//
	// We want to do the same thing in ambient but can't rely on podSpec injection. So, do effectively the same thing,
	// but with iptables rules - use `--socket-exists` as a proxy for "is this a forwarded packet" vs "is this originating from
	// a local node socket". If the latter, outside the pod in the host netns, redirect that traffic to a hardcoded/custom proxy

	if err != nil {
		return err
	}
	for _, vs := range virtualServices.Items {
		for _, hostname := range vs.Spec.Hosts {
			if host.Name(hostname).IsWildCarded() {
				res := ObjectToInstance(vs)
				messages.Add(msg.NewUpdateIncompatibility(res,
					"PERSIST_OLDEST_FIRST_HEURISTIC_FOR_VIRTUAL_SERVICE_HOST_MATCHING", "1.20",

	}
	v, f, err := tpath.GetFromStructPath(injectedCMValues, "global.multiCluster.clusterName")
	if err != nil {
		return "", err
	}
	vs, ok := v.(string)
	if !f || !ok {
		return "", fmt.Errorf("could not retrieve global.multiCluster.clusterName from injection config")
	}
	return vs, nil
}

// Because we are placing into an Unstructured, place as a map instead

      # There are currently two types of anti-affinity:
      #    "requiredDuringSchedulingIgnoredDuringExecution"
      #    "preferredDuringSchedulingIgnoredDuringExecution"
      # which denote "hard" vs. "soft" requirements, you can define your values
      # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
      # correspondingly.
      # For example:
      # podAntiAffinityLabelSelector:

      # There are currently two types of anti-affinity:
      #    "requiredDuringSchedulingIgnoredDuringExecution"
      #    "preferredDuringSchedulingIgnoredDuringExecution"
      # which denote "hard" vs. "soft" requirements, you can define your values
      # in "podAntiAffinityLabelSelector" and "podAntiAffinityTermLabelSelector"
      # correspondingly.
      # For example:
      # podAntiAffinityLabelSelector:

			},
			configDumps: map[string][]byte{
				"productpage-v1-1234567890": config,
				"ingress":                   []byte("{}"),
			},
			namespace:      "default",
			istioNamespace: "default",
			// case 9, vs route to multiple hosts
			args: strings.Split("service productpage", " "),
			expectedOutput: `Service: productpage
DestinationRule: productpage for "productpage"

		shouldBeEnabled := util.PodRedirectionEnabled(ns, newPod)

		// We should check the latest annotation vs desired status
		changeNeeded := isAnnotated != shouldBeEnabled
		// Also need change for case user manually rolls out the pods
		changeNeeded = changeNeeded || (wasAnnotated && isOpOut && !shouldBeEnabled)

		}
	}

	if matches == 0 {
		if len(vs.Spec.Http) > 0 {
			fmt.Fprintf(writer, "%sWARNING: No destinations match pod subsets (checked %d HTTP routes)\n",
				printSpaces(initPrintNum+printLevel1), len(vs.Spec.Http))
		}
		if len(vs.Spec.Tcp) > 0 {
			fmt.Fprintf(writer, "%sWARNING: No destinations match pod subsets (checked %d TCP routes)\n",
				printSpaces(initPrintNum+printLevel1), len(vs.Spec.Tcp))
		}

		} else {
			// This is unexpected, bubble up to an error. Might be missing event, or invalid assumption in our code.
			// Either way, we will skip.
			log.Errorf("Skipping pod, already repaired with an unexpected UID %v vs %v", uid, pod.UID)
		}
		return nil
	}
	log.Infof("Repairing pod...")

	// Fetch the pod's network namespace. This must run in the host process due to how the procfs /ns/net works.

istio heritage: Tiller release: istio name: virtualservices.networking.istio.io spec: group: networking.istio.io names: categories: - istio-io - networking-istio-io kind: VirtualService listKind: VirtualServiceList plural: virtualservices shortNames: - vs singular: virtualservice scope: Namespaced versions: - additionalPrinterCol: - description: The names of gateways and sidecars that should apply these routes jsonPath: .spec.gateways name: Gateways type: string - description: The destination hosts to...