strategy: {}
  template:
    metadata:
      annotations:
        prometheus.io/path: /stats/prometheus
        prometheus.io/port: "15020"
        prometheus.io/scrape: "true"
        sidecar.istio.io/status: '{"initContainers":["istio-init"],"containers":["istio-proxy"],"volumes":null,"imagePullSecrets":null,"revision":"default"}'
      creationTimestamp: null
      labels:
        app: hello
        tier: backend
        track: stable

- In sidecar mode, the CNI plugin can configure sidecar networking for pods when they are scheduled by the container runtime, using iptables. The CNI handling the netns setup replaces the current Istio approach using a `NET_ADMIN` privileged `initContainers` container, `istio-init`, injected in the pods along with `istio-proxy` sidecars. This removes the need for a privileged, `NET_ADMIN` container in the Istio users' application pods.

spec:
  initContainers:
    - name: istio-init
      image: docker.io/istio/proxy_init:unittest-{{.Values.global.tag}}
  containers:
    - name: istio-proxy

			},
			expected: "",
		},
		{
			anno:     klabels.Set{},
			expected: "",
		},
		{
			anno: klabels.Set{
				apiannotation.SidecarStatus.Name: `
				{
					"initContainers": [
						"istio-init"
					],
					"containers": [
						"istio-proxy"
					],
					"volumes": [
						"istio-envoy",
						"istio-data",
						"istio-podinfo",
						"istio-token",

{{- end }}
  }
spec:
  {{- $holdProxy := and
      (or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
      (not $nativeSidecar) }}
  initContainers:
  {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
  {{ if or .Values.pilot.cni.enabled .Values.istio_cni.enabled -}}
  - name: istio-validation
  {{ else -}}

{{- end }}
  }
spec:
  {{- $holdProxy := and
      (or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts)
      (not $nativeSidecar) }}
  initContainers:
  {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }}
  {{ if or .Values.pilot.cni.enabled .Values.istio_cni.enabled -}}
  - name: istio-validation
  {{ else -}}

{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
{{- if .Values.global.proxy.enableCoreDump }}
      initContainers:
        - name: enable-core-dump
{{- if contains "/" .Values.global.proxy.image }}
          image: "{{ .Values.global.proxy.image }}"
{{- else }}

runAsNonRoot: true {{- end }} serviceAccountName: {{ $gateway.name }}-service-account {{- if .Values.global.priorityClassName }} priorityClassName: "{{ .Values.global.priorityClassName }}" {{- end }} {{- if .Values.global.proxy.enableCoreDump }} initContainers: - name: enable-core-dump {{- if contains "/" .Values.global.proxy.image }} image: "{{ .Values.global.proxy.image }}" {{- else }} image: "{{ .Values.global.hub }}/{{ .Values.global.proxy.image | default "proxyv2" }}:{{ .Values.global.tag }}{{with...

  // Restricts the check for exit codes to the container with the
  // specified name. When null, the rule applies to all containers.
  // When specified, it should match one the container or initContainer
  // names in the pod template.
  // +optional
  optional string containerName = 1;

  // Represents the relationship between the container exit code(s) and the

  // Cannot be updated.
  // More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
  // +patchMergeKey=name
  // +patchStrategy=merge
  repeated Container initContainers = 20;

  // List of containers belonging to the pod.
  // Containers cannot currently be added or removed.
  // There must be at least one container in a Pod.
  // Cannot be updated.