* nat
-N ISTIO_POSTRT
-A POSTROUTING -j ISTIO_POSTRT
-A ISTIO_POSTRT -m owner --socket-exists -p tcp -m set --match-set istio-inpod-probes-v4 dst -j SNAT --to-source 169.254.7.127
COMMIT
* nat
-N ISTIO_POSTRT
-A POSTROUTING -j ISTIO_POSTRT
-A ISTIO_POSTRT -m owner --socket-exists -p tcp -m set --match-set istio-inpod-probes-v6 dst -j SNAT --to-source fd16:9254:7127:1337:ffff:ffff:ffff:ffff

* nat
-N ISTIO_POSTRT
-A POSTROUTING -j ISTIO_POSTRT
-A ISTIO_POSTRT -m owner --socket-exists -p tcp -m set --match-set istio-inpod-probes-v4 dst -j SNAT --to-source 169.254.7.127

                            type: string
                            x-kubernetes-validations:
                            - message: must be a valid duration greater than 1ms
                              rule: duration(self) >= duration('1ms')
                          probes:
                            description: Maximum number of keepalive probes to send

			"--mark", inpodMark,
			"-j", "CONNMARK",
			"--set-xmark", inpodTproxyMark)

		// Handle healthcheck probes from the host node. In the host netns, before the packet enters the pod, we SNAT
		// the healthcheck packet to a fixed IP if the packet is coming from a node-local process with a socket.
		//
		// We do this so we can exempt this traffic from ztunnel capture/proxy - otherwise both kube-proxy (legit)

                                logger.debug("Process command: {}", command);
                            }
                            if (Constants.CRAWLER_PROCESS_COMMAND_THREAD_DUMP.equals(command)) {
                                ThreadDumpUtil.printThreadDump();
                            } else {
                                logger.warn("Unknown process command: {}", command);
                            }

- Kubeadm: switched the kube-scheduler static Pod to use the endpoints /livez (for startup and liveness probes) and /readyz (for the readiness probe). Previously /healthz was used for all probes, which is deprecated behavior in the scope of this component. ([#126945](https://github.com/kubernetes/kubernetes/pull/126945), [@liangyuanpeng](https://github.com/liangyuanpeng)) [SIG Cluster Lifecycle]

     */
    public ToolchainsBuildingException(List<Problem> problems) {
        super(toMessage(problems));

        this.problems = new ArrayList<>();
        if (problems != null) {
            this.problems.addAll(problems);
        }
    }

    /**
     * Gets the problems that caused this exception.
     *
     * @return The problems that caused this exception, never {@code null}.
     */

func createHostsideProbeIpset(isV6 bool) (ipset.IPSet, error) {
	linDeps := ipset.RealNlDeps()
	probeSet, err := ipset.NewIPSet(iptables.ProbeIPSet, isV6, linDeps)
	if err != nil {
		return probeSet, err
	}
	probeSet.Flush()
	return probeSet, nil
}

func (s *Server) Start() {
	log.Info("CNI ambient server starting")
	s.kubeClient.RunAndWait(s.ctx.Done())

    public void validate(Settings settings, SettingsProblemCollector problems) {
        validate(settings, false, problems);
    }

    @Override
    public void validate(Settings settings, boolean isProjectSettings, SettingsProblemCollector problems) {
        List<BuilderProblem> list = settingsBuilder.validate(settings.getDelegate(), isProjectSettings);
        for (BuilderProblem problem : list) {

import java.util.List;

/**
 * Collects problems that are encountered during settings building.
 *
 */
public interface ProblemCollector {

    /**
     * Adds the specified problem.
     * Either message or exception is required
     *
     * @param severity The severity of the problem, must not be {@code null}.
     * @param message The detail message of the problem, may be {@code null}.