**Affected Versions**:
  - kube-apiserver v1.29.0 - v1.29.3
  - kube-apiserver v1.28.0 - v1.28.8
  - kube-apiserver <= v1.27.12

**Fixed Versions**:
  - kube-apiserver v1.29.4
  - kube-apiserver v1.28.9
  - kube-apiserver v1.27.13

This vulnerability was reported by tha3e1vl.

doubt re-run istioctl kube-inject on deployments to get the most up-to-date changes.

It's best to do kube-inject when the resource is initially created.
`,
		Example: `  # Update resources on the fly before applying.
  kubectl apply -f <(istioctl kube-inject -f <resource.yaml>)

  # Create a persistent version of the deployment with Istio sidecar injected.
  istioctl kube-inject -f deployment.yaml -o deployment-injected.yaml

10.244.0.3:53                                    HEALTHY                  outbound|53||kube-dns.kube-system.svc.cluster.local
10.244.0.8:9153                                  HEALTHY                  outbound|9153||kube-dns.kube-system.svc.cluster.local
10.244.0.3:9153                                  HEALTHY                  outbound|9153||kube-dns.kube-system.svc.cluster.local

	clients   map[string]kube.CLIClient
	rootFlags *RootFlags
	results   map[string][]byte
	objects   []runtime.Object
	version   string
}

func (f *fakeInstance) CLIClientWithRevision(rev string) (kube.CLIClient, error) {
	if _, ok := f.clients[rev]; !ok {
		var cliclient kube.CLIClient
		if f.version != "" {
			cliclient = kube.NewFakeClientWithVersion(f.version, f.objects...)
		} else {

[registry.k8s.io/kube-proxy:v1.32.0-alpha.3](https://c...

	"istio.io/istio/pkg/config/analysis/analyzers/injection"
	analyzer_util "istio.io/istio/pkg/config/analysis/analyzers/util"
	"istio.io/istio/pkg/config/resource"
	"istio.io/istio/pkg/kube"
	"istio.io/istio/pkg/kube/inject"
	"istio.io/istio/pkg/slices"
	"istio.io/istio/pkg/util/sets"
)

type revisionCount struct {
	// pods in a revision
	pods int
	// pods that are disabled from injection
	disabled int

	labelSelector := centralOpts.XdsPodLabel
	if labelSelector == "" {
		labelSelector = "app=istiod"
	}
	pods, err := kubeClient.GetIstioPods(context.TODO(), istioNamespace, metav1.ListOptions{
		LabelSelector: labelSelector,
		FieldSelector: kube.RunningStatus,
	})
	if err != nil {

	"k8s.io/apimachinery/pkg/types"

	"istio.io/istio/cni/pkg/config"
	"istio.io/istio/cni/pkg/plugin"
	"istio.io/istio/pkg/kube"
	"istio.io/istio/pkg/kube/controllers"
	"istio.io/istio/pkg/kube/kclient"
)

type Controller struct {
	client       kube.Client
	pods         kclient.Client[*corev1.Pod]
	queue        controllers.Queue
	cfg          config.RepairConfig
	events       kclient.EventRecorder

[registry.k8s.io/kube-controller-manager:v1.30.6](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-controller-manager) | [amd64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-controller-manager-amd64), [arm6...

	"istio.io/api/annotation"
	"istio.io/api/label"
	"istio.io/istio/pkg/config/constants"
	"istio.io/istio/pkg/kube"
)

func IsZtunnelPod(client kube.CLIClient, podName, podNamespace string) bool {
	isZtunnel := strings.HasPrefix(podName, "ztunnel")
	if client == nil {
		return isZtunnel
	}
	pod, err := client.Kube().CoreV1().Pods(podNamespace).Get(context.Background(), podName, metav1.GetOptions{})
	if err != nil {
		return isZtunnel