description: |-
                  Specifies the failure behavior for the plugin due to fatal errors.

                  Valid Options: FAIL_CLOSE, FAIL_OPEN
                enum:
                - FAIL_CLOSE
                - FAIL_OPEN
                type: string
              imagePullPolicy:
                description: |-

		log.Errorf("failed to remove pod %s from host ipset, error was: %v", pod.Name, err)
		return err
	}

	log.Info("in pod mode - deleting pod from ztunnel")

	// pod is deleted, clean-up its open netns
	openNetns := s.currentPodSnapshot.Take(string(pod.UID))
	if openNetns == nil {
		log.Warn("failed to find pod netns")
	}

	if err := s.ztunnelServer.PodDeleted(ctx, string(pod.UID)); err != nil {

If there is no waypoint, ztunnel will enforce RBAC policies against the request.

If all checks pass, ztunnel will open a connection to the target. This will spoof the source IP (from `Forwarded` for waypoints, or the incoming IP otherwise).

                description: |-
                  Specifies the failure behavior for the plugin due to fatal errors.

                  Valid Options: FAIL_CLOSE, FAIL_OPEN
                enum:
                - FAIL_CLOSE
                - FAIL_OPEN
                type: string
              imagePullPolicy:
                description: |-