cidr := r.AddressPrefix
					pl := r.PrefixLen.GetValue()
					if pl != 32 && pl != 128 {
						cidr += fmt.Sprintf("/%d", pl)
					}
					m[cidr] = rm.OnMatch
				}
			}
		default:
			panic("unhandled")
		}
	}
	outputs := []string{}
	for k, v := range m {
		switch v := v.GetOnMatch().(type) {
		case *matcher.Matcher_OnMatch_Action:
			if v.Action.GetName() == name {

    # Only one environment should have this enabled.
    enableNamespacesByDefault: false

    # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
    # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.

This works out to be more efficient in common cases where policies change much less often than workloads.
This only applies for selector-based policies; namespaced and global policies can be handled without needing to list them out in the Workload API.

## Redirection

As ztunnel aims to transparently encrypt and route users traffic, we need a mechanism to capture all traffic entering and leaving "mesh" pods.

		// We have no good way to distinguish between these two cases from here. But we don't need to!
		// Existing pods will be handled by the dataplane using `GetAmbientPods`,
		// and the initial enqueueNamespace, and new pods will be handled by the CNI.

	case controllers.EventUpdate:
		// For update, we just need to handle opt outs
		newPod := event.New.(*corev1.Pod)

* For manual cherry-picks:
    * Large fixes, where the LOC>100 not withstanding unit tests changes, require subject-matter expert approval.

  repeated k8s.io.api.admissionregistration.v1.RuleWithOperations rules = 3;

  // FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
  // allowed values are Ignore or Fail. Defaults to Ignore.
  // +optional
  optional string failurePolicy = 4;

  // matchPolicy defines how the "rules" list is used to match incoming requests.

        # - name: import-shadowing
        # - name: modifies-value-receiver
        # - name: unused-receiver
        # - name: bare-return
        # - name: flag-parameter
        # - name: unhandled-error
        # - name: if-return
  unparam:
    # Inspect exported functions, default is false. Set to true if no external program/library imports your code.

  // it is required that the specified status equals the pod condition status.
  // Defaults to True.
  optional string status = 2;
}

// PodFailurePolicyRule describes how a pod failure is handled when the requirements are met.
// One of onExitCodes and onPodConditions, but not both, can be used in each rule.
message PodFailurePolicyRule {
  // Specifies the action taken on a pod failure when the requirements are satisfied.

  // on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.
  repeated RuleWithOperations rules = 3;

  // FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
  // allowed values are Ignore or Fail. Defaults to Fail.
  // +optional
  optional string failurePolicy = 4;

  // matchPolicy defines how the "rules" list is used to match incoming requests.

  // capacity is made available exclusively to this priority level.
  // Required.
  // +unionDiscriminator
  optional string type = 1;

  // `limited` specifies how requests are handled for a Limited priority level.
  // This field must be non-empty if and only if `type` is `"Limited"`.
  // +optional
  optional LimitedPriorityLevelConfiguration limited = 2;
}