},
			expectedChanged:   true,
			expectedAttempt:   2,
			expectedSandboxID: "sandboxID2",
		},
		"Pod with ready sandbox status but network namespace mismatch": {
			pod: &v1.Pod{
				Spec: v1.PodSpec{
					HostNetwork: true,
				},
			},
			status: &kubecontainer.PodStatus{
				SandboxStatuses: []*runtimeapi.PodSandboxStatus{
					{
						Id: "sandboxID1",
						Linux: &runtimeapi.LinuxPodSandboxStatus{

            type: DirectoryOrCreate # DirectoryOrCreate instead of Directory for the following reason - CNI may not bind mount this until a non-hostnetwork pod is scheduled on the node,
            # and we don't want to block CNI agent pod creation on waiting for the first non-hostnetwork pod.

spec:
  securityContext:
    {{ run_as_user }}
    {{ run_as_group }}
    {{ supplemental_groups }}
    seccompProfile:
      type: RuntimeDefault
  priorityClassName: system-node-critical
  priority: 2000001000
  hostNetwork: true
  containers:
  - name: konnectivity-server-container
    {{ container_security_context }}:
      {{ disallow_privilege_escalation}}
      {{ capabilities }}
        {{ drop_capabilities }}

    matchLabels:
      app: kube-network-policies
  template:
    metadata:
      labels:
        tier: node
        app: kube-network-policies
        k8s-app: kube-network-policies
    spec:
      hostNetwork: true
      tolerations:
      - operator: Exists
        effect: NoSchedule
      serviceAccountName: kube-network-policies
      containers:
      - name: kube-network-policies

	// If this option is set, the ports that will be used must be specified.
	// Default to false.
	// +k8s:conversion-gen=false
	// +optional
	HostNetwork bool `json:"hostNetwork,omitempty" protobuf:"varint,11,opt,name=hostNetwork"`
	// Use the host's pid namespace.
	// Optional: Default to false.
	// +k8s:conversion-gen=false
	// +optional

      k8s-app: ip-masq-agent
  template:
    metadata:
      labels:
        k8s-app: ip-masq-agent
    spec:
      priorityClassName: system-node-critical
      serviceAccountName: ip-masq-agent
      hostNetwork: true
      containers:
      - name: ip-masq-agent
        image: registry.k8s.io/networking/ip-masq-agent-amd64:v2.6.1
        args:
          - --masq-chain=IP-MASQ
          - --nomasq-all-reserved-ranges

            {{runAsUser}}
            {{runAsGroup}}
            {{supplementalGroups}}
            "seccompProfile": {
                "type": "RuntimeDefault"
            }
        },
        "hostNetwork": true,
        "containers": [
            {
                "name": "cluster-autoscaler",
                "image": "registry.k8s.io/autoscaling/cluster-autoscaler:v1.26.1",
                "livenessProbe": {

apiVersion: v1
kind: Pod
metadata:
  name: kube-proxy
  namespace: kube-system
  labels:
    tier: node
    component: kube-proxy
spec:
  priorityClassName: system-node-critical
  priority: 2000001000
  hostNetwork: true
  tolerations:
  - operator: "Exists"
    effect: "NoExecute"
  - operator: "Exists"
    effect: "NoSchedule"
  containers:
  - name: kube-proxy

	// If this option is set, the ports that will be used must be specified.
	// Default to false.
	// +k8s:conversion-gen=false
	// +optional
	HostNetwork bool `json:"hostNetwork,omitempty" protobuf:"varint,11,opt,name=hostNetwork"`
	// Use the host's pid namespace.
	// Optional: Default to false.
	// +k8s:conversion-gen=false
	// +optional

},
"spec":{
"securityContext": {
  {{runAsUser}}
  {{runAsGroup}}
  {{supplementalGroups}}
  "seccompProfile": {
      "type": "RuntimeDefault"
  }
},
"priorityClassName": "system-node-critical",
"hostNetwork": true,
"containers":[
    {
    "name": "cloud-controller-manager",
    "image": "gcr.io/k8s-staging-cloud-provider-gcp/cloud-controller-manager:v30.0.0",
    "resources": {
      "requests": {