- If so, calls `istio-iptables` with params to setup pod netns
        - If ambient, sets up the ambient logic.

- `istio-iptables`
    - sets up iptables to redirect a list of ports to the port envoy will listen
    - shared code with istio-init container
    - it will generate an iptables-save config, based on annotations/labels and other settings, and apply it.

### CmdAdd Sidecar Workflow

To use Remote debugging with IntelliJ, replace above step 2 with following:

1. From `./operator/cmd/operator` path run
`
dlv debug --headless --listen=:2345 --api-version=2 -- server
`.

1. In IntelliJ, create a new Go Remote debug configuration with default settings.

Pengyuan Bian <******@****.***> 1625172474 -0700

Pengyuan Bian <******@****.***> 1625172474 -0700

  // Default to 10 seconds.
  // +optional
  optional int32 timeoutSeconds = 7;

  // AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`
  // versions the Webhook expects. API server will try to use first version in
  // the list which it supports. If none of the versions specified in this list
  // supported by API server, validation will fail for this object.

}

// CronJobList is a collection of cron jobs.
message CronJobList {
  // Standard list metadata.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // items is the list of CronJobs.
  repeated CronJob items = 2;
}

Pengyuan Bian <******@****.***> 1625172474 -0700

  // Default to 30 seconds.
  // +optional
  optional int32 timeoutSeconds = 7;

  // AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`
  // versions the Webhook expects. API server will try to use first version in
  // the list which it supports. If none of the versions specified in this list
  // supported by API server, validation will fail for this object.

  // Audiences are the intendend audiences of the token. A recipient of a
  // token must identify themself with an identifier in the list of
  // audiences of the token, and otherwise should reject the token. A
  // token issued for multiple audiences may be used to authenticate
  // against any of the audiences listed but implies a high degree of
  // trust between the target audiences.
  repeated string audiences = 1;

message LimitRangeSpec {
  // Limits is the list of LimitRangeItem objects that are enforced.
  repeated LimitRangeItem limits = 1;
}

// List holds a list of objects, which may not be known by the server.
message List {
  // Standard list metadata.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds