// When no rule matches the Pod failure, the default handling applies - the
  // counter of pod failures is incremented and it is checked against
  // the backoffLimit. At most 20 elements are allowed.
  // +listType=atomic
  repeated PodFailurePolicyRule rules = 1;
}

// PodFailurePolicyOnExitCodesRequirement describes the requirement for handling

- In sidecar mode, the CNI plugin can configure sidecar networking for pods when they are scheduled by the container runtime, using iptables. The CNI handling the netns setup replaces the current Istio approach using a `NET_ADMIN` privileged `initContainers` container, `istio-init`, injected in the pods along with `istio-proxy` sidecars. This removes the need for a privileged, `NET_ADMIN` container in...

			// choose to do so.
			//
			// NOTE: This is a warning and not an error because the user may not intend to label their namespace as ambient.
			//
			// e.g. Users are handling ambient redirection per workload rather than at the namespace level.
			if enrollNamespace {
				namespaceIsLabeledAmbient, err := namespaceIsLabeledAmbient(kubeClient, ns)
				if err != nil {

  # Change the revision tag to reference the "1-8-1" revision
  istioctl tag set prod --revision 1-8-1 --overwrite

  # Make revision "1-8-1" the default revision, both resulting in that revision handling injection for "istio-injection=enabled"
  # and validating resources cluster-wide
  istioctl tag set default --revision 1-8-1

  # Rollout namespace "test-ns" to update workloads to the "1-8-1" revision

				log.Debug("listener closed - returning")
				return
			}

			log.Errorf("failed to accept conn: %v", err)
			continue
		}
		log.Debug("connection accepted")
		go func() {
			log.Debug("handling conn")
			if err := z.handleConn(ctx, conn); err != nil {
				log.Errorf("failed to handle conn: %v", err)
			}
		}()
	}
}

// ZDS protocol is very simple, for every message sent, and ack is sent.

  // defaultBackend is the backend that should handle requests that don't
  // match any rule. If Rules are not specified, DefaultBackend must be specified.
  // If DefaultBackend is not set, the handling of requests that do not match any
  // of the rules will be up to the Ingress controller.
  // +optional
  optional IngressBackend defaultBackend = 1;