- it also sets up a UDS socket for istio-cni to send logs to this container.
    - based on config, it may run the 'repair' controller that detects pods where istio setup fails and restarts them, or created in corner cases.
    - if ambient is enabled, also runs an ambient controller, watching Pod, Namespace

- `istio-cni`
    - CNI plugin executable copied to `/opt/cni/bin`

  - If there are any errors, read the error and fix your code.
  - IMPORTANT NOTE: if the first import fails, you have to select and apply `Synchronization disabled`, then repeat the step above.
    Otherwise, TeamCity complains "Can't find the previous revision, please commit current settings first".