cheduled pods. Why bother with the indirection, and not just use a shared full L7 proxy on the node? There are several reasons for this:</p><ul><li>Envoy is not inherently multi-tenant. As a result, we have security concerns with commingling complex processing rules for L7 traffic from multiple unconstrained tenants in a shared instance. By strictly limiting to L4 processing, we reduce the vulnerability surface area significantly.</li><li>The mTLS and L4 features provided by the ztunnel need a much smaller 