// +optional
  optional NodeAffinity nodeAffinity = 1;

  // Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
  // +optional
  optional PodAffinity podAffinity = 2;

  // Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
  // +optional

- one end of the socket is in the application pod
- and the other end is in ztunnel's pod

and setting up iptables rules to funnel traffic thru that socket "tube" to ztunnel and back.

This effectively behaves like ztunnel is an in-pod sidecar, without actually requiring the injection of ztunnel as a sidecar into the pod manifest, or mutatating the application pod in any way.

  // +optional
  optional ImageReviewStatus status = 3;
}

// ImageReviewContainerSpec is a description of a container within the pod creation request.
message ImageReviewContainerSpec {
  // This can be in the form image:tag or image@SHA:012345679abcdef.
  // +optional
  optional string image = 1;
}

// ImageReviewSpec is a description of the pod creation request.

  // in a pod.
  // The Handler must be lowercase, conform to the DNS Label (RFC 1123) requirements,
  // and is immutable.
  optional string handler = 2;

  // overhead represents the resource overhead associated with running a pod for a
  // given RuntimeClass. For more details, see
  //  https://kubernetes.io/docs/concepts/scheduling-eviction/pod-overhead/
  // +optional

// Kubernetes, as specified in requests and limits, describing each pod in the
// current scale target (e.g. CPU or memory).  The values will be averaged
// together before being compared to the target.  Such metrics are built in to
// Kubernetes, and have special scaling options on top of those available to
// normal per-pod metrics using the "pods" source.  Only one "target" type
// should be set.

	defer cancel()

	pods := &fakePodCache{}

	pod, f := podAndNetns()
	f.Close()
	pods.pods = map[string]WorkloadInfo{
		string(pod.UID): {}, // simulate unknown netns
	}

	fixture := connectWithPods(ctx, pods)
	ztunClient := fixture.ztunClient
	// read initial pod add
	keep, fds := readRequest(t, ztunClient)
	assert.Equal(t, len(fds), 0)

		},
		{ // case 2 no pod
			args:           strings.Split("pod", " "),
			expectedString: "Error: expecting pod name",
			wantException:  true, // "istioctl experimental inspect pod" should fail
		},
		{ // case 3 unknown pod
			args:           strings.Split("po not-a-pod", " "),
			expectedString: "pods \"not-a-pod\" not found",

  // that should be running the daemon pod (i.e. status.desiredNumberScheduled)
  // can have their a new pod created before the old pod is marked as deleted.
  // The update starts by launching new pods on 30% of nodes. Once an updated
  // pod is available (Ready for at least minReadySeconds) the old DaemonSet pod
  // on that node is marked deleted. If the old pod becomes unavailable for any

		Example: `  # Check the injection status of a pod
  istioctl experimental check-inject details-v1-fcff6c49c-kqnfk.test
	
  # Check the injection status of a pod under a deployment
  istioctl x check-inject deployment/details-v1

  # Check the injection status of a pod under a deployment in namespace test

					break GetProxyLoop
				}
				namespacedName := pod.Name + "." + pod.Namespace
				if visited[namespacedName] {
					// If we already have information about the pod, skip it.
					continue
				}
				resp, err := queryToOnePod(&pod)
				if err != nil {
					fmt.Fprintf(os.Stderr, "Skip the agent in Pod %s due to the error: %s\n", namespacedName, err.Error())
					continue
				}