return false
		}
	}

	// For each candidate pod, iterate across all init containers searching for
	// crashlooping init containers that match our criteria
	for _, container := range pod.Status.InitContainerStatuses {
		// Skip the container if the InitContainerName is not a match and our
		// InitContainerName filter is non-empty.
		if c.cfg.InitContainerName != "" && container.Name != c.cfg.InitContainerName {
			continue
		}

NAME     VHOST NAME     DOMAINS     MATCH                  VIRTUAL SERVICE
         backend        *           /healthz/ready*        

  - name: istio-podinfo
    downwardAPI:
      items:
        - path: "labels"
          fieldRef:
            fieldPath: metadata.labels
        - path: "annotations"
          fieldRef:
            fieldPath: metadata.annotations
  - name: istio-token
    projected:
      sources:
      - serviceAccountToken:
          path: istio-token
          expirationSeconds: 43200

  // +optional
  optional int32 minReadySeconds = 4;

  // Selector is a label query over pods that should match the replica count.
  // Label keys and values that must match in order to be controlled by this replica set.
  // It must match the pod template's labels.
  // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors

  clientConfig:
    {{- if .injectionURL }}
    url: "{{ .injectionURL }}"
    {{- else }}
    service:
      name: istiod{{- if not (eq .revision "") }}-{{ .revision }}{{- end }}
      namespace: {{ .namespace }}
      path: "{{ .injectionPath }}"
      port: 443
    {{- end }}
  sideEffects: None
  rules:
  - operations: [ "CREATE" ]
    apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
  failurePolicy: Fail

iptables -t nat -N ISTIO_POSTRT
iptables -t nat -A POSTROUTING -j ISTIO_POSTRT

	Components     []string                   `json:"components,omitempty"`
	Customizations []IopDiff                  `json:"customizations,omitempty"`
}

type IopDiff struct {
	Path  string `json:"path"`
	Value string `json:"value"`
}

// MutatingWebhookConfigInfo represents a tiny subset of fields from
// MutatingWebhookConfiguration kubernetes object. This is exposed for
// integration tests only

    - wolfi-baselayout
    - glibc
    - iptables
    - ip6tables
    - libnetfilter_conntrack
    - libnfnetlink
    - libmnl
    - libgcc
archs:
  - x86_64
  - aarch64
paths:
- path: /run
  type: directory
  permissions: 0o755
accounts:
  users:
    - username: nonroot
      uid: 65532
    - username: nobody
      uid: 65534
  run-as: 65532

}

// NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface
message NonResourceAttributes {
  // Path is the URL path of the request
  // +optional
  optional string path = 1;

  // Verb is the standard HTTP verb
  // +optional
  optional string verb = 2;
}

// NonResourceRule holds information that describes a rule for the non-resource

  optional string subResource = 4;

  // RequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale).
  // If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.
  //
  // For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of