},
                {
                    "endpoint_config": {
                        "@type": "type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment",
                        "cluster_name": "inbound|9080||",
                        "policy": {
                            "overprovisioning_factor": 140
                        }
                    }
                },
                {

    messages and `Long.MAX_VALUE` to never compress outbound messages. The default is 1024L which
    compresses messages of size 1 KiB and larger. (Inbound messages are compressed or not based on
    the web socket server's configuration.)
 *  New: Defer constructing `Inflater` and `Deflater` instances until they are needed. This saves

     permission under the Copyright and Similar Rights held by the
     Licensor. For purposes of this Public License, where the Licensed
     Material is a musical work, performance, or sound recording,
     Adapted Material is always produced where the Licensed Material is
     synched in timed relation with a moving image.

  b. Adapter's License means the license You apply to Your Copyright

	we := wg.Spec.Template
	ports := []string{}
	for _, v := range we.Ports {
		ports = append(ports, fmt.Sprint(v))
	}
	// respect the inbound port annotation and capture all traffic if no inbound ports are set
	portBehavior := "*"
	if len(ports) > 0 {
		portBehavior = strings.Join(ports, ",")
	}

      logger.fine(frameLog(true, streamId, length, TYPE_WINDOW_UPDATE, flags))
      throw e
    }
    if (logger.isLoggable(FINE)) {
      logger.fine(
        frameLogWindowUpdate(
          inbound = true,
          streamId = streamId,
          length = length,
          windowSizeIncrement = increment,
        ),
      )
    }
    handler.windowUpdate(streamId, increment)
  }

  }

  /**
   * OkHttp currently doesn't implement failing the request body stream independently of failing the
   * corresponding response body stream. This is necessary if we want servers to be able to stop
   * inbound data and send an early 400 before the request body completes.
   *
   * This test sends a slow request that is canceled by the server. It expects the response to still
   * be readable after the request stream is canceled.

// or '#'.
message HTTPIngressRuleValue {
  // paths is a collection of paths that map requests to backends.
  repeated HTTPIngressPath paths = 1;
}

// Ingress is a collection of rules that allow inbound connections to reach the
// endpoints defined by a backend. An Ingress can be configured to give services
// externally-reachable urls, load balance traffic, terminate SSL, offer name
// based virtual hosting etc.

This will send some identifying information about the Pod to Ztunnel, and, importantly, the Pod's network namespace file descriptor.

Ztunnel will use this to enter the Pod network namespace and start various listeners (inbound, outbound, etc).

> [!NOTE]
> While Ztunnel runs as a single shared binary on the node, each individual pod gets its own unique set of listeners within its own network namespace.

## Pod Startup

- excludeInterfaces
- kubevirtInterfaces
- ISTIO_META_DNS_CAPTURE env variable on the proxy - enables dns redirect
- INVALID_DROP env var on proxy - changes behavior from reset to drop in iptables
- auto excluded inbound ports: 15020, 15021, 15090

The code automatically detects the proxyUID and proxyGID from RunAsUser/RunAsGroup and exclude them from interception, defaulting to 1337

### Overview

  istioctl proxy-config clusters <pod-name[.namespace]> --port 9080

  # Retrieve full cluster dump for clusters that are inbound with a FQDN of details.default.svc.cluster.local.
  istioctl proxy-config clusters <pod-name[.namespace]> --fqdn details.default.svc.cluster.local --direction inbound -o json

  # Retrieve cluster summary without using Kubernetes API
  ssh <user@hostname> 'curl localhost:15000/config_dump' > envoy-config.json