config      func(cfg *Config)
		ingressMode bool
	}{
		{
			name: "default",
			config: func(cfg *Config) {
				cfg.RedirectDNS = true
			},
		},
		{
			name: "tproxy",
			config: func(cfg *Config) {
				cfg.TPROXYRedirection = true
				cfg.RedirectDNS = true
			},
		},
		{
			name: "ingress",
			config: func(cfg *Config) {
			},
			ingressMode: true,
		},
	}

	redirectDNS := cfg.cfg.RedirectDNS
	if ingressMode && cfg.cfg.TPROXYRedirection {
		ingressMode = false
		// We could support this, but TPROXYRedirection is deprecated and will be removed soon, so we can just test less.
		log.Warnf("ignoring ingressMode due to TPROXYRedirection being enabled. These are mutually exclusive")
	}

	// We use the SidecarTrafficExcludeInboundPorts annotation for compatibility (its somewhat widely used) but don't support all values.
	ingressMode := false
	if a, f := pod.Annotations[annotation.AmbientBypassInboundCapture.Name]; f {
		var err error
		ingressMode, err = strconv.ParseBool(a)
		if err != nil {
			log.Warnf("annotation %v=%q found, but only '*' is supported", annotation.AmbientBypassInboundCapture.Name, a)

		return nil
	}
	// key: namespace
	ingressPods := map[string][]*corev1.Pod{}
	ingressNss := sets.New[string]()
	for i, pod := range pods.Items {
		ns := pod.GetNamespace()
		ingressNss.Insert(ns)
		ingressPods[ns] = append(ingressPods[ns], pods.Items[i].DeepCopy())
	}

	foundIngresses := []*ingressInfo{}