chosen as the default since they are typically ignored for ingress-egress controls, and <a href=https://datatracker.ietf.org/doc/html/rfc3927>by IETF standard</a> are not routable outside of the local subnetwork.</p><p>This behavior is transparently enabled when you add pods to the ambient mesh, and by default ambient uses the link-local address <code>169.254.7.127</code> to identify and correctly allow kubelet health probe packets.</p><p>However if your workload, namespace or cluster has a preexisting ingr