"-p", iptablesconstants.TCP,
		"-i", "lo",
		"-j", "ACCEPT")

	// CLI: -A ISTIO_PRERT -p tcp -m tcp --dport <INPORT> -m mark ! --mark 0x539/0xfff -j TPROXY --on-port <INPORT> --on-ip 127.0.0.1 --tproxy-mark 0x111/0xfff
	//
	// DESC: Anything heading to <INPORT> that does not have the mark, TPROXY to ztunnel inbound port <INPORT>
	iptablesBuilder.AppendRule(
		iptableslog.UndefinedCommand, ChainInpodPrerouting, iptablesconstants.MANGLE,

	// to the local service. If not set, no inbound port will be intercepted by istio iptablesOrFail.
	var table string
	if cfg.cfg.InboundPortsInclude != "" {
		if cfg.cfg.InboundInterceptionMode == constants.TPROXY {
			// When using TPROXY, create a new chain for routing all inbound traffic to
			// Envoy. Any packet entering this chain gets marked with the ${INBOUND_TPROXY_MARK} mark,

		return
	}

	// Overriding RunAsUser is now allowed in TPROXY mode, it must always run with uid=0
	tproxy := false
	if proxyConfig.InterceptionMode == meshconfig.ProxyConfig_TPROXY {
		tproxy = true
	} else if mode, found := finalPod.Annotations[annotation.SidecarInterceptionMode.Name]; found && mode == iptablesconstants.TPROXY {
		tproxy = true
	}

					constants.DataplaneModeLabel: constants.DataplaneModeNone,
				},
			},
		},
	}

	tProxy := echo.Config{
		Service:        TproxySvc,
		ServiceAccount: true,
		Ports:          ports.All(),
		Subsets: []echo.SubsetConfig{{
			Annotations: map[string]string{annotation.SidecarInterceptionMode.Name: "TPROXY"},
			Labels: map[string]string{
				constants.DataplaneModeLabel: constants.DataplaneModeNone,
			},

// GetProxyConfigNamespace extracts the namespace associated with the proxy
// from the proxy metadata or the proxy ID
func GetProxyConfigNamespace(proxy *Proxy) string {
	if proxy == nil {
		return ""
	}

	// First look for ISTIO_META_CONFIG_NAMESPACE
	// All newer proxies (from Istio 1.1 onwards) are supposed to supply this
	if len(proxy.Metadata.Namespace) > 0 {
		return proxy.Metadata.Namespace
	}

			want: "proxy-override-runas.yaml.injected",
		},
		{
			in:   "proxy-override-runas.yaml",
			want: "proxy-override-runas.yaml.cni.injected",
			setFlags: []string{
				"components.cni.enabled=true",
			},
		},
		{
			in:   "proxy-override-runas.yaml",
			want: "proxy-override-runas.yaml.tproxy.injected",
			mesh: func(m *meshapi.MeshConfig) {

  fun proxyMoveTest(cleanShutdown: Boolean) {
    // Define a single Proxy at myproxy:8008 that will artificially move during the test
    val proxySelector = RecordingProxySelector()
    val socketAddress = InetSocketAddress.createUnresolved("myproxy", 8008)
    proxySelector.proxies.add(Proxy(Proxy.Type.HTTP, socketAddress))

    // Define two host names for the DNS routing of fake proxy servers

	}
}

// resetProxyEnv is helper function that unsets all *_proxy variables.
func resetProxyEnv(t *testing.T) {
	for _, e := range os.Environ() {
		key, value, _ := strings.Cut(e, "=")
		if strings.HasSuffix(strings.ToLower(key), "_proxy") {
			t.Cleanup(func() { os.Setenv(key, value) })
			os.Unsetenv(key)
		}
	}

	t.Setenv("HTTP_PROXY", "http://proxy.example.com:3128")

		tag = fmt.Sprintf("%v", global.GetTag().AsInterface())
	}

	imageType := global.GetVariant()
	if image != nil {
		imageType = image.ImageType
	}

	if global.GetProxy() != nil && global.GetProxy().GetImage() != "" {
		imageName = global.GetProxy().GetImage()
	}

	if it, ok := annotations[annotation.SidecarProxyImageType.Name]; ok {
		imageType = it
	}

	"k8s.io/component-base/metrics/legacyregistry"
	"k8s.io/klog/v2"
	kubeproxyconfig "k8s.io/kubernetes/pkg/proxy/apis/config"
	"k8s.io/kubernetes/pkg/proxy/util/nfacct"
)

const kubeProxySubsystem = "kubeproxy"

var (
	// SyncProxyRulesLatency is the latency of one round of kube-proxy syncing proxy
	// rules. (With the iptables proxy, this includes both full and partial syncs.)
	SyncProxyRulesLatency = metrics.NewHistogram(