Deckhouse admission-policy-engine (baseline) rejected the pods because istio-init needs NET_ADMIN and NET_RAW. Label the namespace security.deckhouse.io/pod-policy=privileged like the other app namespaces in ugmk.
