Close() error
}

/*
To clean up stale ztunnels

	we may need to ztunnel to send its (uid, bootid / boot time) to us
	so that we can remove stale entries when the ztunnel pod is deleted
	or when the ztunnel pod is restarted in the same pod (remove old entries when the same uid connects again, but with different boot id?)

	save a queue of what needs to be sent to the ztunnel pod and send it one by one when it connects.

  // +optional
  repeated string searches = 2;

  // A list of DNS resolver options.
  // This will be merged with the base options generated from DNSPolicy.
  // Duplicated entries will be removed. Resolution options given in Options
  // will override those that appear in the base DNSPolicy.
  // +optional
  repeated PodDNSConfigOption options = 3;
}

func (m *realDeps) clearEntriesWithComment(name, comment string) error {
	res, err := netlink.IpsetList(name)
	if err != nil {
		return fmt.Errorf("failed to list ipset %s: %w", name, err)
	}
	for _, entry := range res.Entries {
		if entry.Comment == comment {
			err := netlink.IpsetDel(name, &entry)
			if err != nil {
				return fmt.Errorf("failed to delete IP %s from ipset %s: %w", entry.IP, name, err)
			}
		}
	}
	return nil

  // the list automatically by PodDisruptionBudget controller after some time.
  // If everything goes smooth this map should be empty for the most of the time.
  // Large number of entries in the map may indicate problems with pod deletions.
  // +optional
  map<string, k8s.io.apimachinery.pkg.apis.meta.v1.Time> disruptedPods = 2;

  // Number of pod disruptions that are currently allowed.

message EndpointHints {
  // forZones indicates the zone(s) this endpoint should be consumed by to
  // enable topology aware routing. May contain a maximum of 8 entries.
  // +listType=atomic
  repeated ForZone forZones = 1;
}

// EndpointPort represents a Port used by an EndpointSlice
message EndpointPort {

func addPodToHostNSIpset(pod *corev1.Pod, podIPs []netip.Addr, hostsideProbeSet *ipset.IPSet) error {
	// Add the pod UID as an ipset entry comment, so we can (more) easily find and delete
	// all relevant entries for a pod later.
	podUID := string(pod.ObjectMeta.UID)
	ipProto := uint8(unix.IPPROTO_TCP)

	var ipsetAddrErrs []error

	// For each pod IP
	for _, pip := range podIPs {
		// Add to host ipset

false, "pluginVersion": "7.2.1", "pointradius": 2, "points": false, "renderer": "flot", "seriesOverrides": [], "spaceLength": 10, "stack": false, "steppedLine": false, "targets": [ { "expr": "avg(envoy_wasm_remote_load_cache_entries)", "interval": "", "legendFormat": "entries", "refId": "A" } ], "thresholds": [], "timeFrom": null, "timeRegions": [], "timeShift": null, "title": "Cache Entry", "tooltip": { "shared": true, "sort": 0, "value_type": "individual" }, "type": "graph", "xaxis": { "buckets":...

  // after a successful allocation and is opaque to Kubernetes. Driver
  // documentation may explain to users how to interpret this data if needed.
  //
  // Setting this field is optional. It has a maximum size of 32 entries.
  // If null (or empty), it is assumed this allocation will be processed by a
  // single kubelet plugin with no ResourceHandle data attached. The name of
  // the kubelet plugin invoked will match the DriverName set in the

  // The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
  // It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
  optional string uid = 1;

  // Kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)

	*/

	podUIDNetns := make(PodToNetns)
	netnsObserved := sets.New[uint64]()

	entries, err := fs.ReadDir(p.proc, ".")
	if err != nil {
		return nil, err
	}

	desiredUIDs := sets.New(maps.Keys(pods)...)
	for _, entry := range entries {
		// we can't break here because we need to close all the netns we opened
		// plus we want to return whatever we can to the user.