serviceCluster: istio-proxy
  # These settings that determine how long an old Envoy
  # process should be kept alive after an occasional reload.
  drainDuration: 2s
  #
  # The mode used to redirect inbound connections to Envoy. This setting
  # has no effect on outbound traffic: iptables REDIRECT is always used for
  # outbound connections.
  # If "REDIRECT", use iptables REDIRECT to NAT and redirect to Envoy.

  - Navigate to service provider section, expand Inbound Authentication Configurations and expand OAuth/OpenID Connect Configuration.
    - Copy the OAuth Client Key as the value for `<CLIENT_ID>`.
    - Copy the OAuth Client Secret as the value for `<CLIENT_SECRET>`.

		if reqInfo == nil {
			return
		}
		reqInfo.RLock()
		defer reqInfo.RUnlock()

		entry = internalAudit.ToEntry(w, r, reqClaims, xhttp.GlobalDeploymentID)
		// indicates all requests for this API call are inbound
		entry.Trigger = "incoming"

		for _, filterKey := range filterKeys {
			delete(entry.ReqClaims, filterKey)
			delete(entry.ReqQuery, filterKey)
			delete(entry.ReqHeader, filterKey)

   */
  val sequenceNumber: Int,
  socket: Socket,
  /**
   * The failure MockWebServer recorded when attempting to decode this request. If, for example,
   * the inbound request was truncated, this exception will be non-null.
   */
  val failure: IOException? = null,
) {
  val method: String?
  val path: String?

  /**

	defKVS, ok := DefaultKVS[subSys]
	if !ok {
		return
	}

	defValue, isFound := defKVS.Lookup(cfgParam)
	// Comments usually are absent from `defKVS`, so we handle it specially.
	if !isFound && cfgParam == Comment {
		defValue, isFound = "", true
	}
	if !isFound {
		return
	}

	if target == "" {
		target = Default
	}

	if redactSecrets {

		//
		// DESC: Anything heading to <INPORT> that does not have the mark, TPROXY to ztunnel inbound port <INPORT>
		iptablesBuilder.AppendRule(
			iptableslog.UndefinedCommand, ChainInpodPrerouting, iptablesconstants.MANGLE,
			"-p", "tcp",
			"-m", "tcp",
			"--dport", fmt.Sprintf("%d", ZtunnelInboundPort),

  }

  /** Returns the negotiated protocol, or null if no protocol was negotiated. */
  open fun getSelectedProtocol(sslSocket: SSLSocket): String? = null

  /** For MockWebServer. This returns the inbound SNI names. */
  @SuppressLint("NewApi")
  @IgnoreJRERequirement // This function is overridden to require API >= 24.
  open fun getHandshakeServerNames(sslSocket: SSLSocket): List<String> {

      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "refId": "A"
        }
      ],
      "title": "Inbound Workloads",
      "type": "row"
    },
    {
      "gridPos": {
        "h": 3,
        "w": 24,
        "x": 0,
        "y": 13
      },
      "id": 45,
      "links": [],

        "windowSizeIncrement == 0 || windowSizeIncrement > 0x7fffffffL: $windowSizeIncrement"
      }
      if (logger.isLoggable(FINE)) {
        logger.fine(
          frameLogWindowUpdate(
            inbound = false,
            streamId = streamId,
            length = 4,
            windowSizeIncrement = windowSizeIncrement,
          ),
        )
      }
      frameHeader(
        streamId = streamId,

	filter := istio_envoy_configdump.ClusterFilter{
		FQDN: host.Name(svcHost),
		Port: int(port),
		// Although we want inbound traffic, ask for outbound traffic, as the DR is
		// not associated with the inbound traffic.
		Direction: model.TrafficDirectionOutbound,
	}

	dump, err := cd.GetClusterConfigDump()
	if err != nil {
		return "", err
	}