The ambient CNI agent is the only place where ambient network config and pod redirection machinery happens.

	@bin/check_samples.sh
	@testlinter
	@envvarlinter istioctl pilot security

# Allow-list:
# (k8s) Machinery, utils, klog
# (proto) Istio API non-CRDs, MeshConfig and ProxyConfig
# (proto) Envoy TLS proto for SDS
# (proto) Envoy Wasm filters for wasm xDS proxy
# (proto) xDS discovery service for xDS proxy

    iwh("Injection Patcher")
    aex("Auto Service Export")
    scr-->mcsc
    ksd-->mcsc
    nsc-->ksd
    wes-->ksd
    iwh-->ksd
    aex-->ksd
```

#### VMs

Virtual Machine support consists of two controllers.

  // The message must not contain line breaks.
  // If unset, the message is "failed Expression: {Expression}".
  // +optional
  optional string message = 2;

  // Reason represents a machine-readable description of why this validation failed.
  // If this is the first validation in the list to fail, this reason, as well as the
  // corresponding HTTP response code, are used in the
  // HTTP response to the client.