// TODO: when there exists a means for users to signal the intent to exclude a pod from ambient without requiring the use of
		// the ambient redirection annotation, this annotation should no longer be checked by this function and this case should return 'true'
		{
			name: "pod has annotation to disable ambient redirection",
			args: args{
				namespace: namespaceWithAmbientEnabledLabel,
				pod:       podWithAmbientDisabledAnnotation,
			},

  # has no effect on outbound traffic: iptables REDIRECT is always used for
  # outbound connections.
  # If "REDIRECT", use iptables REDIRECT to NAT and redirect to Envoy.
  # The "REDIRECT" mode loses source addresses during redirection.
  # If "TPROXY", use iptables TPROXY to redirect to Envoy.
  # The "TPROXY" mode preserves both the source and destination IP
  # addresses and ports, so that they can be used for advanced filtering
  # and manipulation.

## Redirection

As ztunnel aims to transparently encrypt and route users traffic, we need a mechanism to capture all traffic entering and leaving "mesh" pods.
This is a security critical task: if the ztunnel can be bypassed, authorization policies can be bypassed.

Redirection must meet these requirements:

MINIO_IDENTITY_OPENID_SCOPES="openid,groups"
MINIO_IDENTITY_OPENID_REDIRECT_URI="http://127.0.0.1:10000/oauth_callback"
MINIO_IDENTITY_OPENID_CLAIM_NAME="groups"
```
</details>

### Redirection from OpenID Provider

            joinUninterruptibly(interruptingThread, 2500, MILLISECONDS);
            Thread.interrupted();
            if (interruptingThread.isAlive()) {
              // This will be hidden by test-output redirection:
              logger.severe("InterruptenatorTask did not exit; future tests may be affected");
              /*
               * This won't do any good under JUnit 3, but I'll leave it around in

            joinUninterruptibly(interruptingThread, 2500, MILLISECONDS);
            Thread.interrupted();
            if (interruptingThread.isAlive()) {
              // This will be hidden by test-output redirection:
              logger.severe("InterruptenatorTask did not exit; future tests may be affected");
              /*
               * This won't do any good under JUnit 3, but I'll leave it around in

The ambient CNI agent is the only place where ambient network config and pod redirection machinery happens.

    provider: "default"

    # Configure ambient settings
    ambient:
      # If enabled, ambient redirection will be enabled
      enabled: false
      # Set ambient config dir path: defaults to /etc/ambient-config
      configDir: ""
      # If enabled, and ambient is enabled, DNS redirection will be enabled
      dnsCapture: false


    repair:
      enabled: true
      hub: ""
      tag: ""

  template:
    metadata:
      labels:
        sidecar.istio.io/inject: "false"
        app: ztunnel
{{ with .Values.podLabels -}}{{ toYaml . | indent 8 }}{{ end }}
      annotations:
        ambient.istio.io/redirection: disabled
        sidecar.istio.io/inject: "false"
{{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }}
    spec:
      nodeSelector:
        kubernetes.io/os: linux
      serviceAccountName: ztunnel

		return fmt.Errorf("get netns: %v", err)
	}
	log = log.WithLabels("netns", netns)

	if err := redirectRunningPod(pod, netns); err != nil {
		log.Errorf("failed to setup redirection: %v", err)
		m.With(resultLabel.Value(resultFail)).Increment()
		return err
	}
	c.repairedPods[key] = pod.UID
	log.Infof("pod repaired")
	m.With(resultLabel.Value(resultSuccess)).Increment()
	return nil