log.Infof("excluded %s/%s pod because it has proxy type %s", podNamespace, podName, pi.ProxyType)
		return nil
	}

	val := pi.Annotations[injectAnnotationKey]
	if lbl, labelPresent := pi.Labels[label.SidecarInject.Name]; labelPresent {
		// The label is the new API; if both are present we prefer the label
		val = lbl
	}
	if val != "" {
		log.Debugf("contains inject annotation: %s", val)

- Pods owned by a Job now uses the labels `batch.kubernetes.io/job-name` and `batch.kubernetes.io/controller-uid`.
  The legacy labels `job-name` and `controller-uid` are still added for compatibility. ([#114930](https://github.com/kubernetes/kubernetes/pull/114930), [@kannon92](https://github.com/kannon92))

  // When a driver is initialized on a node, it provides the same topology keys
  // along with values. Kubelet will expose these topology keys as labels
  // on its own node object.
  // When Kubernetes does topology aware provisioning, it can use this list to
  // determine which labels it should retrieve from the node object and pass
  // back to the driver.
  // It is possible for different nodes to use different topology keys.

  // When a driver is initialized on a node, it provides the same topology keys
  // along with values. Kubelet will expose these topology keys as labels
  // on its own node object.
  // When Kubernetes does topology aware provisioning, it can use this list to
  // determine which labels it should retrieve from the node object and pass
  // back to the driver.
  // It is possible for different nodes to use different topology keys.

  - Use of the `--node-labels` flag to set labels under the `kubernetes.io/` and `k8s.io/` prefix will be subject to restriction by the `NodeRestriction` admission plugin in future releases. [See admission plugin documentation](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction) for allowed labels. ([#68267](https://github.com/kubernetes/kubernetes/pull/68267), [@liggitt](https://github.com/liggitt))...

pkg runtime/pprof, func ForLabels(context.Context, func(string, string) bool)
pkg runtime/pprof, func Label(context.Context, string) (string, bool)
pkg runtime/pprof, func Labels(...string) LabelSet
pkg runtime/pprof, func SetGoroutineLabels(context.Context)
pkg runtime/pprof, func WithLabels(context.Context, LabelSet) context.Context
pkg runtime/pprof, type LabelSet struct

* **Maschinelles Lernen**: Normalerweise sind viele „Matrix“- und „Vektor“-Multiplikationen erforderlich. Stellen Sie sich eine riesige Tabelle mit Zahlen vor, in der Sie alle Zahlen gleichzeitig multiplizieren.

 *
 * <p>{@code Object.hashCode} implementations tend to be very fast, but have weak collision
 * prevention and <i>no</i> expectation of bit dispersion. This leaves them perfectly suitable for
 * use in hash tables, because extra collisions cause only a slight performance hit, while poor bit
 * dispersion is easily corrected using a secondary hash function (which all reasonable hash table

 *
 * <p>{@code Object.hashCode} implementations tend to be very fast, but have weak collision
 * prevention and <i>no</i> expectation of bit dispersion. This leaves them perfectly suitable for
 * use in hash tables, because extra collisions cause only a slight performance hit, while poor bit
 * dispersion is easily corrected using a secondary hash function (which all reasonable hash table

- `istio-iptables`
    - sets up iptables to redirect a list of ports to the port envoy will listen
    - shared code with istio-init container
    - it will generate an iptables-save config, based on annotations/labels and other settings, and apply it.

### CmdAdd Sidecar Workflow

`CmdAdd` is triggered when there is a new pod created. This runs on the node, in a chain of CNI plugins - Istio is