1. By running as a node-level daemonset that:

- listens for these UDS events from the CNI plugin (which fire when new pods are spawned in an ambient-enabled namespace), and adds those pods to the ambient mesh.
- watches k8s resource for existing pods, so that pods that have already been started can be moved in or out of the ambient mesh.

        multiple of the number of replicas.
    *   `tf.data.Dataset` now supports automatic data distribution and sharding
        in distributed environments, including on TPU pods.
    *   Distribution policies for `tf.data.Dataset` can now be tuned with 1.
        `tf.data.experimental.AutoShardPolicy(OFF, AUTO, FILE, DATA)` 2.
        `tf.data.experimental.ExternalStatePolicy(WARN, IGNORE, FAIL)`

## Redirection

As ztunnel aims to transparently encrypt and route users traffic, we need a mechanism to capture all traffic entering and leaving "mesh" pods.
This is a security critical task: if the ztunnel can be bypassed, authorization policies can be bypassed.

Redirection must meet these requirements:

!!! info
    If you are using Kubernetes, this would probably be an <a href="https://kubernetes.io/docs/concepts/workloads/pods/init-containers/" class="external-link" target="_blank">Init Container</a>.