=== command: kubectl apply -f manifest.yaml ===
(already applied above; re-showing for record)
apiVersion: v1
kind: Pod
metadata:
  name: pinned-before-relabel
  namespace: istio-vt-t40
  labels:
    app: pinned
  annotations:
    sidecar.istio.io/inject: "true"
spec:
  containers:
  - name: sleep
    image: curlimages/curl:8.14.1
    command: ["sleep", "infinity"]

=== command: kubectl -n istio-vt-t40 wait --for=condition=Ready pod/pinned-before-relabel --timeout=60s ===
(already executed above - condition met)

=== command: kubectl -n istio-vt-t40 get pod pinned-before-relabel -o jsonpath='{.spec.containers[*].name}{"
"}'  # expect 2 containers incl istio-proxy ===
sleep istio-proxy

=== command: kubectl label ns istio-vt-t40 istio-injection- --overwrite ===
namespace/istio-vt-t40 labeled

=== command: kubectl get ns istio-vt-t40 --show-labels (sanity check) ===
NAME           STATUS   AGE   LABELS
istio-vt-t40   Active   22s   kubernetes.io/metadata.name=istio-vt-t40

=== command: kubectl -n istio-vt-t40 get pod pinned-before-relabel -o jsonpath='{.spec.containers[*].name}{"
"}'  # expect unchanged, still 2 containers ===
sleep istio-proxy

=== command: kubectl -n istio-vt-t40 run new-after-relabel --image=curlimages/curl:8.14.1 --command -- sleep infinity ===
pod/new-after-relabel created

=== command: kubectl -n istio-vt-t40 wait --for=condition=Ready pod/new-after-relabel --timeout=60s ===
pod/new-after-relabel condition met

=== command: kubectl -n istio-vt-t40 get pod new-after-relabel -o jsonpath='{.spec.containers[*].name}{"
"}'  # expect 1 container, no sidecar ===
new-after-relabel

=== command: kubectl label ns istio-vt-t40 istio-injection=enabled --overwrite  # restore for hygiene ===
namespace/istio-vt-t40 labeled

=== extra sanity: kubectl get ns istio-vt-t40 --show-labels (after restore) ===
NAME           STATUS   AGE   LABELS
istio-vt-t40   Active   23s   istio-injection=enabled,kubernetes.io/metadata.name=istio-vt-t40

=== extra sanity: kubectl -n istio-vt-t40 get pods -o wide (final state) ===
NAME                    READY   STATUS    RESTARTS   AGE   IP              NODE          NOMINATED NODE   READINESS GATES
new-after-relabel       1/1     Running   0          1s    10.255.194.87   k8s-worker1   <none>           <none>
pinned-before-relabel   2/2     Running   0          16s   10.255.194.88   k8s-worker1   <none>           <none>