// Note:
  // * the number of additional invocations is not guaranteed to be exactly one.
  // * if additional invocations result in further modifications to the object, webhooks are not guaranteed to be invoked again.
  // * webhooks that use this option may be reordered to minimize the number of additional invocations.

  // Note:
  // * the number of additional invocations is not guaranteed to be exactly one.
  // * if additional invocations result in further modifications to the object, webhooks are not guaranteed to be invoked again.
  // * webhooks that use this option may be reordered to minimize the number of additional invocations.

//
// If 'PodIPs' exists, it is preferred (and should be guaranteed to contain the address in 'PodIP'),
// otherwise fallback to 'PodIP'.
//
// Note that very early in the pod's lifecycle (before all the node CNI plugin invocations finish)
// K8S may not have received the pod IPs yet, and may not report the pod as having any.
func GetPodIPsIfPresent(pod *corev1.Pod) []netip.Addr {
	var podIPs []netip.Addr
	if len(pod.Status.PodIPs) != 0 {

        - it connects to K8S using the kubeconfig and JWT token copied from install-cni to get Pod and Namespace. Since this is a short-running command, each invocation creates a new connection.
        - If so, calls `istio-iptables` with params to setup pod netns
        - If ambient, sets up the ambient logic.

- `istio-iptables`

  // +optional
  optional int32 healthCheckNodePort = 12;

  // publishNotReadyAddresses indicates that any agent which deals with endpoints for this
  // Service should disregard any indications of ready/not-ready.
  // The primary use case for setting this field is for a StatefulSet's Headless Service to
  // propagate SRV DNS records for its Pods for the purpose of peer discovery.

		constants.ServiceAccountPath,
	)
	// Create file watcher before checking for installation
	// so that no file modifications are missed while and after checking
	// note: we create a file watcher for each invocation, otherwise when we write to the directories
	// we would get infinite looping of events
	//
	// Additionally, fsnotify will lose existing watches on atomic copies (due to overwrite/rename),