imagePullPolicy: {{ $.ImagePullPolicy }}
        securityContext: # to allow core dumps
          readOnlyRootFilesystem: false
{{- end }}
{{- if $.IncludeExtAuthz }}
      - name: ext-authz
        image: {{ $.ImageHub }}/ext-authz:{{ $.ImageTag }}
        imagePullPolicy: {{ $.ImagePullPolicy }}
        ports:
        - containerPort: 8000
        - containerPort: 9000
{{- end }}
{{- range $i, $appContainer := $.AppContainers }}

      {{- if $.ImagePullSecretName }}
      imagePullSecrets:
      - name: {{ $.ImagePullSecretName }}
      {{- end }}
      containers:
      - name: istio-proxy
        image: {{ $.ImageHub }}/{{ $.VM.Image }}:{{ $.ImageTag }}
        imagePullPolicy: {{ $.ImagePullPolicy }}
        securityContext:
          capabilities:
            add:
            - NET_ADMIN

			if subset.Labels == nil {
				subset.Labels = make(map[string]string)
			}
			subset.Labels[constants.AmbientUseWaypointLabel] = cfg.WorkloadWaypointProxy
		}
	}

	params := map[string]any{
		"ImageHub":                settings.Image.Hub,
		"ImageTag":                settings.Image.Tag,
		"ImagePullPolicy":         settings.Image.PullPolicy,
		"ImagePullSecretName":     imagePullSecretName,