- If so, calls `istio-iptables` with params to setup pod netns
        - If ambient, sets up the ambient logic.

- `istio-iptables`
    - sets up iptables to redirect a list of ports to the port envoy will listen
    - shared code with istio-init container
    - it will generate an iptables-save config, based on annotations/labels and other settings, and apply it.

### CmdAdd Sidecar Workflow

			}

			// Copy a valid config file into tempDir
			if err := file.AtomicCopy(filepath.Join("testdata", c.validConfigFilename), tempDir, c.cniConfigFilename); err != nil {
				t.Fatal(err)
			}

			// Listen for isReady to be set to true
			ticker := time.NewTicker(500 * time.Millisecond)
			defer ticker.Stop()
			readyChan := make(chan bool)
			go func(ctx context.Context, tick <-chan time.Time) {
				for {

                        unique across all servers.
                      type: string
                    port:
                      description: The Port on which the proxy should listen for incoming
                        connections.
                      properties:
                        name:
                          description: Label assigned to the port.

To use Remote debugging with IntelliJ, replace above step 2 with following:

1. From `./operator/cmd/operator` path run
`
dlv debug --headless --listen=:2345 --api-version=2 -- server
`.

1. In IntelliJ, create a new Go Remote debug configuration with default settings.

	// Deployment:istio-system:* - compare all deployments in istio-system namespace
	// Service:*:istio-pilot - compare Services called "istio-pilot" in all namespaces.
	selectResources string
	// ignoreResources ignores all listed items during comparison. It uses the same list format as selectResources.
	ignoreResources string
	// renameResources identifies renamed resources before comparison.

  // a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook.
  //
  // - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version.
  // For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,

  // a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook.
  //
  // - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version.
  // For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,

  // completedIndexes holds the completed indexes when .spec.completionMode =
  // "Indexed" in a text format. The indexes are represented as decimal integers
  // separated by commas. The numbers are listed in increasing order. Three or
  // more consecutive numbers are compressed and represented by the first and
  // last element of the series, separated by a hyphen.

		fmt.Sprintf("Comma-separated minimum per-logger level of messages to output, in the form of"+
			" [<logger>:]<level>,[<logger>:]<level>,... or <level> to change all active loggers, "+
			"where logger components can be listed by running \"istioctl proxy-config log <pod-name[.namespace]>\""+
			"or referred from https://github.com/envoyproxy/envoy/blob/main/source/common/common/logger.h, and level can be one of %s", levelListString))
	return logCmd
}

                        unique across all servers.
                      type: string
                    port:
                      description: The Port on which the proxy should listen for incoming
                        connections.
                      properties:
                        name:
                          description: Label assigned to the port.