# process should be kept alive after an occasional reload.
  drainDuration: 2s
  #
  # The mode used to redirect inbound connections to Envoy. This setting
  # has no effect on outbound traffic: iptables REDIRECT is always used for
  # outbound connections.
  # If "REDIRECT", use iptables REDIRECT to NAT and redirect to Envoy.
  # The "REDIRECT" mode loses source addresses during redirection.

NAME                  STATUS      LOCALITY     CLUSTER
10.244.0.176:8080     HEALTHY                  outbound|80||istio-ingressgateway.istio-system.svc.cluster.local

        },
        {
            "ecdsFilter": {
                "@type": "type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig",
                "name": "istio.io/telemetry/stats/prometheus/sidecar/Outbound/HTTP"
            },
            "lastUpdated": "2023-12-23T13:46:00.701Z"
        },
        {
            "ecdsFilter": {
                "@type": "type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig",

		}
		name := fmt.Sprintf("%s.%s", wl.Info.Name, wl.Info.Namespace)
		if filter.Direction != "outbound" {
			for _, c := range wl.Connections.Inbound {
				fmt.Fprintf(w, "%v\tInbound\t%v\t%v\t%v\n", name, lookupIP(c.ActualDst), lookupIP(c.Src), c.OriginalDst)
			}
		}
		if filter.Direction != "inbound" {
			for _, c := range wl.Connections.Outbound {

  lastUpdated: "2022-12-08T11:03:53.225Z"
  versionInfo: 2022-12-08T09:07:09Z/10
- ecdsFilter:
    '@type': type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig
    name: istio.io/telemetry/stats/prometheus/sidecar/Outbound/HTTP
  lastUpdated: "2023-12-23T13:46:00.701Z"
- ecdsFilter:
    '@type': type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig
    name: istio.io/telemetry/stats/prometheus/sidecar/Inbound/HTTP

## Traffic routing

Based on the three [redirection](#redirection) paths, the ztunnel has three primary types of traffic it handles.

### Outbound

Requests leaving a pod go through the "outbound" code path on port 15001.
This is where most of Ztunnel's logic lives.

For outbound traffic, we need to first determine where the traffic is destined to.

                {
                    "ecds_filter": {
                        "@type": "type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig",
                        "name": "istio.io/telemetry/stats/prometheus/sidecar/Outbound/HTTP"
                    },
                    "last_updated": "2023-12-23T13:46:00.701Z"
                },
                {
                    "ecds_filter": {

        ],
        "routes": [
         {
          "match": {
           "case_sensitive": true,
           "path_separated_prefix": "/get"
          },
          "route": {
           "cluster": "outbound|8000||httpbin.default.svc.cluster.local",
           "timeout": "0s",
           "retry_policy": {
            "retry_on": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",

	Connections WorkloadConnections `json:"connections,omitempty"`
	Info        WorkloadInfo        `json:"info"`
}

type WorkloadConnections struct {
	Inbound  []InboundConnection  `json:"inbound"`
	Outbound []OutboundConnection `json:"outbound"`
}

type WorkloadInfo struct {
	Name           string `json:"name"`
	Namespace      string `json:"namespace"`
	TrustDomain    string `json:"trustDomain"`

  val sink: BufferedSink,
  val random: Random,
  private val perMessageDeflate: Boolean,
  private val noContextTakeover: Boolean,
  private val minimumDeflateSize: Long,
) : Closeable {
  /** This holds outbound data for compression and masking. */
  private val messageBuffer = Buffer()

  /** The [Buffer] of [sink]. Write to this and then flush/emit [sink]. */
  private val sinkBuffer: Buffer = sink.buffer