
  },
  "services": {
    "/10.96.65.117": {
      "name": "namespace-istio-waypoint",
      "namespace": "bookinfo",
      "hostname": "namespace-istio-waypoint.bookinfo.svc.cluster.local",
      "vips": [
        "/10.96.65.117"

    configMap: false
    # Additional labels to apply on the pod level for monitoring and logging configuration.
    podLabels: {}
    # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
    ipFamilyPolicy: ""
    ipFamilies: []
  sidecarInjectorWebhook:
    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or

                }
              ]
            },
            "metadata": {
              "filter_metadata": {
                "istio": {
                  "default_original_port": 9080,
                  "services": [
                    {
                      "host": "productpage.default.svc.cluster.local",
                      "namespace": "default",
                      "name": "productpage"
                    }