// The sidecar can be a normal container or init in Kubernetes 1.28+
func containers(pod *v1.Pod) []v1.Container {
	res := make([]v1.Container, 0, len(pod.Spec.Containers)+len(pod.Spec.InitContainers))
	res = append(res, pod.Spec.InitContainers...)
	res = append(res, pod.Spec.Containers...)
	return res
}

func (pi PodInfo) String() string {
	var b strings.Builder

        {{- end }}
      {{- if .Values.serviceAccount.create }}
      serviceAccountName: {{ .Values.serviceAccount.name }}
      {{- end }}
      {{- if .Values.policies }}
      initContainers:
        - name: minio-make-policy
          image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
          {{- if .Values.makePolicyJob.securityContext.enabled }}

			},
			expected: "",
		},
		{
			anno:     klabels.Set{},
			expected: "",
		},
		{
			anno: klabels.Set{
				apiannotation.SidecarStatus.Name: `
				{
					"initContainers": [
						"istio-init"
					],
					"containers": [
						"istio-proxy"
					],
					"volumes": [
						"istio-envoy",
						"istio-data",
						"istio-podinfo",
						"istio-token",

- In sidecar mode, the CNI plugin can configure sidecar networking for pods when they are scheduled by the container runtime, using iptables. The CNI handling the netns setup replaces the current Istio approach using a `NET_ADMIN` privileged `initContainers` container, `istio-init`, injected in the pods along with `istio-proxy` sidecars. This removes the need for a privileged, `NET_ADMIN` container in the Istio users' application pods.

## Pod Startup

### Pod Startup Requirements

During new Pod startup, we MUST meet the constraint that the network is ready the instant the application starts (including `initContainers`!).
This is critical -- issues around this were the [top issue with sidecars](https://github.com/istio/istio/issues/11130).

### Pod Startup Implementation

The key mechanism to maintain this property is the CNI plugin.

.Values.customCommandJob.extraVolumes }} {{- toYaml .Values.customCommandJob.extraVolumes | nindent 8 }} {{- end }} {{- if .Values.serviceAccount.create }} serviceAccountName: {{ .Values.serviceAccount.name }} {{- end }} {{- if .Values.policies }} initContainers: - name: minio-make-policy image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" {{- if .Values.makePolicyJob.securityContext.enabled }} {{- with .Values.makePolicyJob.containerSecurityCon }} securityContext: {{ toYaml . | nindent...

- Added `--keep-*` flags to `kubectl debug`, which enables to control the removal
  of probes, labels, annotations and initContainers from copy pod. ([#123149](https://github.com/kubernetes/kubernetes/pull/123149), [@mochizuki875](https://github.com/mochizuki875)) [SIG CLI and Testing]

- InitContainer's image location will be considered in scheduling when prioritizing nodes. ([#123366](https://github.com/kubernetes/kubernetes/pull/123366), [@kerthcet](https://github.com/kerthcet)) [SIG Scheduling]

- Kube-apiserver: fixes a 1.28 regression printing pods with invalid initContainer status ([#124909](https://github.com/kubernetes/kubernetes/pull/124909), [@liggitt](https://github.com/liggitt)) [SIG Node]

- Kube-apiserver: fixes a 1.28 regression printing pods with invalid initContainer status ([#124910](https://github.com/kubernetes/kubernetes/pull/124910), [@liggitt](https://github.com/liggitt)) [SIG Node]