currentPodCache: map[string]WorkloadInfo{},
	}
}

func (p *podNetnsCache) UpsertPodCache(pod *corev1.Pod, nspath string) (Netns, error) {
	newnetns, err := p.openNetns(nspath)
	if err != nil {
		return nil, err
	}
	wl := WorkloadInfo{
		Workload: podToWorkload(pod),
		Netns:    newnetns,
	}
	return p.UpsertPodCacheWithNetns(string(pod.UID), wl), nil
}

func TestDoubleTake(t *testing.T) {
	p := newPodNetnsCache(openNsTestOverride)

	pod := &corev1.Pod{ObjectMeta: metav1.ObjectMeta{UID: "testUID"}}
	ns := newFakeNs(inc())
	wl := WorkloadInfo{
		Workload: podToWorkload(pod),
		Netns:    ns,
	}
	netns1 := p.UpsertPodCacheWithNetns(string(pod.UID), wl)
	netnsTaken := p.Take(string(pod.UID))
	if netns1 != netnsTaken {

func (c *Controller) repairPod(pod *corev1.Pod) error {
	m := podsRepaired.With(typeLabel.Value(repairType))
	log := repairLog.WithLabels("pod", pod.Namespace+"/"+pod.Name)
	key := types.NamespacedName{Name: pod.Name, Namespace: pod.Namespace}
	// We will get an event every time the pod changes. The repair is not instantaneous, though -- it will only recover
	// once the pod restarts (in CrashLoopBackoff), which can take some time.

func (s *InformerHandlers) GetAmbientPods() []*corev1.Pod {
	var pods []*corev1.Pod
	for _, pod := range s.pods.List(metav1.NamespaceAll, klabels.Everything()) {
		ns := s.namespaces.Get(pod.Namespace, "")
		if ns == nil {
			log.Warnf("failed to find namespace %s for pod %s", pod.Namespace, pod.Name)
		}

		if !util.IsZtunnelPod(s.systemNamespace, pod) && util.PodRedirectionEnabled(ns, pod) {
			pods = append(pods, pod)
		}
	}

// containers fetches all containers in the pod.
// This is used to extract init containers (istio-init and istio-validation), and the sidecar.
// The sidecar can be a normal container or init in Kubernetes 1.28+
func containers(pod *v1.Pod) []v1.Container {
	res := make([]v1.Container, 0, len(pod.Spec.Containers)+len(pod.Spec.InitContainers))
	res = append(res, pod.Spec.InitContainers...)
	res = append(res, pod.Spec.Containers...)
	return res
}

- one end of the socket is in the application pod
- and the other end is in ztunnel's pod

and setting up iptables rules to funnel traffic thru that socket "tube" to ztunnel and back.

This effectively behaves like ztunnel is an in-pod sidecar, without actually requiring the injection of ztunnel as a sidecar into the pod manifest, or mutatating the application pod in any way.

		Long:  `Retrieve information about cluster configuration for the Envoy instance in the specified pod.`,
		Example: `  # Retrieve summary about cluster configuration for a given pod from Envoy.
  istioctl proxy-config clusters <pod-name[.namespace]>

  # Retrieve cluster summary for clusters with port 9080.
  istioctl proxy-config clusters <pod-name[.namespace]> --port 9080

	pod := &corev1.Pod{
		ObjectMeta: metav1.ObjectMeta{
			Name:      "test",
			Namespace: "test",
		},
		Spec: corev1.PodSpec{
			NodeName: "derp",
		},
		Status: corev1.PodStatus{
			PodIP:  "2.2.2.2",
			PodIPs: []corev1.PodIP{{IP: "2.2.2.2"}, {IP: "3.3.3.3"}},
		},
	}

	podIPs := GetPodIPsIfPresent(pod)
	assert.Equal(t, len(podIPs), 2)
}

func TestGetPodIPsIfNoPodIPPresent(t *testing.T) {
	pod := &corev1.Pod{

	Annotations         map[string]string
	InitContainerName   string
	InitContainerStatus *corev1.ContainerStatus
	NodeName            string
}

func makePod(args makePodArgs) *corev1.Pod {
	pod := &corev1.Pod{
		TypeMeta: metav1.TypeMeta{
			Kind:       "Pod",
			APIVersion: "v1",
		},
		ObjectMeta: metav1.ObjectMeta{
			Name:        args.PodName,
			Namespace:   "default",
			Labels:      args.Labels,

// an actual pod condition type.
message PodFailurePolicyOnPodConditionsPattern {
  // Specifies the required Pod condition type. To match a pod condition
  // it is required that specified type equals the pod condition type.
  optional string type = 1;

  // Specifies the required Pod condition status. To match a pod condition