* <td><code>
 *  smb://host/share2/zig/zag
 * </code></td>
 * </tr>
 * 
 * <tr>
 * <td width="20%"><code>
 *  smb://host/share/foo/bar/
 * </code></td>
 * <td width="20%"><code>
 *  ../zip/
 * </code></td>
 * <td><code>
 *  smb://host/share/foo/zip/
 * </code></td>
 * </tr>
 * 
 * <tr>
 * <td width="20%"><code>
 *  smb://host/share/zig/zag
 * </code></td>
 * <td width="20%"><code>

Additionally, it does not require any network rules/routing/config in the host network namespace, which greatly increases ambient mode compatibility with 3rd-party CNIs. In virtually all cases, this "in-pod" ambient CNI is exactly as compatible with 3rd-party CNIs as sidecars are/were.

### Notable Env Vars

                    final String domain = paramMap.get(CRAWLER_FILE_AUTH + "." + fileAuthName + ".domain");
                    final String hostname = paramMap.get(CRAWLER_FILE_AUTH + "." + fileAuthName + ".host");
                    final String port = paramMap.get(CRAWLER_FILE_AUTH + "." + fileAuthName + ".port");
                    final String username = paramMap.get(CRAWLER_FILE_AUTH + "." + fileAuthName + ".username");

) (map[string]*discovery.DiscoveryResponse, error) {
	return MultiRequestAndProcessXds(false, dr, centralOpts, istioNamespace, ns, serviceAccount, kubeClient, options)
}

type xdsAddr struct {
	gcpProject, host, istiod string
}

func getXdsAddressFromWebhooks(client kube.CLIClient) (*xdsAddr, error) {

func getObjectLocation(r *http.Request, domains []string, bucket, object string) string {
	// unit tests do not have host set.
	if r.Host == "" {
		return path.Clean(r.URL.Path)
	}
	proto := handlers.GetSourceScheme(r)
	if proto == "" {
		proto = getURLScheme(globalIsTLS)
	}
	u := &url.URL{
		Host:   r.Host,
		Path:   path.Join(SlashSeparator, bucket, object),
		Scheme: proto,
	}

	peerRESTEnableSha256    = "enableSha256"
	peerRESTEnableMultipart = "enableMultipart"
	peerRESTAccessKey       = "access-key"
	peerRESTMetricsTypes    = "types"
	peerRESTDisk            = "disk"
	peerRESTHost            = "host"
	peerRESTJobID           = "job-id"
	peerRESTDepID           = "depID"
	peerRESTStartRebalance  = "start-rebalance"
	peerRESTMetrics         = "metrics"
	peerRESTDryRun          = "dry-run"

    val client =
      clientTestRule.newClientBuilder()
        .proxy(socksProxy.proxy())
        .build()
    val url =
      server.url("/")
        .newBuilder()
        .host(SocksProxy.HOSTNAME_THAT_ONLY_THE_PROXY_KNOWS)
        .build()
    val request = Request.Builder().url(url).build()
    val response1 = client.newCall(request).execute()

```mermaid
graph TD;
src[src pod]-->|15008|ztunnel{ztunnel}
ztunnel-->|HBONE|dwp{"destination waypoint (all policy applied here)"}
dwp{destination waypoint}-->|15008|dztunnel{destination ztunnel}
dztunnel-->|host network|dst[dst pod]

		Redacted: string(redacted),
	}, nil
}

// writeKubeConfigFile will rewrite/replace the kubeconfig used by the CNI plugin.
// We are the only consumers of this file and it resides in our owned rundir on the host node,
// so we are good to simply write it out if our watched svcacct token changes.
func writeKubeConfigFile(cfg *config.InstallConfig) error {
	kc, err := createKubeConfig(cfg)
	if err != nil {
		return err
	}

// When clients request content hosted on a particular source domain and that content make requests
// directed towards a domain other than its own, the remote domain needs to host a cross-domain
// policy file that grants access to the source domain, allowing the client to continue the transaction.
func setCrossDomainPolicyMiddleware(h http.Handler) http.Handler {