}

	initAllSubsystems(ctx)
	initConfigSubsystem(ctx, objLayer)

	globalIAMSys.Init(ctx, objLayer, globalEtcdClient, 2*time.Second)

	req, err := newTestRequest(http.MethodGet, "http://example.com:9000/bucket/object", 0, nil)
	if err != nil {
		t.Fatal(err)
	}

	if err = signRequestV4(req, globalActiveCred.AccessKey, globalActiveCred.SecretKey); err != nil {
		t.Fatal(err)
	}

const (
	EnvKESEndpoint       = "MINIO_KMS_KES_ENDPOINT"     // One or multiple KES endpoints, separated by ','
	EnvKESDefaultKey     = "MINIO_KMS_KES_KEY_NAME"     // The default key name used for IAM data and when no key ID is specified on a bucket
	EnvKESAPIKey         = "MINIO_KMS_KES_API_KEY"      // Access credential for KES - API keys and private key / certificate are mutually exclusive

hpaSpec | [HorizontalPodAutoscaler](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/)
podDisruptionBudget | [PodDisruptionBudget](https://kubernetes.io/docs/concepts/workloads/pods/disruptions/#how-disruption-budgets-work)
podAnnotations | [pod annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)

			return err
		}

		// Calculate a hash of the key for the id of the ES document.
		// Id's are limited to 512 bytes in V7+, so we need to do this.
		var keyHash string
		{
			key := eventData.S3.Bucket.Name + "/" + objectName
			if target.client.isAtleastV7() {
				hh, _ := highwayhash.New(magicHighwayHash256Key) // New will never return error since key is 256 bit
				hh.Write([]byte(key))
				hashBytes := hh.Sum(nil)

    public static final String STORAGE_ACCESS_KEY = "storage.accesskey";

    public static final String STORAGE_SECRET_KEY = "storage.secretkey";

    public static final String STORAGE_BUCKET = "storage.bucket";

    public static final String MAPPING_TYPE_ARRAY = "array";

    public static final String MAPPING_TYPE_STRING = "string";

    public static final String MAPPING_TYPE_LONG = "long";

 *       in the hash code should be as evenly "spread out" through the hash code's bits as possible.
 *       The result is that, for example, when choosing a bucket in a hash table of size 2^8,
 *       <i>any</i> eight bits could be consistently used.
 *   <li><b>cryptographic:</b> certain hash functions such as {@link Hashing#sha512} are designed to

 *       in the hash code should be as evenly "spread out" through the hash code's bits as possible.
 *       The result is that, for example, when choosing a bucket in a hash table of size 2^8,
 *       <i>any</i> eight bits could be consistently used.
 *   <li><b>cryptographic:</b> certain hash functions such as {@link Hashing#sha512} are designed to

            thread.setDaemon( true );
            thread.start();
        }
    }
    void tryClose() {
        synchronized( LOCK ) {

            /* Yes, there is the potential to drop packets
             * because we might close the socket during a
             * request. However the chances are slim and the
             * retry code should ensure the overall request

However, because Ztunnel operates only at Layer 4, we are in a tricky position:
* TCP is stateful, so we cannot really just pass state over to the other process.
  If we operated at L3 we could just start processing packets in the new Ztunnel.
* We do not operate at L7, so we cannot signal to the application, in any way, that it should reconnect (to the new Ztunnel).

Realistically, that means the best we can do is:

See [architecture doc](../architecture/ambient/ztunnel-cni-lifecycle.md).

## Reference

### Design details

Broadly, `istio-cni` accomplishes ambient redirection by instructing ztunnel to set up sockets within the application pod network namespace, where:

- one end of the socket is in the application pod
- and the other end is in ztunnel's pod