// An update strategy to replace existing DaemonSet pods with new pods.
  // +optional
  optional DaemonSetUpdateStrategy updateStrategy = 3;

  // The minimum number of seconds for which a newly created DaemonSet pod should
  // be ready without any of its container crashing, for it to be considered
  // available. Defaults to 0 (pod will be considered available as soon as it
  // is ready).

- watches k8s resource for existing pods, so that pods that have already been started can be moved in or out of the ambient mesh.
- sends UDS events to ztunnel via a socket whenever a pod is enabled for ambient mesh (whether from CNI plugin or node watcher), instructing ztunnel to create the "tube" socket.

  // the webhook call will be ignored or the API call will fail based on the
  // failure policy.
  // The timeout value must be between 1 and 30 seconds.
  // Default to 10 seconds.
  // +optional
  optional int32 timeoutSeconds = 7;

  // AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`

  // reason UnknownTimeZone.
  // More information can be found in https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/#time-zones
  // +optional
  optional string timeZone = 8;

  // Optional deadline in seconds for starting the job if it misses scheduled
  // time for any reason.  Missed jobs executions will be counted as failed ones.
  // +optional
  optional int64 startingDeadlineSeconds = 2;

```bash
iop istio-control istio-discovery $IBASE/istio-control/istio-discovery \
            --set global.istioNamespace=istio-system

# Second istio-discovery, using master version of istio
TAG=latest HUB=gcr.io/istio-testing iop istio-master istio-discovery-master $IBASE/istio-control/istio-discovery \
            --set policy.enable=false \

Additionally, using the redirection mechanism reduces the need for clients to know the destination's ztunnel address.

Below shows an example outbound request. The "target" path is what the client sends, while the "actual" path is the real network flow after redirection.

```mermaid
graph LR
    subgraph Client Node
        Client
        CZ["Ztunnel"]
    end
    subgraph Server Node
        Server

  // +optional
  optional string host = 1;

  // IngressRuleValue represents a rule to route requests for this IngressRule.
  // If unspecified, the rule defaults to a http catch-all. Whether that sends
  // just traffic matching the host to the default backend or all traffic to the
  // default backend, is left to the controller fulfilling the Ingress. Http is
  // currently the only supported IngressRuleValue.

  // the webhook call will be ignored or the API call will fail based on the
  // failure policy.
  // The timeout value must be between 1 and 30 seconds.
  // Default to 30 seconds.
  // +optional
  optional int32 timeoutSeconds = 7;

  // AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`

  // reason UnknownTimeZone.
  // More information can be found in https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/#time-zones
  // +optional
  optional string timeZone = 8;

  // Optional deadline in seconds for starting the job if it misses scheduled
  // time for any reason.  Missed jobs executions will be counted as failed ones.
  // +optional
  optional int64 startingDeadlineSeconds = 2;

```yaml
apiVersion: security.istio.io/v1beta1