b.WriteString("NodeName: " + c.NodeName + "\n")
	b.WriteString("LabelKey: " + c.LabelKey + "\n")
	b.WriteString("LabelValue: " + c.LabelValue + "\n")
	b.WriteString("DeletePods: " + fmt.Sprint(c.DeletePods) + "\n")
	b.WriteString("LabelPods: " + fmt.Sprint(c.LabelPods) + "\n")
	b.WriteString("SidecarAnnotation: " + c.SidecarAnnotation + "\n")
	b.WriteString("InitContainerName: " + c.InitContainerName + "\n")

  REPAIR_ENABLED: {{ .Values.cni.chained | quote }}
  REPAIR_LABEL_PODS: {{ .Values.cni.repair.labelPods | quote }}
  REPAIR_DELETE_PODS: {{ .Values.cni.repair.deletePods | quote }}
  REPAIR_REPAIR_PODS: {{ .Values.cni.repair.repairPods | quote }}
  REPAIR_INIT_CONTAINER_NAME: {{ .Values.cni.repair.initContainerName | quote }}

      labelPods: false
      # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
      # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
      deletePods: false

    verbs: ["create", "patch"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["watch", "get", "list"]
{{- if .Values.cni.repair.repairPods }}
{{- /*  No privileges needed*/}}
{{- else if .Values.cni.repair.deletePods }}
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["delete"]
{{- else if .Values.cni.repair.labelPods }}
  - apiGroups: [""]

					msg := fmt.Errorf(`iptables validation failed; workload is not ready for Istio.
When using Istio CNI, this can occur if a pod is scheduled before the node is ready.

If installed with 'cni.repair.deletePods=true', this pod should automatically be deleted and retry.
Otherwise, this pod will need to be manually removed so that it is scheduled on a node with istio-cni running, allowing iptables rules to be established.
`)