Name:      "productpage-v1-1234567890",
						Namespace: "default",
						Labels: map[string]string{
							"app": "productpage",
						},
					},
					Spec: corev1.PodSpec{
						Containers: []corev1.Container{
							{
								Name: "productpage",
								Ports: []corev1.ContainerPort{
									{
										Name:          "http",
										ContainerPort: 9080,
									},
								},
							},
							{

    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }}
    kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}",
    {{- end }}
    {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }}
    kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}",
    {{- end }}
    {{- end }}

// may contain duplicates, and possibly be incomplete.
message ResourceRule {
  // Verb is a list of kubernetes resource API verbs, like: get, list, watch, create, update, delete, proxy.  "*" means all.
  repeated string verbs = 1;

  // APIGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of

    # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
    # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
    # injectedAnnotations:
    #   container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
    #   container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default

	for _, container := range pod.Status.InitContainerStatuses {
		// Skip the container if the InitContainerName is not a match and our
		// InitContainerName filter is non-empty.
		if c.cfg.InitContainerName != "" && container.Name != c.cfg.InitContainerName {
			continue
		}

		// For safety, check the containers *current* status. If the container

- In ambient mode, the CNI plugin does not configure any networking,...

  // +optional
  optional DaemonSetUpdateStrategy updateStrategy = 3;

  // The minimum number of seconds for which a newly created DaemonSet pod should
  // be ready without any of its container crashing, for it to be considered
  // available. Defaults to 0 (pod will be considered available as soon as it
  // is ready).
  // +optional
  optional int32 minReadySeconds = 4;

      (d) If the Work includes a "NOTICE" text file as part of its
          distribution, then any Derivative Works that You distribute must
          include a readable copy of the attribution notices contained
          within such NOTICE file, excluding those notices that do not
          pertain to any part of the Derivative Works, in at least one
          of the following places: within a NOTICE text file distributed

      (d) If the Work includes a "NOTICE" text file as part of its
          distribution, then any Derivative Works that You distribute must
          include a readable copy of the attribution notices contained
          within such NOTICE file, excluding those notices that do not
          pertain to any part of the Derivative Works, in at least one
          of the following places: within a NOTICE text file distributed

      (d) If the Work includes a "NOTICE" text file as part of its
          distribution, then any Derivative Works that You distribute must
          include a readable copy of the attribution notices contained
          within such NOTICE file, excluding those notices that do not
          pertain to any part of the Derivative Works, in at least one
          of the following places: within a NOTICE text file distributed