If it is allowed, we will forward to the target destination.

#### Hairpin

In the case that the destination has a waypoint, that waypoint must have been bypassed to reach the inbound passthrough codepath.
How we handle this is [under discussion](https://docs.google.com/document/d/1uM1c3zzoehiijh1ZpZuJ1-SzuVVupenv8r5yuCaFshs/edit#heading=h.dwbqvwmg6ud3).

### Inbound

  // Except values will be rejected if they are outside the cidr range
  // +optional
  repeated string except = 2;
}

// Ingress is a collection of rules that allow inbound connections to reach the
// endpoints defined by a backend. An Ingress can be configured to give services
// externally-reachable urls, load balance traffic, terminate SSL, offer name
// based virtual hosting etc.
message Ingress {

  // probably is the storage version.
  // +optional
  optional GroupVersionForDiscovery preferredVersion = 3;

  // a map of client CIDR to server address that is serving this group.
  // This is to help clients reach servers in the most network-efficient way possible.
  // Clients can use the appropriate server address as per the CIDR that they match.
  // In case of multiple matches, clients should use the longest matching CIDR.

  // Except values will be rejected if they are outside the CIDR range
  // +optional
  repeated string except = 2;
}

// Ingress is a collection of rules that allow inbound connections to reach the
// endpoints defined by a backend. An Ingress can be configured to give services
// externally-reachable urls, load balance traffic, terminate SSL, offer name
// based virtual hosting etc.

	//
	// Types that are assignable to Destination:
	//
	//	*GatewayAddress_Hostname
	//	*GatewayAddress_Address
	Destination isGatewayAddress_Destination `protobuf_oneof:"destination"`
	// port to reach the gateway at for mTLS HBONE connections
	HboneMtlsPort uint32 `protobuf:"varint,3,opt,name=hbone_mtls_port,json=hboneMtlsPort,proto3" json:"hbone_mtls_port,omitempty"`
}

func (x *GatewayAddress) Reset() {

	}).GetMatches(to)
}

// ReachableDestinations filters out known-unreachable destinations given a source.
// - from a naked pod, we can't reach cross-network endpoints or VMs
// - we can't reach cross-cluster headless endpoints
// - from an injected Pod, only non-naked cross-network endpoints are reachable

										// on where we call service B from, we'll reach a different set of endpoints.
										// If we're calling from exportCluster, it will be the same as cluster-local
										// (i.e. we'll only reach endpoints in exportCluster). From all other clusters,
										// we should reach endpoints in that cluster AND exportCluster.
										expectedClusters = cluster.Clusters{exportCluster}

						isAnnotationMatch = true
						break
					}
				}
			}
			if !isAnnotationMatch {
				continue
			}
		}
		// If we reach here, it means that all include entries are matched.
		return false
	}
	// If we reach here, it means that no include entries are matched.
	return true
}

func shouldSkipDeployment(deployment string, config *config2.BugReportConfig) bool {

  if [[ "${running}" != 'true' ]]; then
      docker run \
        -d --restart=always -p "${KIND_REGISTRY_PORT}:5000" --name "${KIND_REGISTRY_NAME}" \
        gcr.io/istio-testing/registry:2

    # Allow kind nodes to reach the registry
    docker network connect "kind" "${KIND_REGISTRY_NAME}"
  fi

  # https://docs.tilt.dev/choosing_clusters.html#discovering-the-registry
  for cluster in $(kind get clusters); do

    code: IST0163
    level: Warning
    description: "Address for the ingress gateway on the external control plane is not valid"
    template: "The hostname (%s) that was provided for the webhook (%s) to reach the ingress gateway on the external control plane cluster %s. Traffic may not flow properly."
    args:
      - name: hostname
        type: string
      - name: webhook
        type: string
      - name: msg