// Value must be non-negative integer. The value zero indicates delete immediately.
  // If this value is nil, the default grace period will be used instead.
  // The grace period is the duration in seconds after the processes running in the carp are sent
  // a termination signal and the time when the processes are forcibly halted with a kill signal.

  // container crashes or exits. The Pod's termination grace period countdown begins before the
  // PreStop hook is executed. Regardless of the outcome of the handler, the
  // container will eventually terminate within the Pod's termination grace
  // period (unless delayed by finalizers). Other management of the container blocks until the hook completes
  // or until the termination grace period is reached.

# Usage: tracing::extract_prow_trace.
# If running in a prow job, this sets the parent trace to the same value Prow tracing will use, as defined in https://github.com/kubernetes/test-infra/issues/30010
function tracing::extract_prow_trace() {
  if [[ "${PROW_JOB_ID:-}" != "" ]]; then
    local trace
    trace="$(<<< "$PROW_JOB_ID" tr -d '\-')"
    local span
    span="${trace:0:16}"
    export TRACEPARENT="01-${trace}-${span}-00"

  # diagnostic information from Envoy. See
  # https://lyft.github.io/envoy/docs/operations/admin.html
  # for more details
  proxyAdminPort: 15000
  #
  # Zipkin trace collector
  zipkinAddress: ""
  #
  # Statsd metrics collector converts statsd metrics into Prometheus metrics.
  statsdUdpAddress: ""
  #
  # Mutual TLS authentication between sidecars and istio control plane.

          address: {{ ((.Values.global.tracer).datadog).address | default "$(HOST_IP):8126" }}
      {{- else if eq .Values.global.proxy.tracer "stackdriver" }}
        stackdriver:
          # enables trace output to stdout.
          debug: {{ (($.Values.global.tracer).stackdriver).debug | default "false" }}
          # The global default max number of attributes per span.

    {{ end -}}
    securityContext:
      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
      allowPrivilegeEscalation: true
      capabilities:
        add:
        - NET_ADMIN
        drop:
        - ALL
      privileged: true

    {{ end -}}
    securityContext:
      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
      allowPrivilegeEscalation: true
      capabilities:
        add:
        - NET_ADMIN
        drop:
        - ALL
      privileged: true

)

var log = istiolog.RegisterScope("iptables", "iptables helper")

type Config struct {
	RestoreFormat bool `json:"RESTORE_FORMAT"`
	TraceLogging  bool `json:"IPTABLES_TRACE_LOGGING"`
	EnableIPv6    bool `json:"ENABLE_INBOUND_IPV6"`
	RedirectDNS   bool `json:"REDIRECT_DNS"`
}

type IptablesConfigurator struct {
	ext    dep.Dependencies
	nlDeps NetlinkDependencies
	cfg    *Config

## Certificate Rotation

The agent also handles rotating certificates near expiration. It does so by triggering a callback from the `SecretManager` to the SDS server
when a certificate is near expiration (configurable by `SECRET_GRACE_PERIOD_RATIO`, defaulting to half of the expiration). If the SDS server
is still interested in this certificate (ie, Envoy is still connected and requesting the certificate), the SDS server will send another request

	// Repair
	registerBooleanParameter(constants.RepairEnabled, true, "Whether to enable race condition repair or not")
	registerBooleanParameter(constants.RepairDeletePods, false, "Controller will delete pods when detecting pod broken by race condition")
	registerBooleanParameter(constants.RepairLabelPods, false, "Controller will label pods when detecting pod broken by race condition")
	registerStringParameter(constants.RepairLabelKey, "cni.istio.io/uninitialized",