A security issue was discovered in Kubernetes that could allow  Windows workloads to run as `ContainerAdministrator` even when those workloads set the `runAsNonRoot` option to `true `.

This issue has been rated low and assigned CVE-2021-25749

### Am I vulnerable?

All Kubernetes clusters with following versions, running Windows workloads with `runAsNonRoot` are impacted

#### Affected Versions

			expectedException: true,
			expectedOutput:    "Error: expecting a workload name\n",
		},
		{
			description:       "Invalid command args - missing service name",
			args:              strings.Split("group create -n bar", " "),
			expectedException: true,
			expectedOutput:    "Error: expecting a workload name\n",
		},
		{
			description:       "Invalid command args - missing service namespace",

	for uid, wl := range snap {
		var resp *zdsapi.WorkloadResponse
		var err error
		log := log.WithLabels("uid", uid)
		if wl.Workload != nil {
			log = log.WithLabels(
				"name", wl.Workload.Name,
				"namespace", wl.Workload.Namespace,
				"serviceAccount", wl.Workload.ServiceAccount)
		}
		if wl.Netns != nil {
			fd := int(wl.Netns.Fd())
			log.Infof("sending pod to ztunnel as part of snapshot")

* If a socket is found, istio-agent will not start its own SDS Server and Envoy will be configured to use that socket as its source of cryptographic material.

	ztunClient *net.UnixConn
	ztunServer *ztunnelServer
	uid        string
} {
	pods := &fakePodCache{}

	pod, ns := podAndNetns()
	workload := WorkloadInfo{
		Workload: podToWorkload(pod),
		Netns:    ns,
	}
	pods.pods = map[string]WorkloadInfo{
		string(pod.UID): workload,
	}
	ret := connectWithPods(ctx, pods)

	return struct {
		ztunClient *net.UnixConn
		ztunServer *ztunnelServer

# Packages, and component versions, can be found here:
# https://learn.microsoft.com/en-us/visualstudio/install/workload-component-id-vs-build-tools
RUN C:\TEMP\vs_community.exe \
        --quiet --wait --norestart --nocache \
        --add Microsoft.VisualStudio.Component.VC.Tools.x86.x64 \
        --add Microsoft.VisualStudio.Workload.NativeDesktop \
        --add Microsoft.VisualStudio.Component.VC.14.39.17.9.x86.64 \

        |||
      ),
      panels.timeSeries.xdsPushes(
        'XDS Pushes', queries.ztunnelXdsMessages, |||
          Count of XDS messages, by type.
        |||
      ),
      panels.timeSeries.base('Workload Manager', queries.workloadManager, |||
        Count of active and pending proxies managed by each instance.
        Pending is expected to converge to zero.
      |||
      ),
    ]),
  ], panelHeight=8)
)

10.244.0.195:9080                                HEALTHY                  outbound|9080||reviews.default.svc.cluster.local
./var/run/secrets/workload-spiffe-uds/socket     HEALTHY                  sds-grpc
10.244.0.188:11800                               HEALTHY                  outbound|11800||skywalking-oap.skywalking.svc.cluster.local

			continue
		}
		pod := pods[res.uid]
		netns := &NetnsWithFd{
			netns: res.netns,
			fd:    res.netnsfd,
			inode: res.inode,
		}
		workload := WorkloadInfo{
			Workload: podToWorkload(pod),
			Netns:    netns,
		}
		podUIDNetns[string(res.uid)] = workload

	}
	return podUIDNetns, nil
}

type PodNetnsEntry struct {
	uid     types.UID
	netns   fs.File
	netnsfd uintptr
	inode   uint64

	"istio.io/istio/istioctl/pkg/tag"
	"istio.io/istio/istioctl/pkg/util"
	"istio.io/istio/istioctl/pkg/validate"
	"istio.io/istio/istioctl/pkg/version"
	"istio.io/istio/istioctl/pkg/waypoint"
	"istio.io/istio/istioctl/pkg/workload"
	"istio.io/istio/istioctl/pkg/ztunnelconfig"
	"istio.io/istio/operator/cmd/mesh"
	"istio.io/istio/pkg/cmd"
	"istio.io/istio/pkg/collateral"
	"istio.io/istio/pkg/config/constants"
	"istio.io/istio/pkg/log"