KubeconfigMode           = "kubeconfig-mode"
	KubeCAFile               = "kube-ca-file"
	SkipTLSVerify            = "skip-tls-verify"
	MonitoringPort           = "monitoring-port"
	LogUDSSocket             = "log-uds-socket"
	ZtunnelUDSAddress        = "ztunnel-uds-address"
	CNIEventSocket           = "cni-event-address"
	CNIAgentRunDir           = "cni-agent-run-dir"
	ExcludeNamespaces        = "exclude-namespaces"

	if port <= 0 {
		return
	}
	mux := http.NewServeMux()
	var listener net.Listener
	var err error
	if listener, err = net.Listen("tcp", fmt.Sprintf(":%d", port)); err != nil {
		log.Errorf("unable to listen on socket: %v", err)
		return
	}
	exporter, err := monitoring.RegisterPrometheusExporter(nil, nil)
	if err != nil {
		log.Errorf("could not set up prometheus exporter: %v", err)
		return
	}
	mux.Handle(path, exporter)

	CNIBinSourceDir string
	// Directories into which to copy the CNI binaries
	CNIBinTargetDirs []string

	// The HTTP port for monitoring
	MonitoringPort int

	// The ztunnel server socket address that the ztunnel will connect to.
	ZtunnelUDSAddress string

	// Whether ambient is enabled
	AmbientEnabled bool

	// Whether ambient DNS capture is enabled
	AmbientDNSCapture bool

### Design details

Broadly, `istio-cni` accomplishes ambient redirection by instructing ztunnel to set up sockets within the application pod network namespace, where:

- one end of the socket is in the application pod
- and the other end is in ztunnel's pod

and setting up iptables rules to funnel traffic thru that socket "tube" to ztunnel and back.

import org.mockserver.configuration.Configuration
import org.mockserver.logging.MockServerLogger
import org.mockserver.model.HttpRequest.request
import org.mockserver.model.HttpResponse.response
import org.mockserver.socket.tls.KeyStoreFactory
import org.testcontainers.containers.MockServerContainer
import org.testcontainers.junit.jupiter.Container
import org.testcontainers.junit.jupiter.Testcontainers

      }

    /** Sets the trailers and returns this. */
    fun trailers(trailers: Headers) =
      apply {
        this.trailers = trailers.newBuilder()
      }

    /** Sets the socket policy and returns this. */
    fun socketPolicy(socketPolicy: SocketPolicy) =
      apply {
        this.socketPolicy = socketPolicy
      }

    /**

 *  New: charset support for `Credentials.basic()`.


## Version 3.5.0

_2016-11-30_

 *  **Web Sockets are now a stable feature of OkHttp.** Since being introduced as a beta feature in
    OkHttp 2.3 our web socket client has matured. Connect to a server's web socket with
    `OkHttpClient.newWebSocket()`, send messages with `send()`, and receive messages with the
    `WebSocketListener`.

`github.com`) and all of the **static** configuration necessary to connect to that server: the port number, HTTPS settings, and preferred network protocols (like HTTP/2).

URLs that share the same address may also share the same underlying TCP socket connection. Sharing a connection has substantial performance benefits: lower latency, higher throughput (due to [TCP slow start](https://www.igvita.com/2011/10/20/faster-web-vs-tcp-slow-start/)) and conserved battery. OkHttp uses a [ConnectionPoo...

        .socketFactory(
          object : DelegatingSocketFactory(getDefault()) {
            override fun configureSocket(socket: Socket): Socket {
              socket.receiveBufferSize = socketBufferSize
              socket.sendBufferSize = socketBufferSize
              return socket
            }
          },
        )
        .writeTimeout(Duration.ofMillis(500))
        .build()
    server.start()

   dropped in 2.0.

## Version 1.5.4

_2014-04-14_

 * Drop ALPN support in Android. There's a concurrency bug in all
   currently-shipping versions.
 * Support asynchronous disconnects by breaking the socket only. This should
   prevent flakiness from multiple threads concurrently accessing a stream.

## Version 1.5.3

_2014-03-29_

 * Fix bug where the Content-Length header was not always dropped when