{
                             "key": "request.auth.claims"
                            },
                            {
                             "key": "iss"
                            }
                           ],
                           "value": {
                            "list_match": {
                             "one_of": {

			// and skip the event.
			//
			// This isn't perfect (someone could manually annotate an unready pod,
			// then install Istio, then the pod goes ready, and we'd miss capture) - but that
			// seems vanishingly unlikely
			wasReady := kube.CheckPodReadyOrComplete(oldPod)
			isReady := kube.CheckPodReadyOrComplete(newPod)
			if wasReady != nil && isReady != nil && isAnnotated {

  //
  // This field is not supported when watch is true. Clients may start a watch from the last
  // resourceVersion value returned by the server and not miss any modifications.
  optional string continue = 8;

  // `sendInitialEvents=true` may be set together with `watch=true`.
  // In that case, the watch stream will begin with synthetic events to