// 2) has CAP_SYS_ADMIN
  // Note that this field cannot be set when spec.os.name is windows.
  // +optional
  optional bool allowPrivilegeEscalation = 7;

  // procMount denotes the type of proc mount to use for the containers.
  // The default is DefaultProcMount which uses the container runtime defaults for
  // readonly paths and masked paths.
  // This requires the ProcMountType feature flag to be enabled.

// limitations under the License.

package nodeagent

import "testing"

func TestOpenNetns(t *testing.T) {
	ns, err := OpenNetns("/proc/self/ns/net")
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	// the inode for netns is proc dynamic, so it needs to be higher than
	// #define PROC_DYNAMIC_FIRST 0xF0000000U

	if ns.Inode() < 0xF0000000 {
		t.Fatalf("unexpected inode: %v", ns.Inode())
	}
	defer ns.Close()

	}
}

type PodNetnsFinder interface {
	FindNetnsForPods(filter map[types.UID]*corev1.Pod) (PodToNetns, error)
}

type PodNetnsProcFinder struct {
	proc fs.FS
}

func NewPodNetnsProcFinder(proc fs.FS) *PodNetnsProcFinder {
	return &PodNetnsProcFinder{proc: proc}
}

func isNotNumber(r rune) bool {
	return r < '0' || r > '9'
}

              - NET_RAW
              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
              # network namespaces in `/proc` to obtain descriptors for entering pod netnamespaces.
              # There does not appear to be a more granular capability for this.
              - SYS_ADMIN
{{- if .Values.cni.seccompProfile }}
            seccompProfile:

            {
              "datasource": {
                "type": "prometheus",
                "uid": "${datasource}"
              },
              "expr": "sum(increase(envoy_server_hot_restart_epoch[1m]))",
              "format": "time_series",
              "intervalFactor": 1,
              "legendFormat": "Envoy Restarts",
              "refId": "B"
            }
          ],

	if err != nil {
		return "", fmt.Errorf("network id: %v", err)
	}
	fs, err := procfs.NewFS("/host/proc")
	if err != nil {
		return "", fmt.Errorf("read procfs: %v", err)
	}
	procs, err := fs.AllProcs()
	if err != nil {
		return "", fmt.Errorf("read procs: %v", err)
	}
	oldest := uint64(math.MaxUint64)
	best := ""

		return nil, fmt.Errorf("error initializing the host rules for health checks: %w", err)
	}

	podNetns := NewPodNetnsProcFinder(os.DirFS(filepath.Join(pconstants.HostMountsPath, "proc")))
	netServer := newNetServer(ztunnelServer, podNsMap, iptablesConfigurator, podNetns, set)

	// Set some defaults
	s := &Server{
		ctx:        ctx,
		kubeClient: client,
		isReady:    ready,

	// this can happen if the pod was dynamically added to the mesh after it was created.
	// in that case, try finding the netns using procfs.
	if err := s.rescanPod(pod); err != nil {
		log.Errorf("error scanning proc: error was %s", err)
		return nil, err
	}
	// try again. we can still get here if the pod is in the process of being created.
	// in this case the CNI will be invoked soon and provide us with the netns.

"sum(irate(envoy_cluster_upstream_cx_connect_fail{cluster_name=\"xds-grpc\"}[1m]))", "format": "time_series", "hide": false, "intervalFactor": 1, "legendFormat": "XDS Connection Failures", "refId": "A" }, { "expr": "sum(increase(envoy_server_hot_restart_epoch[1m]))", "format": "time_series", "intervalFactor": 1, "legendFormat": "Envoy Restarts", "refId": "B" } ], "thresholds": [], "timeFrom": null, "timeRegions": [], "timeShift": null, "title": "Envoy Details", "tooltip": { "shared": true, "sort": 0, "value_type":...

//
// +protobuf.options.marshal=false
// +protobuf.as=Timestamp
// +protobuf.options.(gogoproto.goproto_stringer)=false
message MicroTime {
  // Represents seconds of UTC time since Unix epoch
  // 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
  // 9999-12-31T23:59:59Z inclusive.
  optional int64 seconds = 1;

  // Non-negative fractions of a second at nanosecond resolution. Negative