ipFamilyPolicy: ""
    ipFamilies: []

  sidecarInjectorWebhook:
    # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
    # always skip the injection on pods that match that label selector, regardless of the global policy.

  // reinvocationPolicy indicates whether this webhook should be called multiple times as part of a single admission evaluation.
  // Allowed values are "Never" and "IfNeeded".
  //
  // Never: the webhook will not be called more than once in a single admission evaluation.
  //
  // IfNeeded: the webhook will be called at least one additional time as part of the admission evaluation

  // reinvocationPolicy indicates whether this webhook should be called multiple times as part of a single admission evaluation.
  // Allowed values are "Never" and "IfNeeded".
  //
  // Never: the webhook will not be called more than once in a single admission evaluation.
  //
  // IfNeeded: the webhook will be called at least one additional time as part of the admission evaluation

// K8S may get a pod Add event without any IPs in the object, and the pod will later be updated with IPs.
//
// We always need the IPs, but this is fine because this AddPodToMesh can be called from the CNI plugin as well,
// which always has the firsthand info of the IPs, even before K8S does - so we pass them separately here because
// we actually may have them before K8S in the Pod object.

  // If the CSIDriverRegistry feature gate is enabled and the value is
  // specified to false, the attach operation will be skipped.
  // Otherwise the attach operation will be called.
  //
  // This field is immutable.
  //
  // +optional
  optional bool attachRequired = 1;

  // podInfoOnMount indicates this CSI volume driver requires additional pod information (like podName, podUID, etc.)

      return 2
    fi
  done
}

# load_cluster_topology function reads cluster configuration topology file and
# sets up environment variables used by other functions. So this should be called
# before anything else.
#
# Note: Cluster configuration topology file specifies basic configuration of each
# KinD cluster like its name, pod and service subnets and network_id. If two cluster

	ns.ObjectMeta.Labels = map[string]string{constants.DataplaneModeLabel: constants.DataplaneModeAmbient}

	testCmdAddExpectFail(t, cniConf, pod, ns)

	wasCalled := serverClose()
	// server called, but errored
	assert.Equal(t, wasCalled, true)
}

func TestCmdAddPodWithProxySidecarAmbientEnabledNS(t *testing.T) {
	url, serverClose := setupCNIEventClientWithMockServer(false)

		kubeClient: client.Kube(),
		netServer:  fs,
	}

	handlers := setupHandlers(ctx, client, server, "istio-system")
	client.RunAndWait(ctx.Done())
	go handlers.Start()
	// wait until pod add was called
	mt.Assert(EventTotals.Name(), map[string]string{"type": "update"}, monitortest.AtLeast(1))

	log.Debug("labeling namespace")
	_, err := client.Kube().CoreV1().Namespaces().Patch(ctx, ns.Name,

	pod := &corev1.Pod{
		ObjectMeta: metav1.ObjectMeta{
			Name:      "foo",
			Namespace: "bar",
			UID:       "123",
		},
		Spec: corev1.PodSpec{ServiceAccountName: "sa"},
	}

	// this is usually called after add. so manually add the pod uid for now
	fakens := newFakeNs(123)
	closed := fakens.closed
	workload := WorkloadInfo{
		Workload: podToWorkload(pod),
		Netns:    fakens,
	}

  // If the CSIDriverRegistry feature gate is enabled and the value is
  // specified to false, the attach operation will be skipped.
  // Otherwise the attach operation will be called.
  //
  // This field is immutable.
  //
  // +optional
  optional bool attachRequired = 1;

  // podInfoOnMount indicates this CSI volume driver requires additional pod information (like podName, podUID, etc.)