return cfg, err
			}
		}
	}

	switch speed := env.Get(EnvSpeed, kvs.GetWithDefault(Speed, DefaultKVS)); speed {
	case "fastest":
		cfg.Delay, cfg.MaxWait, cfg.Cycle = 0, 0, time.Second
	case "fast":
		cfg.Delay, cfg.MaxWait, cfg.Cycle = 1, 100*time.Millisecond, time.Minute
	case "default":
		cfg.Delay, cfg.MaxWait, cfg.Cycle = 2, time.Second, time.Minute
	case "slow":

}

// New - initialize new etcd client.
func New(cfg Config) (*clientv3.Client, error) {
	if !cfg.Enabled {
		return nil, nil
	}
	cli, err := clientv3.New(cfg.Config)
	if err != nil {
		return nil, err
	}
	cli.KV = namespace.NewKV(cli.KV, cfg.PathPrefix)
	cli.Watcher = namespace.NewWatcher(cli.Watcher, cfg.PathPrefix)
	cli.Lease = namespace.NewLease(cli.Lease, cfg.PathPrefix)
	return cli, nil
}

	if err != nil {
		return cfg, err
	}
	if eduration < 0 {
		return cfg, config.ErrInvalidBatchExpirationWorkersWait(nil)
	}

	if rduration > 0 {
		cfg.ReplicationWorkersWait = rduration
	}

	if kduration > 0 {
		cfg.KeyRotationWorkersWait = kduration
	}

	if eduration > 0 {
		cfg.ExpirationWorkersWait = eduration
	}

	return cfg, nil

		return
	}

	cfg, err := readServerConfig(ctx, objectAPI, nil)
	if err != nil {
		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
		return
	}

	if err = cfg.DelFrom(bytes.NewReader(kvBytes)); err != nil {
		writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
		return
	}

	if err = validateConfig(ctx, cfg, subSys); err != nil {

	if err != nil {
		return cfg, err
	}

	cfg.RequestsMax = requestsMax
	if requestsMax < 0 {
		return cfg, errors.New("invalid API max requests value")
	}

	clusterDeadline, err := time.ParseDuration(env.Get(EnvAPIClusterDeadline, kvs.GetWithDefault(apiClusterDeadline, DefaultKVS)))
	if err != nil {
		return cfg, err
	}
	cfg.ClusterDeadline = clusterDeadline

	if err != nil {
		return cfg, err
	}

	cfg.HSTSSeconds = hstsSeconds
	cfg.HSTSIncludeSubdomains = hstsIncludeSubdomains
	cfg.HSTSPreload = hstsPreload

	referrerPolicy := env.Get(EnvBrowserReferrerPolicy, kvs.GetWithDefault(browserReferrerPolicy, DefaultKVS))
	switch referrerPolicy {

)

func AddInpodMarkIPRule(cfg *Config) error {
	err := forEachInpodMarkIPRule(cfg, netlink.RuleAdd)
	if errors.Is(err, unix.EEXIST) {
		log.Debugf("Ignoring exists error adding inpod mark ip rule: %v", err)
		return nil
	}
	return err
}

func DelInpodMarkIPRule(cfg *Config) error {
	return forEachInpodMarkIPRule(cfg, netlink.RuleDel)
}

func forEachInpodMarkIPRule(cfg *Config, f func(*netlink.Rule) error) error {

	setup(t)
	tt := struct {
		name   string
		config func(cfg *Config)
	}{
		"default",
		func(cfg *Config) {
			cfg.RedirectDNS = true
		},
	}

	probeSNATipv4 := netip.MustParseAddr("169.254.7.127")
	probeSNATipv6 := netip.MustParseAddr("e9ac:1e77:90ca:399f:4d6d:ece2:2f9b:3164")

	cfg := &Config{}
	tt.config(cfg)

	deps := &dep.RealDependencies{}

			return cfg, err
		}
	case config.AuditWebhookSubSys:
		cfg = lookupLegacyConfigForSubSys(ctx, config.AuditWebhookSubSys)
		if cfg, err = lookupAuditWebhookConfig(scfg, cfg); err != nil {
			return cfg, err
		}
	case config.AuditKafkaSubSys:
		cfg.AuditKafka = make(map[string]kafka.Config)
		if cfg, err = lookupAuditKafkaConfig(scfg, cfg); err != nil {
			return cfg, err
		}
	}
	return cfg, nil
}

		name        string
		config      func(cfg *Config)
		ingressMode bool
	}{
		{
			name: "default",
			config: func(cfg *Config) {
				cfg.RedirectDNS = true
			},
		},
		{
			name: "tproxy",
			config: func(cfg *Config) {
				cfg.TPROXYRedirection = true
				cfg.RedirectDNS = true
			},
		},
		{
			name: "ingress",
			config: func(cfg *Config) {
			},
			ingressMode: true,
		},
	}