func (s *InformerHandlers) GetActiveAmbientPodSnapshot() []*corev1.Pod {
	var pods []*corev1.Pod
	for _, pod := range s.pods.List(metav1.NamespaceAll, klabels.Everything()) {
		ns := s.namespaces.Get(pod.Namespace, "")
		if ns == nil {
			log.Warnf("failed to find namespace %s for pod %s", pod.Namespace, pod.Name)
		}

		// Exclude ztunnels, and terminated daemonset pods
		// from the snapshot.

	mt.Assert(EventTotals.Name(), map[string]string{"type": "update"}, monitortest.AtLeast(4))

	waitForMockCalls()

	assertPodNotAnnotated(t, client, pod)

	// patch a test label to emulate a POD update event
	_, err = client.Kube().CoreV1().Pods(pod.Namespace).Patch(ctx, pod.Name,
		types.MergePatchType, []byte(`{"metadata":{"labels":{"test":"update"}}}`), metav1.PatchOptions{})

		Namespace: "bar",
		UID:       types.UID("863b91d4-4b68-4efa-917f-4b560e3e86aa"),
	}
	pod := &corev1.Pod{ObjectMeta: podMeta}

	err := netServer.ConstructInitialSnapshot([]*corev1.Pod{pod})
	assert.NoError(t, err)
	if fixture.podNsMap.Get("863b91d4-4b68-4efa-917f-4b560e3e86aa") == nil {
		t.Fatal("expected pod to be in cache")
	}
}

		_, err = s.addPodToHostNSIpset(pod, podIPs)
		if err != nil {
			log.Errorf("failed to add pod to ipset: %s/%s %v", pod.Namespace, pod.Name, err)
			return err
		}
	} else {
		log.Errorf("pod: %s/%s was not enrolled and is unhealthy: %v", pod.Namespace, pod.Name, retErr)
	}

	return retErr
}

func (s *meshDataplane) RemovePodFromMesh(ctx context.Context, pod *corev1.Pod, isDelete bool) error {

)

func Test_analyzeRunningWebhooks(t *testing.T) {
	cases := []struct {
		name             string
		pod              *corev1.Pod
		ns               *corev1.Namespace
		expectedMessages []webhookAnalysis
	}{
		{
			name: "no inj because of no match labels",
			pod:  podTestObject("test1", "test1", "", ""),
			ns:   nsTestObject("test1", "", ""),
			expectedMessages: []webhookAnalysis{
				{

  // that should be running the daemon pod (i.e. status.desiredNumberScheduled)
  // can have their a new pod created before the old pod is marked as deleted.
  // The update starts by launching new pods on 30% of nodes. Once an updated
  // pod is available (Ready for at least minReadySeconds) the old DaemonSet pod
  // on that node is marked deleted. If the old pod becomes unavailable for any

	const maxStaleRetries = 10
	const msInterval = 10
	retries := 0
	var ambientPod *corev1.Pod
	var err error

	// The plugin already consulted the k8s API - but on this end handler caches may be stale, so retry a few times if we get no pod.
	// if err is returned, we couldn't find the pod
	// if nil is returned, we found it but ambient is not enabled

  // +optional
  optional NodeAffinity nodeAffinity = 1;

  // Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
  // +optional
  optional PodAffinity podAffinity = 2;

  // Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
  // +optional

An alternative flow is when a pod is enrolled into ambient mode after it starts up.
In this case, the CNI Agent is watching for Pod events from the API server directly and performing the same setup.
Note this is done while the Pod is running, unlike the CNI plugin flow which occurs before the Pod starts.

Once the network is configured, the CNI Agent will signal to Ztunnel to start running within the Pod.

	Annotations         map[string]string
	InitContainerName   string
	InitContainerStatus *corev1.ContainerStatus
	NodeName            string
}

func makePod(args makePodArgs) *corev1.Pod {
	pod := &corev1.Pod{
		TypeMeta: metav1.TypeMeta{
			Kind:       "Pod",
			APIVersion: "v1",
		},
		ObjectMeta: metav1.ObjectMeta{
			Name:        args.PodName,
			Namespace:   "default",
			Labels:      args.Labels,