pod.Spec.Containers = []corev1.Container{app, proxy}
	pod.ObjectMeta.Annotations = map[string]string{annotation.SidecarStatus.Name: "true"}
	ns.ObjectMeta.Labels = map[string]string{constants.DataplaneModeLabel: constants.DataplaneModeAmbient}

	testDoAddRun(t, cniConf, testNSName, pod, ns)

	wasCalled := serverClose()
	// Pod has sidecar annotation from injector, should not be added to mesh
	assert.Equal(t, wasCalled, false)
}

        - --proxyLogLevel
        - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}}
        - --proxyComponentLogLevel
        - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}}
        - --log_output_level
        - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}}

	"k8s.io/client-go/kubernetes"

	"istio.io/api/annotation"
	"istio.io/istio/pkg/config/constants"
)

var annotationPatch = []byte(fmt.Sprintf(
	`{"metadata":{"annotations":{"%s":"%s"}}}`,
	constants.AmbientRedirection,
	constants.AmbientRedirectionEnabled,
))

var annotationRemovePatch = []byte(fmt.Sprintf(
	`{"metadata":{"annotations":{"%s":null}}}`,
	constants.AmbientRedirection,
))

		}
		wasAnnotated := oldPod.Annotations != nil && oldPod.Annotations[constants.AmbientRedirection] == constants.AmbientRedirectionEnabled
		isAnnotated := newPod.Annotations != nil && newPod.Annotations[constants.AmbientRedirection] == constants.AmbientRedirectionEnabled
		shouldBeEnabled := util.PodRedirectionEnabled(ns, newPod)

		// We should check the latest annotation vs desired status

				Name:      "test",
				Namespace: "test",
			},
		}

		podWithSidecar = &corev1.Pod{
			ObjectMeta: metav1.ObjectMeta{
				Name:        "test",
				Namespace:   "test",
				Annotations: sidecarStatusAnnotation,
			},
		}

		podWithAmbientDisabledLabel = &corev1.Pod{
			ObjectMeta: metav1.ObjectMeta{
				Name:      "test",
				Namespace: "test",
				Labels:    ambientDisabledLabel,

imagePullSecrets:
  {{- range . }}
  - name: {{ . }}
  {{- end }}
  {{- end }}
metadata:
  name: ztunnel
  namespace: {{ .Release.Namespace }}
  labels:
    {{- .Values.labels | toYaml | nindent 4}}
  annotations:
    {{- .Values.annotations | toYaml | nindent 4 }}
---
{{- if (eq .Values.platform "openshift") }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ztunnel
  labels:
    app: ztunnel

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: ztunnel
  namespace: {{ .Release.Namespace }}
  labels:
    {{- .Values.labels | toYaml | nindent 4}}
  annotations:
    {{- .Values.annotations | toYaml | nindent 4 }}
spec:
  updateStrategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: ztunnel
  template:
    metadata:
      labels:

    - Get the port list from pods definition, as well as annotations.
    - Setup iptables with required port list: `nsenter --net=<k8s pod netns> /opt/cni/bin/istio-iptables ...`. Following conditions will prevent the redirect rules to be setup in the pods:
        - Pods have annotation `sidecar.istio.io/inject` set to `false` or has no key `sidecar.istio.io/status` in annotations

        sidecar.istio.io/inject: "false"
        istio.io/dataplane-mode: none
      annotations:
        sidecar.istio.io/inject: "false"
        # Add Prometheus Scrape annotations
        prometheus.io/scrape: 'true'
        prometheus.io/port: "15014"
        prometheus.io/path: '/metrics'
        # Custom annotations
        {{- if .Values.cni.podAnnotations }}
{{ toYaml .Values.cni.podAnnotations | indent 8 }}

				log.Infof("excluded due to inject-disabled annotation")
				return nil
			}
		}
	}

	if _, ok := pi.Annotations[sidecarStatusKey]; !ok {
		log.Infof("excluded due to not containing sidecar annotation")
		return nil
	}

	log.Debugf("Setting up redirect")

	redirect, err := NewRedirect(pi)
	if err != nil {
		log.Errorf("redirect failed due to bad params: %v", err)
		return err
	}