Modified: time.Date(2012, 2, 3, 19, 56, 48, 0, timeZone(-2*time.Hour)),
				Mode:     0777 | fs.ModeSymlink,
			},
		},
	},
	{
		Name: "readme.zip",
	},
	{
		Name:  "readme.notzip",
		Error: ErrFormat,
	},
	{
		Name: "dd.zip",
		File: []ZipTestFile{
			{
				Name:     "filename",
				Content:  []byte("This is a test textfile.\n"),

// via the nodeIP
// - kubelet (node-local healthchecks, which we do not capture)
// - kube-proxy (fowarded/proxied traffic from LoadBalancer-backed services, potentially with public IPs, which we must capture)
func (cfg *IptablesConfigurator) CreateHostRulesForHealthChecks(hostSNATIP, hostSNATIPV6 *netip.Addr) error {
	// Append our rules here

	return errors.New("not implemented on this platform")
}

func (m *realDeps) clearEntriesWithIP(name string, ip netip.Addr) error {
	return errors.New("not implemented on this platform")
}

func (m *realDeps) listEntriesByIP(name string) ([]netip.Addr, error) {
	return []netip.Addr{}, errors.New("not implemented on this platform")

	flush(name string) error
	clearEntriesWithComment(name string, comment string) error
	clearEntriesWithIP(name string, ip netip.Addr) error
	listEntriesByIP(name string) ([]netip.Addr, error)
}

// TODO this should actually create v6 and v6 subsets of type `hash:ip`, add them both to a
// superset of type `list:set` - we can then query the superset directly in iptables (with the same rule),

	fakeIPSetDeps.On("addIP",
		"foo-v4",
		netip.MustParseAddr("99.9.9.9"),
		ipProto,
		podUID,
		true,
	).Return(nil)

	fakeIPSetDeps.On("addIP",
		"foo-v4",
		netip.MustParseAddr("2.2.2.2"),
		ipProto,
		podUID,
		true,
	).Return(nil)

	podIPs := []netip.Addr{netip.MustParseAddr("99.9.9.9"), netip.MustParseAddr("2.2.2.2")}
	err := addPodToHostNSIpset(pod, podIPs, &set)

      operator: In
      values:
      - "{{ $tagName }}"
    - key: istio-injection
      operator: DoesNotExist
  objectSelector:
    matchExpressions:
    - key: sidecar.istio.io/inject
      operator: NotIn
      values:
      - "false"
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.object.") ) }}
  namespaceSelector:
    matchExpressions:
    - key: istio.io/rev
      operator: DoesNotExist

			Name:      "test",
			Namespace: "test",
			UID:       types.UID("test"),
		},
	}

	fakeCtx := context.Background()
	fakeClientSet := fake.NewSimpleClientset(pod)

	podIP := netip.MustParseAddr("99.9.9.1")
	podIPs := []netip.Addr{podIP}

	server := &fakeServer{}
	server.On("AddPodToMesh",
		fakeCtx,
		pod,
		podIPs,
		"",
	).Return(nil)

	server.Start(fakeCtx)
	m := meshDataplane{

func GetPodIPsIfPresent(pod *corev1.Pod) []netip.Addr {
	var podIPs []netip.Addr
	if len(pod.Status.PodIPs) != 0 {
		for _, pip := range pod.Status.PodIPs {
			ip := netip.MustParseAddr(pip.IP)
			podIPs = append(podIPs, ip)
		}
	} else if len(pod.Status.PodIP) != 0 {
		ip := netip.MustParseAddr(pod.Status.PodIP)
		podIPs = append(podIPs, ip)
	}
	return podIPs

	return args.Error(0)
}

func (m *MockedIpsetDeps) clearEntriesWithIP(name string, ip netip.Addr) error {
	args := m.Called(name, ip)
	return args.Error(0)
}

func (m *MockedIpsetDeps) listEntriesByIP(name string) ([]netip.Addr, error) {
	args := m.Called(name)
	return args.Get(0).([]netip.Addr), args.Error(1)

		config func(cfg *Config)
	}{
		{
			"default",
			func(cfg *Config) {
				cfg.RedirectDNS = true
			},
		},
	}
	probeSNATipv4 := netip.MustParseAddr("169.254.7.127")
	probeSNATipv6 := netip.MustParseAddr("e9ac:1e77:90ca:399f:4d6d:ece2:2f9b:3164")

	for _, tt := range cases {
		for _, ipv6 := range []bool{false, true} {
			t.Run(tt.name+"_"+ipstr(ipv6), func(t *testing.T) {
				cfg := constructTestConfig()