watchedNamespaces: {{.WatchedNamespaces}}
hub: {{.Hub}}
tag: {{.Tag}}
{{- if .ImagePullSecrets }}
imagePullSecrets:
{{- range .ImagePullSecrets }}
- {{ . }}
{{- end }}
{{- end }}
revision: {{if .Revision }} {{.Revision}} {{else}} "" {{end}}
`

	tv := struct {
		IstioNamespace    string
		WatchedNamespaces string
		Hub               string
		Tag               string
		ImagePullSecrets  []string

		return err
	}
	defer netNs.Close()

	return netNs.Do(func(_ ns.NetNS) error {
		log.Infof("============= Start iptables configuration for %v =============", podName)
		defer log.Infof("============= End iptables configuration for %v =============", podName)
		return cmd.ProgramIptables(cfg)
	})

	retries := 0
	var ambientPod *corev1.Pod
	var err error

	log.Debugf("Checking pod: %s in ns: %s is enabled for ambient", addCmd.PodName, addCmd.PodNamespace)
	// The plugin already consulted the k8s API - but on this end handler caches may be stale, so retry a few times if we get no pod.
	for ambientPod, err = s.handlers.GetPodIfAmbient(addCmd.PodName, addCmd.PodNamespace); (ambientPod == nil) && (retries < maxStaleRetries); retries++ {
		if err != nil {