the Envoy configuration of the pod. The command is especially useful for inspecting
the policy propagation from Istiod to Envoy and the final AuthorizationPolicy list merged
from multiple sources (mesh-level, namespace-level and workload-level).

The command also supports reading from a standalone config dump file with flag -f.`,
		Example: `  # Check AuthorizationPolicy applied to pod httpbin-88ddbcfdd-nt5jb:
  istioctl x authz check httpbin-88ddbcfdd-nt5jb

                     }
                  ]
               },
               {
                  "matcher": {
                     "id": "byName",
                     "options": "type.googleapis.com/istio.workload.Address"
                  },
                  "properties": [
                     {
                        "id": "displayName",
                        "value": "Addresses"
                     }

	// Determine if running under k8s by checking the CNI args
	k8sArgs := K8sArgs{}
	if err := types.LoadArgs(args.Args, &k8sArgs); err != nil {
		return err
	}

	// Check if the workload is running under Kubernetes.
	podNamespace := string(k8sArgs.K8S_POD_NAMESPACE)
	podName := string(k8sArgs.K8S_POD_NAME)
	log := log.WithLabels("pod", podNamespace+"/"+podName)
	if podNamespace == "" || podName == "" {

                        "envoy.filters.listener.original_dst": {
                          "local": "192.168.195.248:800"
                        },
                        "istio": {
                          "workload": "httpbin;default;httpbin;v1;snorlax"
                        }
                      }
                    },
                    "load_balancing_weight": 1
                  }
                ],

```mermaid
graph BT
    mcsc("Multicluster Secret")
    scr("Credentials Controller")
    ksd("Kubernetes Service Controller")
    nsc("Namespace Controller")
    wes("Workload Entry Store")
    iwh("Injection Patcher")
    aex("Auto Service Export")
    scr-->mcsc
    ksd-->mcsc
    nsc-->ksd
    wes-->ksd
    iwh-->ksd
    aex-->ksd
```

#### VMs

  // More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/#specifying-your-own-pod-selector
  // +optional
  optional bool manualSelector = 5;

  // Describes the pod that will be created when executing a job.
  // The only allowed template.spec.restartPolicy values are "Never" or "OnFailure".
  // More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/

			// choose to do so.
			//
			// NOTE: This is a warning and not an error because the user may not intend to label their namespace as ambient.
			//
			// e.g. Users are handling ambient redirection per workload rather than at the namespace level.
			hasWaypoint, err := namespaceHasLabel(kubeClient, ns, label.IoIstioUseWaypoint.Name)
			if err != nil {
				return err
			}
			if enrollNamespace {

	// pick 10 nodes that precisely can send those 100 requests the first node
	// in the 10 node shard would coordinate between other 9 shards to get the
	// rest of the `99*9` requests.
	//
	// This essentially splits the workload properly and also allows for network
	// utilization to be optimal, instead of blindly throttling the way we are
	// doing below. However the changes that are needed here are a bit involved,

* Resolves spurious rollouts of workload controllers when upgrading the API server, due to incorrect defaulting of an alpha procMount field in pods ([#78883](https://github.com/kubernetes/kubernetes/pull/78883), [@liggitt](https://github.com/liggitt))

- Added warnings about workload resources (Pods, ReplicaSets, Deployments, Jobs, CronJobs, or ReplicationControllers) whose names are not valid DNS labels. ([#114412](https://github.com/kubernetes/kubernetes/pull/114412), [@thockin](https://github.com/thockin))