encodings[ 0x10] = encoding // Data Link Escape
      encodings[ 0x11] = encoding // Device Control 1 (oft. XON)
      encodings[ 0x12] = encoding // Device Control 2
      encodings[ 0x13] = encoding // Device Control 3 (oft. XOFF)
      encodings[ 0x14] = encoding // Device Control 4
      encodings[ 0x15] = encoding // Negative Acknowledgment
      encodings[ 0x16] = encoding // Synchronous idle

pkg debug/elf, const R_AARCH64_TLSDESC_LD_PREL19 R_AARCH64
pkg debug/elf, const R_AARCH64_TLSDESC_OFF_G0_NC = 566
pkg debug/elf, const R_AARCH64_TLSDESC_OFF_G0_NC R_AARCH64
pkg debug/elf, const R_AARCH64_TLSDESC_OFF_G1 = 565
pkg debug/elf, const R_AARCH64_TLSDESC_OFF_G1 R_AARCH64
pkg debug/elf, const R_AARCH64_TLSGD_ADD_LO12_NC = 514
pkg debug/elf, const R_AARCH64_TLSGD_ADD_LO12_NC R_AARCH64

the renewal program to acquire the certificates, then configure them with the TLS Termination Proxy, and then restart the TLS Termination Proxy. This is not ideal, as your app(s) will not be available during the time that the TLS Termination Proxy is off.

All this renewal process, while still serving the app, is one of the main reasons why you would want to have a **separate system to handle HTTPS** with a TLS Termination Proxy instead of just using the TLS certificates with the application...

      assertThat(responseBody.readUtf8Line()).isNull()
    }
    body.awaitSuccess()
  }

  /**
   * Duplex calls that have follow-ups are weird. By the time we know there's a follow-up we've
   * already split off another thread to stream the request body. Because we permit at most one
   * exchange at a time we break the request stream out from under that writer.
   */
  @Test
  fun duplexWithRedirect() {

    CZ--"HBONE (actual)"-->SZ
    SZ--Plain-->Server
```

### Pooling

User connections can be multiplexed over shared HBONE connections.
This is done through standard HTTP/2 pooling.
The pooling is keyed off the `{source identity, destination identity, destination ip}`.

### Headers

Ztunnel uses the following well-known headers in HBONE:

!!! warning
    There's a high chance that you **don't** need this base image or any other similar one, and would be better off by building the image from scratch as [described above in: Build a Docker Image for FastAPI](#build-a-docker-image-for-fastapi).

defines install time parameters like component and enablement and namespace, and K8s settings like resources, HPA spec etc. in a structured way.
The simplest customization is to turn components on and off. For example, to turn on cni ([samples/cni-on.yaml](samples/cni-on.yaml):

```yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    cni:
      enabled: true
```

      } else {
        fileSystem.atomicMove(journalFileBackup, journalFile)
      }
    }

    civilizedFileSystem = fileSystem.isCivilized(journalFileBackup)

    // Prefer to pick up where we left off.
    if (fileSystem.exists(journalFile)) {
      try {
        readJournal()
        processJournal()
        initialized = true
        return
      } catch (journalIsCorrupt: IOException) {

    fix insecure hosts crash with an `IllegalArgumentException` on Android.


## Version 4.7.0

_2020-05-17_

 *  New: `HandshakeCertificates.Builder.addInsecureHost()` makes it easy to turn off security in
    private development environments that only carry test data. Prefer this over creating an
    all-trusting `TrustManager` because only hosts on the allowlist are insecure. From
    [our DevServer sample][dev_server]:

activation, it might be nice to allow a user to activate/deactivate a plugin instead of having to uninstall and reinstall a plugin in particular cases. This would prevent having to reconfigure the plugin again. For example it might be nice to turn off LDAP authentication without having to uninstall the plugin.

These particular phases in a plugin’s lifecycle can probably be generalized to all plugins so could be something implemented in all plugins. Here we could have the descriptor either...