{{- else }}
  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
  {{- end }}
  namespace: {{ .Release.Namespace }}
subsets:
- addresses:
  - ip: {{ .Values.global.remotePilotAddress }}
  ports:
  - port: 15012
    name: tcp-istiod
    protocol: TCP
  - port: 15017
    name: tcp-webhook
    protocol: TCP
---

	"time"

	"github.com/minio/minio/internal/deadlineconn"
)

type acceptResult struct {
	conn net.Conn
	err  error
	lidx int
}

// httpListener - HTTP listener capable of handling multiple server addresses.
type httpListener struct {
	opts        TCPOptions
	listeners   []net.Listener    // underlying TCP listeners.
	acceptCh    chan acceptResult // channel where all TCP listeners write accepted connection.

cluster/prometheus_stats                                            cluster/prometheus_stats              -        -          -               STATIC     

NAME                   ADDRESSES PORT  MATCH DESTINATION
listener/main_internal           0     ALL   Cluster: inbound-vip|8100|http|httpbin.default.svc.cluster.local

		}
		return cmp.Compare(a.Hostname, b.Hostname)
	})
	fmt.Fprintln(w, "NAMESPACE\tSERVICE NAME\tSERVICE VIP\tWAYPOINT")

	for _, svc := range svcs {
		var ip string
		if len(svc.Addresses) > 0 {
			_, ip, _ = strings.Cut(svc.Addresses[0], "/")
		}
		waypoint := serviceWaypointName(svc, zDump.Services)
		fmt.Fprintf(w, "%v\t%v\t%v\t%v\n",
			svc.Namespace, svc.Name, ip, waypoint)
	}
	return w.Flush()
}

                            }
                            if( response.received && response.resultCode == 0 ) {

/* Before we return, in anticipation of this address being cached we must
 * augment the addresses name's hashCode to distinguish those resolved by
 * Lmhosts, WINS, or BCAST. Otherwise a failed query from say WINS would
 * get pulled out of the cache for a BCAST on the same name.
 */

  {{- else }}
  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
  {{- end }}
  namespace: {{ .Release.Namespace }}
subsets:
- addresses:
  - ip: {{ .Values.global.remotePilotAddress }}
  ports:
  - port: 15012
    name: tcp-istiod
    protocol: TCP
  - port: 15017
    name: tcp-webhook
    protocol: TCP
---

    response: Response,
    hostname: String,
    results: MutableList<InetAddress>,
    failures: MutableList<Exception>,
  ) {
    try {
      val addresses = readResponse(hostname, response)
      synchronized(results) {
        results.addAll(addresses)
      }
    } catch (e: Exception) {
      synchronized(failures) {
        failures.add(e)
      }
    }
  }

This may be an IP of a Service, a Pod, or something outside the cluster.
Ztunnel will look up the destination from the [addresses](#address-type) it is configured with.

For traffic to unknown addresses, or to workloads that are not a part of the mesh, the traffic will just be passed through as is.
To make ztunnel more transparent, the original source IP address will be spoofed.

    rather than the duration specified in the response's cache-control header.
 *  Fix: Verify certificate IP addresses in canonical form. When a server presents a TLS certificate
    containing an IP address we must match that address against the URL's IP address, even when the
    two addresses are encoded differently, such as `192.168.1.1` and `0::0:0:FFFF:C0A8:101`. Note

 */
package jcifs;


import java.net.InetAddress;
import java.net.UnknownHostException;


/**
 * Interface for both netbios and internet addresses
 * 
 * @author mbechler
 *
 */
public interface Address {

    /**
     * 
     * @param type
     * @return instance for type, null if the type cannot be unwrapped
     */