}
}

func TestPodsAppearsWithNilNetnsWhenEnsureIsUsed(t *testing.T) {
	p := newPodNetnsCache(openNsTestOverride)

	p.Ensure("123")

	found := false
	snap := p.ReadCurrentPodSnapshot()
	for k, v := range snap {
		if k == "123" && v == (WorkloadInfo{}) {
			found = true
		}
	}
	if !found {
		t.Fatal("expected pod 123 to be in the cache")
	}
}

	}
	return nil
}

// TODO ctx is unused here
// nolint: unparam
func (z *ztunnelServer) sendSnapshot(ctx context.Context, conn *ZtunnelConnection) error {
	snap := z.pods.ReadCurrentPodSnapshot()
	for uid, wl := range snap {
		var resp *zdsapi.WorkloadResponse
		var err error
		log := log.WithLabels("uid", uid)
		if wl.Workload != nil {
			log = log.WithLabels(
				"name", wl.Workload.Name,

     * <origin><![CDATA[
     * <distributionManagement>
     * <repository>
     * <id>some-repo</id>
     * <url>scp://host/path</url>
     * </repository>
     * <snapshotRepository>
     * <id>some-snap-repo</id>
     * <url>scp://host/snapshot-path</url>
     * </snapshotRepository>
     * </distributionManagement>
     * ]]></origin>
     * <usage><![CDATA[

import java.util.Properties


@DisableCachingByDefault(because = "Not worth caching")
abstract class UpdateInitPluginTemplateVersionFile : DefaultTask() {

    private
    val devSuffixes = arrayOf(
        "-SNAP\\d+",
        "-SNAPSHOT",
        "-alpha.*\\d+",
        "-beta.*\\d+",
        "-dev-?\\d+",
        "-dev-\\d+-\\d+",
        "-rc-?\\d+",
        "-M.+",
        "-eap-?\\d+"

-N ISTIO_POSTRT
-A POSTROUTING -j ISTIO_POSTRT
-A ISTIO_POSTRT -m owner --socket-exists -p tcp -m set --match-set istio-inpod-probes-v4 dst -j SNAT --to-source 169.254.7.127
COMMIT
* nat
-N ISTIO_POSTRT
-A POSTROUTING -j ISTIO_POSTRT
-A ISTIO_POSTRT -m owner --socket-exists -p tcp -m set --match-set istio-inpod-probes-v6 dst -j SNAT --to-source fd16:9254:7127:1337:ffff:ffff:ffff:ffff

	iptablesBuilder.AppendRuleV4(
		iptableslog.UndefinedCommand, ChainHostPostrouting, iptablesconstants.NAT,
		"-m", "owner",
		"--socket-exists",
		"-p", "tcp",
		"-m", "set",
		"--match-set", fmt.Sprintf(ipset.V4Name, ProbeIPSet),
		"dst",
		"-j", "SNAT",
		"--to-source", hostSNATIP.String(),
	)

    if (!v2_reader_->status().ok()) {
      tsl::Set_TF_Status_from_Status(status, v2_reader_->status());
      return;
    }
    auto result = BuildV2VarMaps();
    var_to_shape_map_.swap(result.first);
    var_to_data_type_map_.swap(result.second);
  } else {
    reader_.reset(new TensorSliceReader(filename));
    if (!reader_->status().ok()) {
      tsl::Set_TF_Status_from_Status(status, reader_->status());
      return;

* nat
-N ISTIO_POSTRT
-A POSTROUTING -j ISTIO_POSTRT
-A ISTIO_POSTRT -m owner --socket-exists -p tcp -m set --match-set istio-inpod-probes-v4 dst -j SNAT --to-source 169.254.7.127

      "plugin_log_level": "info",
      "policy": {
        "type": "k8s"
      },
      "type": "calico"
    },
    {
      "capabilities": {
        "portMappings": true
      },
      "snat": true,
      "type": "portmap"
    },
    {
      "ambient_enabled": false,
      "cni_agent_run_dir": "/tmp",
      "dns": {},
      "exclude_namespaces": [
        "istio-system"
      ],

)

const (
	// to reliably identify kubelet healthprobes from inside the pod (versus standard kube-proxy traffic,
	// since the IP is normally the same), we SNAT identified host probes in the host netns to a fixed
	// APIPA/"link-local" IP.
	//
	// It doesn't matter what this IP is, so long as it's not routable and doesn't collide with anything else.
	//