// Pod explicitly asked to not have ambient redirection enabled
		return false
	}
	return true
}

// PodRedirectionActive reports on whether the pod _has_ actually been configured for traffic redirection.
//
// That is, have we annotated it after successfully sending it to the node proxy and set up iptables rules.
//
// If you just want to know if the pod _should be_ configured for traffic redirection, see PodRedirectionEnabled

		&cfg.InboundTunnelPort)

	flag.BindEnv(fs, constants.ProxyUID, "u",
		"Specify the UID of the user for which the redirection is not applied. Typically, this is the UID of the proxy container.",
		&cfg.ProxyUID)

	flag.BindEnv(fs, constants.ProxyGID, "g",
		"Specify the GID of the user for which the redirection is not applied (same default value as -u param).",
		&cfg.ProxyGID)

	flag.BindEnv(fs, constants.InboundInterceptionMode, "m",

For details, refer to the following guidelines.

## Key scripts

* [`verify-all.sh`](verify-all.sh): This script is a vestigial redirection, Please do not add "real" logic. It is equivalent to `make verify`.
* [`update-all.sh`](update-all.sh): This script is a vestigial redirection, Please do not add "real" logic. 
The `true` target of this makerule is `hack/make-rules/update.sh`.It is equivalent to `make update`.

## Attention

apiVersion: release-notes/v2
kind: feature
area: installation
issue:
  - 47257
releaseNotes:
  - |
    **Added** eBPF redirection support for ambient after CNCF established guidance around dual-licensed eBPF bytecode.

  A group can be specified either by name or by a numeric GID.
  The wildcard character `*` can be used to configure redirection of traffic from all groups
   (default).

  `ISTIO_OUTBOUND_OWNER_GROUPS_EXCLUDE` - is a comma separated list of groups whose outgoing
  traffic should be excluded from redirection to Envoy (sidecar).
  A group can be specified either by name or by a numeric GID.

# root or netadmin capability. The debian file creates user istio.
# ENVOY_USER=istio-proxy

# Uncomment to enable debugging
# ISTIO_AGENT_FLAGS="--proxyLogLevel debug"

# Directory for stdout redirection. The redirection is required because envoy attempts to open
# /dev/stdout - must be a real file. Will be used for access logs. Additional config for logsaver
# needs to be made, envoy reopens the file on SIGUSR1

issue:
  - 50736
releaseNotes:
- |
  **Added** Allow pods to be opted out of ambient capture using the `istio.io/dataplane-mode=none` label.

            .create(
                uri,
                allowInsecureProtocol,
                this::throwExceptionDueToInsecureProtocol,
                redirection -> throwExceptionDueToInsecureRedirect(uri, redirection)
            );
    }

    public static class Factory {
        private final FileResolver fileResolver;

        @Inject
        public Factory(FileResolver fileResolver) {

apiVersion: release-notes/v2
kind: feature
area: traffic-management
issue:
- 48212
releaseNotes:
- |

		&cfg.DryRun)

	flag.BindEnv(fs, constants.ProxyUID, "u",
		"Specify the UID of the user for which the redirection is not applied. Typically, this is the UID of the proxy container.",
		&cfg.ProxyUID)

	flag.BindEnv(fs, constants.ProxyGID, "g",
		"Specify the GID of the user for which the redirection is not applied (same default value as -u param).",
		&cfg.ProxyGID)