]}{@.metadata.name}{&#39;\n&#39;}{end}&#34;); do if [ $(kubectl auth can-i use psp/$psp --as=system:serviceaccount:default:default) = yes ]; then kubectl get psp/$psp --no-headers -o=custom-columns=NAME:.metadata.name,CAPS:.spec.allowedCapabilities; fi; done
</code></pre><p>If you see <code>NET_ADMIN</code> and <code>NET_RAW</code> or <code>*</code> in the list of capabilities of one of the allowed
policies for your service account, your pods have permission to run the Istio init containers.
Otherwise, you 