// The sidecar can be a normal container or init in Kubernetes 1.28+
func containers(pod *v1.Pod) []v1.Container {
	res := make([]v1.Container, 0, len(pod.Spec.Containers)+len(pod.Spec.InitContainers))
	res = append(res, pod.Spec.InitContainers...)
	res = append(res, pod.Spec.Containers...)
	return res
}

func (pi PodInfo) String() string {
	var b strings.Builder

        {{- end }}
      {{- if .Values.serviceAccount.create }}
      serviceAccountName: {{ .Values.serviceAccount.name }}
      {{- end }}
      {{- if .Values.policies }}
      initContainers:
        - name: minio-make-policy
          image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
          {{- if .Values.makePolicyJob.securityContext.enabled }}

			},
			expected: "",
		},
		{
			anno:     klabels.Set{},
			expected: "",
		},
		{
			anno: klabels.Set{
				apiannotation.SidecarStatus.Name: `
				{
					"initContainers": [
						"istio-init"
					],
					"containers": [
						"istio-proxy"
					],
					"volumes": [
						"istio-envoy",
						"istio-data",
						"istio-podinfo",
						"istio-token",

- In sidecar mode, the CNI plugin can configure sidecar networking for pods when they are scheduled by the container runtime, using iptables. The CNI handling the netns setup replaces the current Istio approach using a `NET_ADMIN` privileged `initContainers` container, `istio-init`, injected in the pods along with `istio-proxy` sidecars. This removes the need for a privileged, `NET_ADMIN` container in the Istio users' application pods.

## Pod Startup

### Pod Startup Requirements

During new Pod startup, we MUST meet the constraint that the network is ready the instant the application starts (including `initContainers`!).
This is critical -- issues around this were the [top issue with sidecars](https://github.com/istio/istio/issues/11130).

### Pod Startup Implementation

The key mechanism to maintain this property is the CNI plugin.

secretName: {{ .Values.tls.certSecret }} items: - key: {{ .Values.tls.publicCrt }} path: CAs/public.crt {{- end }} {{- if .Values.serviceAccount.create }} serviceAccountName: {{ .Values.serviceAccount.name }} {{- end }} {{- if .Values.policies }} initContainers: - name: minio-make-policy image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" {{- if .Values.makePolicyJob.securityContext.enabled }} securityContext: runAsUser: {{ .Values.makePolicyJob.securityContext.runAsUser }} runAsGroup:...

secretName: {{ .Values.tls.certSecret }} items: - key: {{ .Values.tls.publicCrt }} path: CAs/public.crt {{- end }} {{- if .Values.serviceAccount.create }} serviceAccountName: {{ .Values.serviceAccount.name }} {{- end }} {{- if .Values.policies }} initContainers: - name: minio-make-policy image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" {{- if .Values.makePolicyJob.securityContext.enabled }} securityContext: runAsUser: {{ .Values.makePolicyJob.securityContext.runAsUser }} runAsGroup:...

secretName: {{ .Values.tls.certSecret }} items: - key: {{ .Values.tls.publicCrt }} path: CAs/public.crt {{- end }} {{- if .Values.serviceAccount.create }} serviceAccountName: {{ .Values.serviceAccount.name }} {{- end }} {{- if .Values.policies }} initContainers: - name: minio-make-policy image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" {{- if .Values.makePolicyJob.securityContext.enabled }} securityContext: runAsUser: {{ .Values.makePolicyJob.securityContext.runAsUser }} runAsGroup:...

.Values.customCommandJob.extraVolumes }} {{- toYaml .Values.customCommandJob.extraVolumes | nindent 8 }} {{- end }} {{- if .Values.serviceAccount.create }} serviceAccountName: {{ .Values.serviceAccount.name }} {{- end }} {{- if .Values.policies }} initContainers: - name: minio-make-policy image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" {{- if .Values.makePolicyJob.securityContext.enabled }} {{- with .Values.makePolicyJob.containerSecurityCon }} securityContext: {{ toYaml . | nindent...

  // Cannot be updated.
  // More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
  // +patchMergeKey=name
  // +patchStrategy=merge
  repeated Container initContainers = 20;

  // List of containers belonging to the pod.
  // Containers cannot currently be added or removed.
  // There must be at least one container in a Pod.
  // Cannot be updated.