expected:   sets.New("example.localhost."),
		},
	}

	nt := d.NameTable()
	nt = proto.Clone(nt).(*dnsProto.NameTable)
	d.BuildAlternateHosts(nt, func(althosts map[string]struct{}, ipv4 []netip.Addr, ipv6 []netip.Addr, _ []string) {
		for host := range althosts {
			if _, exists := nt.Table[host]; !exists {
				addresses := make([]string, 0, len(ipv4)+len(ipv6))
				for _, addr := range ipv4 {

            notIpBlocks: ["9.0.0.1", "9.2.0.0/16"]
            notRemoteIpBlocks: ["9.0.0.1", "9.2.0.0/16"]
      to:
        - operation:
            methods: ["method", "method-prefix-*", "*-suffix-method", "*"]
            hosts: ["exact.com", "*.suffix.com", "prefix.*", "*"]
            ports: ["80", "90"]
            paths: ["/exact", "/prefix/*", "*/suffix", "*", "/path/template/{*}", "/{**}/path/template"]

}

# signs a serving certificate: args are sudo, dest-dir, ca, filename (roughly), subject, hosts...
function kube::util::create_serving_certkey {
    local sudo=$1
    local dest_dir=$2
    local ca=$3
    local id=$4
    local cn=${5:-$4}
    local hosts=""
    local SEP=""
    shift 5
    while [ -n "${1:-}" ]; do
        hosts+="${SEP}\"$1\""
        SEP=","
        shift 1
    done

	if !globalIsDistErasure {
		// Only useful in distributed setups
		return nil, nil
	}

	hosts := endpoints.hostsSorted()
	remote = make([]*peerRESTClient, 0, len(hosts))
	all = make([]*peerRESTClient, len(hosts))
	for i, host := range hosts {
		if host == nil {
			continue
		}
		all[i] = newPeerRESTClient(host, endpoints.FindGridHostsFromPeer(host))

		}
	}

	return devices, nil
}

// shouldMountHostsFile checks if the nodes /etc/hosts should be mounted
// Kubernetes only mounts on /etc/hosts if:
// - container is not an infrastructure (pause) container
// - container is not already mounting on /etc/hosts
// Kubernetes will not mount /etc/hosts if:
// - when the Pod sandbox is being created, its IP is still unknown. Hence, PodIP will not have been set.

    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts: ["*"]
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: route
spec:
  gateways:
  - gateway
  hosts:
  - "*"
  http:
  - match:
    - uri:
        exact: /allowed
    route:
    - destination:

  - to:
    - operation:
        methods: ["method", "method-prefix-*", "*-suffix-method", "*"]
        notMethods: ["not-method", "not-method-prefix-*", "*-suffix-not-method", "*"]
  - to:
    - operation:
        hosts: ["exact.com", "*.suffix.com", "prefix.*", "*"]
        notHosts: ["not-exact.com", "*.not-suffix.com", "not-prefix.*", "*"]
  - to:
    - operation:
        ports: ["80", "90"]
        notPorts: ["800", "900"]
  - to:

			t.ConfigIstio().YAML(apps.Namespace.Name(), `apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: allow-cross-namespaces
spec:
  workloadSelector:
    labels:
      app: a
  egress:
  - hosts:
    - "*/*"`).ApplyOrFail(t)
			// create an echo instance in each revisioned namespace, all these echo
			// instances will be injected with proxies from their respective versions

### ufw

For hosts with ufw enabled (Debian based distros), you can use `ufw` command to allow traffic to specific ports. Use below command to allow access to port 9000

```sh
ufw allow 9000
```

Below command enables all incoming traffic to ports ranging from 9000 to 9010.

```sh
ufw allow 9000:9010/tcp
```

### firewall-cmd

platform blocks the port by default, you may need to enable access to the port. ### ufw For hosts with ufw enabled (Debian based distros), you can use `ufw` command to allow traffic to specific ports. Use below command to allow access to port 9000 ```sh ufw allow 9000 ``` Below command enables all incoming traffic to ports ranging from 9000 to 9010. ```sh ufw allow 9000:9010/tcp ``` ### firewall-cmd For hosts with firewall-cmd enabled (CentOS), you can use `firewall-cmd` command to allow traffic to...