# Add Prometheus Scrape annotations
        prometheus.io/scrape: 'true'
        prometheus.io/port: "15014"
        prometheus.io/path: '/metrics'
        # Custom annotations
        {{- if .Values.cni.podAnnotations }}
{{ toYaml .Values.cni.podAnnotations | indent 8 }}
        {{- end }}
    spec:
      {{if .Values.cni.ambient.enabled }}hostNetwork: true{{ end }}
      nodeSelector:
        kubernetes.io/os: linux

            - NET_ADMIN # Required for TPROXY and setsockopt
            - SYS_ADMIN # Required for `setns` - doing things in other netns
            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
          readOnlyRootFilesystem: true
          runAsGroup: 1337
          runAsNonRoot: false
          runAsUser: 0
{{- if .Values.seLinuxOptions }}
          seLinuxOptions:
{{ toYaml .Values.seLinuxOptions | trim | indent 12 }}
{{- end }}