- `istio-cni`
    - CNI plugin executable copied to `/opt/cni/bin`
    - currently implemented for k8s only
    - on pod add, determines whether pod should have netns setup to redirect to Istio proxy. See [cmdAdd](#cmdadd-workflow) for detailed logic.
        - it connects to K8S using the kubeconfig and JWT token copied from install-cni to get Pod and Namespace. Since this is a short-running command, each invocation creates a new connection.

  // +optional
  // +patchStrategy=merge
  repeated string finalizers = 14;

  // ManagedFields maps workflow-id and version to the set of fields
  // that are managed by that workflow. This is mostly for internal
  // housekeeping, and users typically shouldn't need to set or
  // understand this field. A workflow can be the user's name, a
  // controller's name, or the name of a specific apply path like