spec:
  profile: ambient
  components:
    ingressGateways:
      - name: istio-ingressgateway
        enabled: true
  values:
    cni:
      ambient:
        # Some of the tests require DNS capture
        # For that, DNS capture must be enabled in the CNI
        # and DNS proxying must be enabled in ztunnel
        dnsCapture: true
    ztunnel:
      meshConfig:
        defaultConfig:
          proxyMetadata:

        // This does leave a small window where some text may be captured prior to the prompt being fully displayed, however this is
        // better than doing things in the other order, where there will be a small window where text may not be captured after prompt is fully displayed.

*   Nesting also allows to form islands without involving inter-procedural
    analyzes: any function call may involve a callee with a graph.

The `tf_executor.island` region allows implicit capture. If any value captured
by a `tf_executor.island` is dead, the whole region does not execute and every
produced value is marked as dead as well.

An arbitrary number of `tf_executor.control` operands are accepted by a

	// WorkloadAddressedWaypoint is a workload only waypoint
	WorkloadAddressedWaypoint echo.Instances
	// ServiceAddressedWaypoint is a serviceonly waypoint
	ServiceAddressedWaypoint echo.Instances
	// Captured echo service
	Captured echo.Instances
	// Uncaptured echo Service
	Uncaptured echo.Instances
	// Sidecar echo services with sidecar
	Sidecar echo.Instances

	// All echo services
	All echo.Instances

   * {@code ArrayList<?>::set}.
   *
   * <p>Instead, {@code <?>} will be resolved to a capture in the form of a type variable {@code
   * <capture-of-? extends Object>}, effectively preventing {@code set} from accepting any type.
   */
  static TypeResolver invariantly(Type contextType) {
    Type invariantContext = WildcardCapturer.INSTANCE.capture(contextType);

class FileMetadataTestFixture {
    static maybeRoundLastModified(long lastModified) {
        // Some Java 8 versions on Unix only capture the seconds in lastModified, so we cut off the milliseconds returned from the filesystem as well.
        // For example, Oracle JDK 1.8.0_181-b13 does not capture milliseconds, while OpenJDK 1.8.0_242-b08 does.
        return (JavaVersion.current().java9Compatible || OperatingSystem.current().windows)

        System.err.println('A task error message which is logged at WARN level')
    }
}

// START SNIPPET task-capture-stdout
task logInfo {
    logging.captureStandardOutput LogLevel.INFO
    doFirst {
        println 'A task message which is logged at INFO level'
    }
}
// END SNIPPET task-capture-stdout

task nestedBuildLog(type: GradleBuild) {
    startParameter.currentDir = rootProject.file('nestedBuild')

	JumpOutbound            = Command{"JumpOutbound", "direct all traffic through ISTIO_OUTBOUND chain"}
	ExcludeInboundPort      = Command{"ExcludeInboundPort", "exclude inbound port from capture"}
	IncludeInboundPort      = Command{"IncludeInboundPort", "include inbound port for capture"}
	InboundCapture          = Command{"InboundCapture", "redirect inbound request to proxy"}
	KubevirtCommand         = Command{"KubevirtCommand", "Kubevirt outbound redirect"}

apiVersion: release-notes/v2
kind: bug-fix
area: networking
issue:
- 29412
releaseNotes:
- |
  **Improved** the `istioctl x workload` command to configure VMs to disable inbound `iptables` capture

void TF_SetPayload(TF_Status* s, const char* key, const char* value) {
  TSL_SetPayload(s, key, value);
}
void TF_ForEachPayload(const TF_Status* s, TF_PayloadVisitor visitor,
                       void* capture) {
  TSL_ForEachPayload(s, visitor, capture);
}
void TF_SetStatusFromIOError(TF_Status* s, int error_code,
                             const char* context) {
  TSL_SetStatusFromIOError(s, error_code, context);
}