the sidecar proxy.</p></li><li><p><strong><code>NET_ADMIN</code> and <code>NET_RAW</code> capabilities</strong>: If <a href=https://kubernetes.io/docs/concepts/policy/pod-security-policy/>pod security policies</a>
are <a href=https://kubernetes.io/docs/concepts/policy/pod-security-policy/#enabling-pod-security-policies>enforced</a>
in your cluster and unless you use the <a href=/v1.10/docs/setup/additional-setup/cni/>Istio CNI Plugin</a>, your pods must have the
<code>NET_ADMIN</code> and <code>NET_RAW</cod