In ambient mode, the CNI plugin is effectively just a shim to catch pod creation events and notify the CNI agent early enough to set up network redirection before the pod is fully started. This is necessary because the CNI plugin is effectively the first thing to see a scheduled pod - before the K8S control plane will see things like the pod IP or networking info, the CNI will - but the CNI plugin alone is not sufficient to...

                              maximum: 4294967295
                              minimum: 0
                              type: integer
                            service:
                              description: The fully qualified service name for this
                                cluster.
                              type: string
                            subset:

  * In practice, this largely means that references are fully qualified in the API. IP Addresses (generally) have a network associated with them, node names have a cluster associated with them, etc.

                              maximum: 4294967295
                              minimum: 0
                              type: integer
                            service:
                              description: The fully qualified service name for this
                                cluster.
                              type: string
                            subset:

      # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
      deletePods: false
      # repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
      # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.