flavor: kubernetes allowExternal: true # only when using flavor: cilium egressEntities: - kube-apiserver ## PodDisruptionBudget settings ## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ ## podDisruptionBudget: enabled: false maxUnavailable: 1 ## Specify the service account to use for the MinIO pods. If 'create' is set to 'false' ## and 'name' is left unspecified, the account 'default' will be used. serviceAccount: create: true ## The name of the service account to use. If 'create'...

flavor: kubernetes allowExternal: true # only when using flavor: cilium egressEntities: - kube-apiserver ## PodDisruptionBudget settings ## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ ## podDisruptionBudget: enabled: false maxUnavailable: 1 ## Specify the service account to use for the MinIO pods. If 'create' is set to 'false' ## and 'name' is left unspecified, the account 'default' will be used. serviceAccount: create: true ## The name of the service account to use. If 'create'...

" # Can leave empty claimPrefix: "" comment: "" networkPolicy: enabled: false allowExternal: true ## PodDisruptionBudget settings ## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ ## podDisruptionBudget: enabled: false maxUnavailable: 1 ## Specify the service account to use for the MinIO pods. If 'create' is set to 'false' ## and 'name' is left unspecified, the account 'default' will be used. serviceAccount: create: true ## The name of the service account to use. If 'create'...

flavor: kubernetes allowExternal: true # only when using flavor: cilium egressEntities: - kube-apiserver ## PodDisruptionBudget settings ## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ ## podDisruptionBudget: enabled: false maxUnavailable: 1 ## Specify the service account to use for the MinIO pods. If 'create' is set to 'false' ## and 'name' is left unspecified, the account 'default' will be used. serviceAccount: create: true ## The name of the service account to use. If 'create'...

          "intervalFactor": 1,
          "legendFormat": "{{server}}",
          "metric": "process_start_time_seconds",
          "refId": "A",
          "step": 60
        }
      ],
      "title": "Open FDs ",
      "type": "timeseries"
    },
    {
      "datasource": {
        "type": "prometheus",
        "uid": "${DS_PROMETHEUS}"
      },
      "description": "",
      "fieldConfig": {

                                new Exception("Build failed due to log statements with a higher severity than allowed. "
                                        + "Fix the logged issues or remove flag --fail-on-severity (-fos)."));
            }

            logResult(event.getSession());

            logStats(event.getSession());

            infoLine('-');
        }
    }

        public static final String QUIET = "q";
        public static final String VERBOSE = "X";

        public static final String SHOW_ERRORS = "e";
        public static final String FAIL_ON_SEVERITY = "fos";
        public static final String NON_INTERACTIVE = "non-interactive";
        public static final String BATCH_MODE = "B";
        public static final String FORCE_INTERACTIVE = "force-interactive";

  # Analyze the current live cluster and suppress PodMissingProxy for pod mypod in namespace 'testing'.
  istioctl analyze -S "IST0103=Pod mypod.testing"

  # Analyze the current live cluster and suppress PodMissingProxy for all pods in namespace 'testing',
  # and suppress MisplacedAnnotation on deployment foobar in namespace default.
  istioctl analyze -S "IST0103=Pod *.testing" -S "IST0107=Deployment foobar.default"

  # List available analyzers

    public static final String ALTERNATE_INSTALLATION_TOOLCHAINS = "it";

    public static final String FAIL_FAST = "ff";

    public static final String FAIL_ON_SEVERITY = "fos";

    public static final String FAIL_AT_END = "fae";

    public static final String FAIL_NEVER = "fn";

    public static final String RESUME = "r";

    public static final String RESUME_FROM = "rf";

## Redirection

As ztunnel aims to transparently encrypt and route users traffic, we need a mechanism to capture all traffic entering and leaving "mesh" pods.
This is a security critical task: if the ztunnel can be bypassed, authorization policies can be bypassed.

Redirection must meet these requirements: