default            reviews-v3-5b9bd44f4-z9ms4                           10.244.1.43 ambient-worker        None                                HBONE
default            sleep-7656cf8794-lxcmx                               10.244.2.58 ambient-worker2       None                                HBONE

	CNIAgentRunDir           = "cni-agent-run-dir"
	ExcludeNamespaces        = "exclude-namespaces"
	AmbientEnabled           = "ambient-enabled"
	AmbientDNSCapture        = "ambient-dns-capture"
	AmbientIPv6              = "ambient-ipv6"
	AmbientTPROXYRedirection = "ambient-tproxy-redirection"

	// Repair
	RepairEnabled            = "repair-enabled"
	RepairDeletePods         = "repair-delete-pods"

### Ambient Integration Tests

- **Location**: `tests/integration/ambient`
- **Purpose**: Tests related to the Ambient mode, including components like `ztunnel`.
- **Focus**:
  1. Configuration and communication of Ambient components.
  1. Interaction between `ztunnel` and Ambient components.
  1. Validation of zero-trust security policies.
  1. Testing of ambient traffic management.

      "workloadName": "ratings-v1",
      "workloadType": "deployment",
      "canonicalName": "ratings",
      "canonicalRevision": "v1",
      "network": "network1",
      "node": "ambient-worker2",
      "nativeTunnel": true,
      "status": "Healthy",
      "clusterId": "Kubernetes"
    },
    "/10.244.2.58": {
      "workloadIps": [
        "10.244.2.58"
      ],
      "protocol": "HBONE",

default   details-v1-698d88b-krdw7       10.244.2.55 ambient-worker2 None     HBONE
default   httpbin-7447985f87-t8hv7       10.244.1.40 ambient-worker  None     TCP
default   productpage-v1-675fc69cf-kkrm2 10.244.2.56 ambient-worker2 None     HBONE
default   ratings-v1-6484c4d9bb-8xc2r    10.244.2.57 ambient-worker2 None     HBONE
default   reviews-v1-5b5d6494f4-c7z5w    10.244.1.41 ambient-worker  None     HBONE

	}
	tests := []struct {
		name string
		args args
		want bool
	}{
		{
			name: "ambient mode enabled for namespace",
			args: args{
				namespace: namespaceWithAmbientEnabledLabel,
				pod:       unlabelledPod,
			},
			want: true,
		},
		{
			name: "ambient mode enabled for pod",
			args: args{
				namespace: unlabelledNamespace,
				pod:       podWithAmbientEnabledLabel,

- In ambient mode, the CNI plugin does not configure any networking, but is only responsible for synchronously pushing new pod events back up to an ambient watch server which runs as part of the Istio CNI node agent. The ambient server will find the pod netns and configure networking inside that pod via iptables. The ambient server will additionally watch enabled namespaces, and enroll already-started-but-newly-enrolled...

// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package ambient

import (
	"context"
	"strings"

	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

	"istio.io/api/annotation"
	"istio.io/api/label"
	"istio.io/istio/pkg/config/constants"

	nss := []runtime.Object{
		createNamespace("default", nil),
		createNamespace("kube-system", nil),
		createNamespace("istio-system", nil),
		createNamespace("ambient", map[string]string{
			label.IoIstioDataplaneMode.Name: constants.DataplaneModeAmbient,
		}),
		createNamespace("no-ambient", map[string]string{
			label.IoIstioDataplaneMode.Name: constants.DataplaneModeAmbient,
			"istio-injection":               "enabled",
		}),
	}

	if err != nil {
		return nil, fmt.Errorf("failed to get pod %s/%s: %v", namespace, name, err)
	}

	// This shouldn't happen - we only trigger this when a pod is added to ambient.
	if ambientPod == nil {
		return nil, fmt.Errorf("pod %s/%s is unexpectedly not enrolled in ambient", namespace, name)
	}
	return ambientPod, nil