iptables -t mangle -A ISTIO_DIVERT -j MARK --set-mark 1337
iptables -t mangle -A ISTIO_DIVERT -j ACCEPT
iptables -t mangle -A ISTIO_TPROXY ! -d 127.0.0.1/32 -p tcp -j TPROXY --tproxy-mark 1337/0xffffffff --on-port 15006
iptables -t mangle -A PREROUTING -p tcp -j ISTIO_INBOUND
iptables -t mangle -A ISTIO_INBOUND -p tcp -m conntrack --ctstate RELATED,ESTABLISHED -j ISTIO_DIVERT

        prometheus.io/port: "15020"
        prometheus.io/scrape: "true"
        proxy.istio.io/overrides: '{"containers":[{"name":"istio-proxy","resources":{},"securityContext":{"runAsUser":1234,"runAsGroup":4321}}]}'

iptables -t mangle -A ISTIO_PRERT -p tcp -m tcp --dport 15008 -m mark ! --mark 0x539/0xfff -j TPROXY --on-port 15008 --tproxy-mark 0x111/0xfff
iptables -t mangle -A ISTIO_PRERT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -t mangle -A ISTIO_PRERT ! -d 127.0.0.1/32 -p tcp -m mark ! --mark 0x539/0xfff -j TPROXY --on-port 15006 --tproxy-mark 0x111/0xfff

	D echo.Instances
	// IPv6 only echo app to be used by tests if running in dual-stack mode
	E echo.Instances
	// Standard echo app with TPROXY interception mode to be used by tests
	Tproxy echo.Instances
	// Headless echo app to be used by tests
	Headless echo.Instances
	// StatefulSet echo app to be used by tests
	StatefulSet echo.Instances

            - ALL
            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
            - NET_ADMIN # Required for TPROXY and setsockopt
            - SYS_ADMIN # Required for `setns` - doing things in other netns
            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
          readOnlyRootFilesystem: true
          runAsGroup: 1337
          runAsNonRoot: false
          runAsUser: 0

	chains = []string{constants.ISTIOINBOUND, constants.ISTIODIVERT, constants.ISTIOTPROXY}
	flushAndDeleteChains(ext, iptV, constants.MANGLE, chains)

	if cfg.InboundInterceptionMode == constants.TPROXY {
		DeleteRule(ext, iptV, constants.MANGLE, constants.PREROUTING,
			"-p", constants.TCP, "-m", "mark", "--mark", cfg.InboundTProxyMark, "-j", "CONNMARK", "--save-mark")
		DeleteRule(ext, iptV, constants.MANGLE, constants.OUTPUT,

	Concurrency   int32

	// For unit testing, in combination with NoEnvoy prevents agent.Run from blocking
	TestOnly    bool
	AgentIsRoot bool
}

// NewProxy creates an instance of the proxy control commands
func NewProxy(cfg ProxyConfig) Proxy {
	// inject tracing flag for higher levels
	var args []string
	logLevel, componentLogs := splitComponentLog(cfg.LogLevel)
	if logLevel != "" {
		args = append(args, "-l", logLevel)
	}

# Please keep kube-proxy configuration in-sync with:
# cluster/addons/kube-proxy/kube-proxy-ds.yaml
apiVersion: v1
kind: Pod
metadata:
  name: kube-proxy
  namespace: kube-system
  labels:
    tier: node
    component: kube-proxy
spec:
  priorityClassName: system-node-critical
  priority: 2000001000
  hostNetwork: true
  tolerations:
  - operator: "Exists"
    effect: "NoExecute"
  - operator: "Exists"
    effect: "NoSchedule"

        prometheus.io/port: "15020"
        prometheus.io/scrape: "true"
        proxy.istio.io/overrides: '{"containers":[{"name":"istio-proxy","resources":{},"securityContext":{"runAsUser":1234,"runAsGroup":4321}}]}'
        sidecar.istio.io/interceptionMode: REDIRECT

        prometheus.io/port: "15020"
        prometheus.io/scrape: "true"
        proxy.istio.io/overrides: '{"containers":[{"name":"istio-proxy","resources":{},"securityContext":{"runAsUser":1234,"runAsGroup":4321}}]}'