type Rule struct {
	chain  string
	table  string
	params []string
}

// Rules represents iptables for V4 and V6
type Rules struct {
	rulesv4 []*Rule
	rulesv6 []*Rule
}

// IptablesRuleBuilder is an implementation for IptablesRuleBuilder interface
type IptablesRuleBuilder struct {
	rules Rules
	cfg   *config.Config
}

// NewIptablesBuilders creates a new IptablesRuleBuilder

Leonardo Sarra <******@****.***> 1718116194 +0200

Leonardo Sarra <******@****.***> 1718116194 +0200

Leonardo Sarra <******@****.***> 1718116194 +0200

Leonardo Sarra <******@****.***> 1718116194 +0200

			},
			false,
		},
	}
	builderConfig := &config.Config{
		EnableIPv6: true,
	}
	checkFunc := func(goldenName string, rules [][]string, rulesRestore string, expected bool) {
		// check that rules are set
		if expected {
			var actual strings.Builder
			for _, rule := range rules {
				fmt.Fprintln(&actual, strings.Join(rule, " "))
			}
			compareToGolden(t, goldenName, actual.String())

	"istio.io/istio/pkg/config/visibility"
	"istio.io/istio/pkg/util/sets"
)

// This function merges one or more destination rules for a given host string
// into a single destination rule. Note that it does not perform inheritance style merging.
// IOW, given three dest rules (*.foo.com, *.foo.com, *.com) without selectors, calling this function for
// each config will result in a final dest rule set (*.foo.com, and *.com).
//

				Name:      staticStrictPolicyName,
				Namespace: meshCfg.GetRootNamespace(),
				Scope:     security.Scope_WORKLOAD_SELECTOR,
				Action:    security.Action_DENY,
				Groups: []*security.Group{
					{
						Rules: []*security.Rules{
							{
								Matches: []*security.Match{
									{
										NotPrincipals: []*security.StringMatch{
											{
												MatchType: &security.StringMatch_Presence{},
											},
										},

	if !feature.DefaultFeatureGate.Enabled(features.JobSuccessPolicy) || successPolicy == nil || len(succeededIndexes) == 0 {
		return "", false
	}

	rulesMatchedMsg := "Matched rules at index"
	for index, rule := range successPolicy.Rules {
		if rule.SucceededIndexes != nil {
			requiredIndexes := parseIndexesFromString(logger, *rule.SucceededIndexes, int(completions))

type ZtunnelPolicy struct {
	Name      string             `json:"name"`
	Namespace string             `json:"namespace"`
	Scope     string             `json:"scope"`
	Action    string             `json:"action"`
	Rules     [][][]*PolicyMatch `json:"rules"`
}

type ZtunnelDump struct {
	Workloads     []*ZtunnelWorkload       `json:"workloads"`
	Services      []*ZtunnelService        `json:"services"`