}
	// Helper function; checks that container exit code matches filter
	matchExitCode := func(state *corev1.ContainerStateTerminated) bool {
		// If we are filtering on init container exit code and the termination message does not match, exit
		if ec := c.cfg.InitExitCode; ec == 0 || ec == int(state.ExitCode) {
			return true
		}
		return false
	}

	// Only check pods that have the sidecar annotation; the rest can be

  // If you specify "User" but not "Group", then is it interpreted as "What if User were not a member of any groups
  // +optional
  optional string user = 3;

  // Groups is the groups you're testing for.
  // +optional
  repeated string group = 4;

  // Extra corresponds to the user.Info.GetExtra() method from the authenticator.  Since that is input to the authorizer
  // it needs a reflection here.
  // +optional

# Adapted from istio-discovery/templates/mutatingwebhook.yaml
# Removed paths for legacy and default selectors since a revision tag
# is inherently created from a specific revision
{{/* Copy just what we need to avoid expensive deepCopy */}}
{{- $whv := dict
 "revision" .Values.revision
  "injectionURL" .Values.istiodRemote.injectionURL
  "namespace" .Release.Namespace }}
{{- define "core" }}
- name: {{.Prefix}}sidecar-injector.istio.io
  clientConfig:

  // `limitResponse` indicates what to do with requests that can not be executed right now
  optional LimitResponse limitResponse = 2;

  // `lendablePercent` prescribes the fraction of the level's NominalCL that
  // can be borrowed by other priority levels. The value of this
  // field must be between 0 and 100, inclusive, and it defaults to 0.
  // The number of seats that other levels can borrow from this level, known

  // `limitResponse` indicates what to do with requests that can not be executed right now
  optional LimitResponse limitResponse = 2;

  // `lendablePercent` prescribes the fraction of the level's NominalCL that
  // can be borrowed by other priority levels. The value of this
  // field must be between 0 and 100, inclusive, and it defaults to 0.
  // The number of seats that other levels can borrow from this level, known

  // If you specify "User" but not "Groups", then is it interpreted as "What if User were not a member of any groups
  // +optional
  optional string user = 3;

  // Groups is the groups you're testing for.
  // +optional
  repeated string groups = 4;

  // Extra corresponds to the user.Info.GetExtra() method from the authenticator.  Since that is input to the authorizer
  // it needs a reflection here.
  // +optional

  # Determine what CNI to install
  case "${KUBERNETES_CNI:-}" in 

    "calico")
      echo "Installing Calico CNI"
      install_calico "" "$(dirname "$CONFIG")"
      ;;

    "")
      # perfectly fine, we accepted the default KinD CNI
      ;;

    *)
      # we don't know what to do but we've got no CNI, return non-zero

    # always skip the injection on pods that match that label selector, regardless of the global policy.
    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
    neverInjectSelector: []
    alwaysInjectSelector: []

    # injectedAnnotations are additional annotations that will be added to the pod spec after injection

		} else {
			conf, err := libcni.ConfFromFile(confFile)
			if err != nil {
				installLog.Warnf("Error loading CNI config file %s: %v", confFile, err)
				continue
			}
			// Ensure the config has a "type" so we know what plugin to run.
			// Also catches the case where somebody put a conflist into a conf file.
			if conf.Network.Type == "" {
				installLog.Warnf("Error loading CNI config file %s: no 'type'; perhaps this is a .conflist?", confFile)

}

/*
To clean up stale ztunnels

	we may need to ztunnel to send its (uid, bootid / boot time) to us
	so that we can remove stale entries when the ztunnel pod is deleted
	or when the ztunnel pod is restarted in the same pod (remove old entries when the same uid connects again, but with different boot id?)

	save a queue of what needs to be sent to the ztunnel pod and send it one by one when it connects.