other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the
      direction or management of such entity, whether by contract or
      otherwise, or (ii) ownership of fifty percent (50%) or more of the
      outstanding shares, or (iii) beneficial ownership of such entity.

  // RuntimeClass. Pods using this RuntimeClass can only be scheduled to a
  // node matched by this selector. The RuntimeClass nodeSelector is merged
  // with a pod's existing nodeSelector. Any conflicts will cause the pod to
  // be rejected in admission.
  // +optional
  // +mapType=atomic
  map<string, string> nodeSelector = 1;

  // tolerations are appended (excluding duplicates) to pods running with this

  // daemonset on any given node can double if the readiness check fails, and
  // so resource intensive daemonsets should take into account that they may
  // cause evictions during disruption.
  // +optional
  optional k8s.io.apimachinery.pkg.util.intstr.IntOrString maxSurge = 2;
}

// Spec to control the desired behavior of rolling update.
message RollingUpdateDeployment {

	best := ""
	// We will iterate over all processes. Our goal is to find a process with the same network ID as we found above.
	// There should be 1 or 2 processes that match: the pause container should always be there, and the istio-validation *might*.
	// We want the pause container, as the istio-validation one may exit before we are done.

      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the
      direction or management of such entity, whether by contract or
      otherwise, or (ii) ownership of fifty percent (50%) or more of the
      outstanding shares, or (iii) beneficial ownership of such entity.

  // RuntimeClass. Pods using this RuntimeClass can only be scheduled to a
  // node matched by this selector. The RuntimeClass nodeSelector is merged
  // with a pod's existing nodeSelector. Any conflicts will cause the pod to
  // be rejected in admission.
  // +optional
  // +mapType=atomic
  map<string, string> nodeSelector = 1;

  // tolerations are appended (excluding duplicates) to pods running with this

  // RuntimeClass. Pods using this RuntimeClass can only be scheduled to a
  // node matched by this selector. The RuntimeClass nodeSelector is merged
  // with a pod's existing nodeSelector. Any conflicts will cause the pod to
  // be rejected in admission.
  // +optional
  // +mapType=atomic
  map<string, string> nodeSelector = 1;

  // tolerations are appended (excluding duplicates) to pods running with this

	if err != nil {
		return nil, fmt.Errorf("error configuring iptables: %w", err)
	}

	// Create hostprobe rules now, in the host netns
	// Later we will reuse this same configurator inside the pod netns for adding other rules
	iptablesConfigurator.DeleteHostRules()

	if err := iptablesConfigurator.CreateHostRulesForHealthChecks(&HostProbeSNATIP, &HostProbeSNATIPV6); err != nil {

      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the
      direction or management of such entity, whether by contract or
      otherwise, or (ii) ownership of fifty percent (50%) or more of the
      outstanding shares, or (iii) beneficial ownership of such entity.

option go_package = "k8s.io/api/policy/v1";

// Eviction evicts a pod from its node subject to certain policies and safety constraints.
// This is a subresource of Pod.  A request to cause such an eviction is
// created by POSTing to .../pods/<pod name>/evictions.
message Eviction {
  // ObjectMeta describes the pod that is being evicted.
  // +optional