# has no effect on outbound traffic: iptables REDIRECT is always used for
  # outbound connections.
  # If "REDIRECT", use iptables REDIRECT to NAT and redirect to Envoy.
  # The "REDIRECT" mode loses source addresses during redirection.
  # If "TPROXY", use iptables TPROXY to redirect to Envoy.
  # The "TPROXY" mode preserves both the source and destination IP
  # addresses and ports, so that they can be used for advanced filtering
  # and manipulation.

  labels:
    istio.io/dataplane-mode: ambient
---
apiVersion: v1
kind: Pod
metadata:
  name: random-pod-ambient
  namespace: ns-ambient
  labels:
    app: ambient
  annotations:
    ambient.istio.io/redirection: enabled
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: namespace-scoped
  namespace: ns-ambient
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:

MINIO_IDENTITY_OPENID_SCOPES="openid,groups"
MINIO_IDENTITY_OPENID_REDIRECT_URI="http://127.0.0.1:10000/oauth_callback"
MINIO_IDENTITY_OPENID_CLAIM_NAME="groups"
```
</details>

### Redirection from OpenID Provider

The ambient CNI agent is the only place where ambient network config and pod redirection machinery happens.

spec:
  selector:
    matchLabels:
      istio: pilot
  strategy:
    rollingUpdate:
      maxSurge: 100%
      maxUnavailable: 25%
  template:
    metadata:
      annotations:
        ambient.istio.io/redirection: disabled
        prometheus.io/port: "15014"
        prometheus.io/scrape: "true"
        sidecar.istio.io/inject: "false"
      labels:
        app: istiod
        install.operator.istio.io/owning-resource: unknown

spec:
  selector:
    matchLabels:
      istio: pilot
  strategy:
    rollingUpdate:
      maxSurge: 100%
      maxUnavailable: 25%
  template:
    metadata:
      annotations:
        ambient.istio.io/redirection: disabled
        prometheus.io/port: "15014"
        prometheus.io/scrape: "true"
        sidecar.istio.io/inject: "false"
      labels:
        app: istiod
        install.operator.istio.io/owning-resource: unknown

spec:
  selector:
    matchLabels:
      istio: pilot
  strategy:
    rollingUpdate:
      maxSurge: 100%
      maxUnavailable: 25%
  template:
    metadata:
      annotations:
        ambient.istio.io/redirection: disabled
        prometheus.io/port: "15014"
        prometheus.io/scrape: "true"
        sidecar.istio.io/inject: "false"
      labels:
        app: istiod
        install.operator.istio.io/owning-resource: unknown

    @RequiredFeature(feature = GradleMetadataResolveRunner.GRADLE_METADATA, value = "true")
    def "can resolve unique and non-unique snapshots using Gradle Module Metadata (redirection = #redirection, metadata sources=#metadataSources)"() {
        given:
        buildFile << """
repositories.clear()
repositories {
    maven {
      url "${mavenHttpRepo.uri}"
      metadataSources {

spec: {}
---
apiVersion: v1
kind: Pod
metadata:
  name: ignore-istio-annotations
  annotations:
    # annotations not set by user, should not warn
    istio.io/rev: rev
    ambient.istio.io/redirection: enabled
spec:
  containers:
  - name: "foo"

			args: args{
				namespace: namespaceWithAmbientEnabledLabel,
				pod:       podWithSidecar,
			},
			want: false,
		},
		{
			name: "pod has label to disable ambient redirection",
			args: args{
				namespace: namespaceWithAmbientEnabledLabel,
				pod:       podWithAmbientDisabledLabel,
			},
			want: false,
		},
		{
			name: "pod has sidecar, pod has ambient mode label",