- NET_ADMIN
              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
              - NET_RAW
              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
              # network namespaces in `/proc` to obtain descriptors for entering pod netnamespaces.
              # There does not appear to be a more granular capability for this.
              - SYS_ADMIN

    injectedAnnotations:
      {{- range $key, $val := .Values.sidecarInjectorWebhook.injectedAnnotations }}
      "{{ $key }}": {{ $val | quote }}
      {{- end }}
    {{- /* If someone ends up with this new template, but an older Istiod image, they will attempt to render this template
         which will fail with "Pod injection failed: template: inject:1: function "Istio_1_9_Required_Template_And_Version_Mismatched" not defined".

            desc: "don't use the protojson package directly; use util/protomarshal instead"
          - pkg: gomodules.xyz/jsonpatch/v3
            desc: "don't use v3; v2 is orders of magnitude higher performance"
          - pkg: k8s.io/apimachinery/pkg/util/sets
            desc: "use istio.io/istio/pkg/util/sets"
          - pkg: k8s.io/utils/env
            desc: "use istio.io/istio/pkg/env"