iptables -t nat -A POSTROUTING -j ISTIO_POSTRT
iptables -t nat -A ISTIO_POSTRT -m owner --socket-exists -p tcp -m set --match-set istio-inpod-probes-v4 dst -j SNAT --to-source 169.254.7.127
ip6tables -t nat -N ISTIO_POSTRT
ip6tables -t nat -A POSTROUTING -j ISTIO_POSTRT

    type: LoadBalancer
    ports:
    - name: status-port
      port: 15021
      protocol: TCP
      targetPort: 15021
    - name: http2
      port: 80
      protocol: TCP
      targetPort: 80
    - name: https
      port: 443
      protocol: TCP
      targetPort: 443
    annotations: {}
    loadBalancerIP: ""
    loadBalancerSourceRanges: []
    externalTrafficPolicy: ""

							{
								Name: wellknown.HTTPConnectionManager,
							},
						},
					},
				},
			},
			expect: true,
		},
		{
			desc: "http-tcp-type-match",
			inFilter: &ListenerFilter{
				Type: "HTTP+TCP",
			},
			inListener: &listener.Listener{
				FilterChains: []*listener.FilterChain{{
					Filters: []*listener.Filter{
						{
							Name: wellknown.TCPProxy,
						},

                                  Valid Options: ALL_METRICS, REQUEST_COUNT, REQUEST_DURATION, REQUEST_SIZE, RESPONSE_SIZE, TCP_OPENED_CONNECTIONS, TCP_CLOSED_CONNECTIONS, TCP_SENT_BYTES, TCP_RECEIVED_BYTES, GRPC_REQUEST_MESSAGES, GRPC_RESPONSE_MESSAGES
                                enum:
                                - ALL_METRICS
                                - REQUEST_COUNT

    '@type': type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig
    name: istio.io/telemetry/stats/prometheus/sidecar/Inbound/TCP
  lastUpdated: "2023-12-23T13:46:00.707Z"
- ecdsFilter:
    '@type': type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig
    name: istio.io/telemetry/stats/prometheus/sidecar/Outbound/TCP

import okio.BufferedSink
import okio.BufferedSource
import okio.buffer
import okio.sink
import okio.source

/**
 * A single attempt to connect to a remote server, including these steps:
 *
 *  * [TCP handshake][connectSocket]
 *  * Optional [CONNECT tunnels][connectTunnel]. When using an HTTP proxy to reach an HTTPS server
 *    we must send a `CONNECT` request, and handle authorization challenges from the proxy.

                "name": "istio.io/telemetry/stats/prometheus/sidecar/Inbound/TCP"
            },
            "lastUpdated": "2023-12-23T13:46:00.707Z"
        },
        {
            "ecdsFilter": {
                "@type": "type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig",
                "name": "istio.io/telemetry/stats/prometheus/sidecar/Outbound/TCP"
            },
            "lastUpdated": "2023-12-23T13:46:00.699Z"

            {{- range $key, $val := $gateway.ports }}
            - containerPort: {{ $val.targetPort | default $val.port }}
              protocol: {{ $val.protocol | default "TCP" }}
            {{- end }}
            - containerPort: 15090
              protocol: TCP
              name: http-envoy-prom
        {{- if not $gateway.runAsRoot }}
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:

            {{- range $key, $val := $gateway.ports }}
            - containerPort: {{ $val.targetPort | default $val.port }}
              protocol: {{ $val.protocol | default "TCP" }}
            {{- end }}
            - containerPort: 15090
              protocol: TCP
              name: http-envoy-prom
        {{- if not $gateway.runAsRoot }}
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:

            {{- toYaml . | nindent 10 }}
          {{- end }}
{{- end }}
          ports:
          - containerPort: 8080
            protocol: TCP
          - containerPort: 15010
            protocol: TCP
          - containerPort: 15017
            protocol: TCP
          readinessProbe:
            httpGet:
              path: /ready
              port: 8080
            initialDelaySeconds: 1