// NOTE that this expects to be run from within the HOST network namespace!
//
// We need to do this specifically to be able to distinguish between traffic coming from different node-level processes
// via the nodeIP
// - kubelet (node-local healthchecks, which we do not capture)
// - kube-proxy (fowarded/proxied traffic from LoadBalancer-backed services, potentially with public IPs, which we must capture)

		return err
	}

	// Create a kube client
	client, err := newK8sClient(*conf)
	if err != nil {
		return err
	}

	// Actually do the add
	if err := doAddRun(args, conf, client, IptablesInterceptRuleMgr()); err != nil {
		return err
	}
	return pluginResponse(conf)
}

			// If they don't, the user will be warned and be presented with the command to label their namespace as ambient if they
			// choose to do so.
			//
			// NOTE: This is a warning and not an error because the user may not intend to label their namespace as ambient.
			//