optional string whenDeleted = 1;

  // whenScaled specifies what happens to PVCs created from StatefulSet
  // VolumeClaimTemplates when the StatefulSet is scaled down. The default
  // policy of `Retain` causes PVCs to not be affected by a scaledown. The
  // `Delete` policy causes the associated PVCs for any excess pods above
  // the replica count to be deleted.
  optional string whenScaled = 2;
}

	slices.SortFunc(pols, func(a, b *ZtunnelPolicy) int {
		if r := cmp.Compare(a.Namespace, b.Namespace); r != 0 {
			return r
		}
		return cmp.Compare(a.Name, b.Name)
	})
	fmt.Fprintln(w, "NAMESPACE\tPOLICY NAME\tACTION\tSCOPE")

	for _, pol := range pols {
		fmt.Fprintf(w, "%v\t%v\t%v\t%v\n",
			pol.Namespace, pol.Name, pol.Action, pol.Scope)
	}
	return w.Flush()
}

Note: this does mean that the namespace the gateway is deployed in must not have the `istio-injection=disabled` label.
See [Controlling the injection policy](https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/#controlling-the-injection-policy) for more info.

### Examples

#### Egress Gateway

	common := new(commonFlags)
	cmd := &cobra.Command{
		Use:   "policy",
		Short: "Retrieves policies for the specified Ztunnel pod.",
		Long:  `Retrieve information about policies for the Ztunnel instance.`,
		Example: `  # Retrieve summary about policy configuration for a randomly chosen ztunnel.
  istioctl x ztunnel-config policies

  # Retrieve full policy dump of workloads for a given Ztunnel instance.

    defaultTemplates:
{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
    - {{ . }}
{{- end }}
    {{- else }}
    defaultTemplates: [sidecar]
    {{- end }}
    policy: {{ .Values.global.proxy.autoInject }}
    alwaysInjectSelector:
{{ toYaml .Values.sidecarInjectorWebhook.alwaysInjectSelector | trim | indent 6 }}
    neverInjectSelector:

  // +optional
  repeated ImageReviewContainerSpec containers = 1;

  // Annotations is a list of key-value pairs extracted from the Pod's annotations.
  // It only includes keys which match the pattern `*.image-policy.k8s.io/*`.
  // It is up to each webhook backend to determine how to interpret these annotations, if at all.
  // +optional
  map<string, string> annotations = 2;

  // Namespace is the namespace the pod is being created in.

  optional int32 maxReplicas = 3;

  // targetCPUUtilizationPercentage is the target average CPU utilization (represented as a percentage of requested CPU) over all the pods;
  // if not specified the default autoscaling policy will be used.
  // +optional
  optional int32 targetCPUUtilizationPercentage = 4;
}

// current status of a horizontal pod autoscaler
message HorizontalPodAutoscalerStatus {