// Multiple names sharing the index are managed by first-come
// first-served basis for consistency.
type ipv6ZoneCache struct {
	sync.RWMutex                // guard the following
	lastFetched  time.Time      // last time routing information was fetched
	toIndex      map[string]int // interface name to its index
	toName       map[int]string // interface index to its name
}

var zoneCache = ipv6ZoneCache{
	toIndex: make(map[string]int),

	SizeofICMPv6Filter      = C.sizeof_struct_icmp6_filter
	SizeofUcred             = C.sizeof_struct_ucred
	SizeofTCPInfo           = C.sizeof_struct_tcp_info
)

// Netlink routing and interface messages

const (
	IFA_UNSPEC          = C.IFA_UNSPEC
	IFA_ADDRESS         = C.IFA_ADDRESS
	IFA_LOCAL           = C.IFA_LOCAL
	IFA_LABEL           = C.IFA_LABEL

	// annotation.
	DeprecatedAnnotationTopologyAwareHints = "service.kubernetes.io/topology-aware-hints"

	// AnnotationTopologyMode can be used to enable or disable Topology Aware
	// Routing for a Service. Well known values are "Auto" and "Disabled".
	// Implementations may choose to develop new topology approaches, exposing
	// them with domain-prefixed values. For example, "example.com/lowest-rtt"

	// secretName is the name of the secret used to terminate TLS traffic on
	// port 443. Field is left optional to allow TLS routing based on SNI
	// hostname alone. If the SNI host in a listener conflicts with the "Host"
	// header field used by an IngressRule, the SNI host is used for termination
	// and value of the Host header is used for routing.
	// +optional
	SecretName string `json:"secretName,omitempty" protobuf:"bytes,2,opt,name=secretName"`

}

// EndpointHints provides hints describing how an endpoint should be consumed.
message EndpointHints {
  // forZones indicates the zone(s) this endpoint should be consumed by to
  // enable topology aware routing.
  // +listType=atomic
  repeated ForZone forZones = 1;
}

// EndpointPort represents a Port used by an EndpointSlice
// +structType=atomic
message EndpointPort {

## Traffic routing

Based on the three [redirection](#redirection) paths, the ztunnel has three primary types of traffic it handles.

### Outbound

Requests leaving a pod go through the "outbound" code path on port 15001.

			})
			lb := ListenerBuilder{node: proxy, push: cg.PushContext()}
			filters := lb.buildOutboundNetworkFilters(tt.routes, &model.Port{Port: 443},
				config.Meta{Name: "routing-config-for-example-com", Namespace: "not-default"}, false)

			tcpProxy := xdstest.ExtractTCPProxy(t, &listener.FilterChain{Filters: filters})
			if !reflect.DeepEqual(tcpProxy.IdleTimeout, tt.expected) {

instructions in the previous section.

First, set the following environment variables which are required for
controlling the number of Linux and Windows nodes in the cluster and for
enabling IP aliases (which are required for Windows pod routing). At least one
Linux worker node is required and two are recommended because many default
cluster-addons (e.g., `kube-dns`) need to run on Linux nodes. The master control
plane only runs on Linux.

```bash

In addition, there can be several *static* subroutes used to differentiate between different handlers of the same ID.
A subroute on a client must match a subroute on the server. So routes cannot be used for dynamic routing, unlike HTTP.

Handlers should remain backwards compatible. If a breaking API change is required, a new handler ID should be created.

## Setup & Configuration

				if util.GetEndpointHost(lbEp) != "" {
					lbEndpoints.append(ep.istioEndpoints[i], lbEp)
				}

				continue
			}
			// Cross-network traffic relies on mTLS to be enabled for SNI routing
			// TODO BTS may allow us to work around this
			if !isMtlsEnabled(lbEp) {
				continue
			}

			// Apply the weight for this endpoint to the network gateways.