a single packet can go `input` -> "local process" -> `output`, which it cannot. Note also
that the `ingress` and `egress` hooks are special and mostly not available to us;
kube-proxy lives in the middle section of diagram, with the five main netfilter hooks.

There are three paths through the diagram, called the "input", "forward", and "output"

# Files that should be ignored by tools which do not want to consider generated
# code.
#
# https://github.com/kubernetes/test-infra/blob/master/prow/plugins/size/size.go
#
# This file is a series of lines, each of the form:
#     <type> <name>
#
# Type can be:
#    path - an exact path to a single file
#    file-name - an exact leaf filename, regardless of path
#    path-prefix - a prefix match on the file path

               ],
    {{container_env}}
    "livenessProbe": {
      "httpGet": {
        "scheme": "HTTPS",
        "host": "{{healthcheck_ip}}",
        "port": {{secure_port}},
        "path": "/livez?exclude=etcd&exclude=kms-provider-0&exclude=kms-provider-1"
      },
      "initialDelaySeconds": {{liveness_probe_initial_delay}},
      "timeoutSeconds": 15
    },
    "readinessProbe": {
      "httpGet": {