xternal IP address, serious problems will be encountered — like the connection not being established at all.</p><p>As a result, we designed a tiny control plane (deployed as a DaemonSet), which watches all pods — similar to the kubelet watching pods on the node — to write the pod IP addresses that have been injected into the sidecar to the <code>local_pod_ips</code> map.</p><p>When processing inbound traffic, if the destination address is not in the map, we will not do anything to the traffic.</p><p>O