default            reviews-v3-5b9bd44f4-z9ms4                           10.244.1.43 ambient-worker        None                                HBONE
default            sleep-7656cf8794-lxcmx                               10.244.2.58 ambient-worker2       None                                HBONE

	CNIAgentRunDir           = "cni-agent-run-dir"
	ExcludeNamespaces        = "exclude-namespaces"
	AmbientEnabled           = "ambient-enabled"
	AmbientDNSCapture        = "ambient-dns-capture"
	AmbientIPv6              = "ambient-ipv6"
	AmbientTPROXYRedirection = "ambient-tproxy-redirection"

	// Repair
	RepairEnabled            = "repair-enabled"
	RepairDeletePods         = "repair-delete-pods"

### Ambient Integration Tests

- **Location**: `tests/integration/ambient`
- **Purpose**: Tests related to the Ambient mode, including components like `ztunnel`.
- **Focus**:
  1. Configuration and communication of Ambient components.
  1. Interaction between `ztunnel` and Ambient components.
  1. Validation of zero-trust security policies.
  1. Testing of ambient traffic management.

default   details-v1-698d88b-krdw7       10.244.2.55 ambient-worker2 None     HBONE
default   httpbin-7447985f87-t8hv7       10.244.1.40 ambient-worker  None     TCP
default   productpage-v1-675fc69cf-kkrm2 10.244.2.56 ambient-worker2 None     HBONE
default   ratings-v1-6484c4d9bb-8xc2r    10.244.2.57 ambient-worker2 None     HBONE
default   reviews-v1-5b5d6494f4-c7z5w    10.244.1.41 ambient-worker  None     HBONE

	}
	tests := []struct {
		name string
		args args
		want bool
	}{
		{
			name: "ambient mode enabled for namespace",
			args: args{
				namespace: namespaceWithAmbientEnabledLabel,
				pod:       unlabelledPod,
			},
			want: true,
		},
		{
			name: "ambient mode enabled for pod",
			args: args{
				namespace: unlabelledNamespace,
				pod:       podWithAmbientEnabledLabel,

// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package ambient

import (
	"context"
	"strings"

	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

	"istio.io/api/annotation"
	"istio.io/api/label"
	"istio.io/istio/pkg/config/constants"

	nss := []runtime.Object{
		createNamespace("default", nil),
		createNamespace("kube-system", nil),
		createNamespace("istio-system", nil),
		createNamespace("ambient", map[string]string{
			label.IoIstioDataplaneMode.Name: constants.DataplaneModeAmbient,
		}),
		createNamespace("no-ambient", map[string]string{
			label.IoIstioDataplaneMode.Name: constants.DataplaneModeAmbient,
			"istio-injection":               "enabled",
		}),
	}

	if err != nil {
		return nil, fmt.Errorf("failed to get pod %s/%s: %v", namespace, name, err)
	}

	// This shouldn't happen - we only trigger this when a pod is added to ambient.
	if ambientPod == nil {
		return nil, fmt.Errorf("pod %s/%s is unexpectedly not enrolled in ambient", namespace, name)
	}
	return ambientPod, nil

# PeerAuthentication Implementation in Ambient

	MonitoringPort int

	// The ztunnel server socket address that the ztunnel will connect to.
	ZtunnelUDSAddress string

	// Whether ambient is enabled
	AmbientEnabled bool

	// Whether ambient DNS capture is enabled
	AmbientDNSCapture bool

	// Whether ipv6 is enabled for ambient capture
	AmbientIPv6 bool

	// Feature flag to determined whether TPROXY is used for redirection.
	AmbientTPROXYRedirection bool
}