default   details-v1-698d88b-krdw7       10.244.2.55 ambient-worker2 None     HBONE
default   httpbin-7447985f87-t8hv7       10.244.1.40 ambient-worker  None     TCP
default   productpage-v1-675fc69cf-kkrm2 10.244.2.56 ambient-worker2 None     HBONE
default   ratings-v1-6484c4d9bb-8xc2r    10.244.2.57 ambient-worker2 None     HBONE
default   reviews-v1-5b5d6494f4-c7z5w    10.244.1.41 ambient-worker  None     HBONE

default            sleep-7656cf8794-lxcmx                               10.244.2.58 ambient-worker2       None                                HBONE
gateway-system     gateway-api-admission-server-85985d48ff-5jcvd        10.244.2.8  ambient-worker2       None                                TCP

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector objectSelector = 11;

  // SideEffects states whether this webhook has side effects.
  // Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown).
  // Webhooks with side effects MUST implement a reconciliation system, since a request may be

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector objectSelector = 11;

  // SideEffects states whether this webhook has side effects.
  // Acceptable values are: Unknown, None, Some, NoneOnDryRun
  // Webhooks with side effects MUST implement a reconciliation system, since a request may be
  // rejected by a future step in the admission chain and the side effects therefore need to be undone.

  optional string version = 4;

  // Resource is one of the existing resource types.  "*" means all.
  // +optional
  optional string resource = 5;

  // Subresource is one of the existing resource types.  "" means none.
  // +optional
  optional string subresource = 6;

  // Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.
  // +optional
  optional string name = 7;
}

    - "sidecar.istio.io/status" annotation is not present on the pod (created by injection of sidecar)
    - pod label "istio.io/dataplane-mode" is not "none"
- sidecar interception is enabled if:
    - "istio-init" container is not present in the pod.
    - istio-proxy container exists and
        - does not have DISABLE_ENVOY environment variable (which triggers proxyless mode)

  // available (ready for at least spec.minReadySeconds)
  // +optional
  optional int32 numberAvailable = 7;

  // The number of nodes that should be running the
  // daemon pod and have none of the daemon pod running and available
  // (ready for at least spec.minReadySeconds)
  // +optional
  optional int32 numberUnavailable = 8;

  // Count of hash collisions for the DaemonSet. The DaemonSet controller

  optional string version = 4;

  // Resource is one of the existing resource types.  "*" means all.
  // +optional
  optional string resource = 5;

  // Subresource is one of the existing resource types.  "" means none.
  // +optional
  optional string subresource = 6;

  // Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.
  // +optional
  optional string name = 7;
}

  // that are not part of the Kubernetes system.
  // +optional
  repeated string externalIPs = 5;

  // Supports "ClientIP" and "None". Used to maintain session affinity.
  // Enable client IP based session affinity.
  // Must be ClientIP or None.
  // Defaults to None.
  // More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies
  // +optional

  // available (ready for at least spec.minReadySeconds)
  // +optional
  optional int32 numberAvailable = 7;

  // The number of nodes that should be running the
  // daemon pod and have none of the daemon pod running and available
  // (ready for at least spec.minReadySeconds)
  // +optional
  optional int32 numberUnavailable = 8;

  // Count of hash collisions for the DaemonSet. The DaemonSet controller