// TCP starts sending keepalive probes
			_ = syscall.SetsockoptInt(fd, syscall.IPPROTO_TCP, syscall.TCP_KEEPIDLE, 15)

			// Number of probes.
			// ~ cat /proc/sys/net/ipv4/tcp_keepalive_probes (defaults to 9, we reduce it to 5)
			_ = syscall.SetsockoptInt(fd, syscall.IPPROTO_TCP, syscall.TCP_KEEPCNT, 5)

			// Wait time after successful probe in seconds.

      privileged: false
      # The number of successive failed probes before indicating readiness failure.
      readinessFailureThreshold: 4
      # The initial delay for readiness probes in seconds.
      readinessInitialDelaySeconds: 0
      # The period between readiness probes.
      readinessPeriodSeconds: 15
      # Enables or disables a startup probe.

	HostProbeSNATIP = netip.MustParseAddr(env.RegisterStringVar("HOST_PROBE_SNAT_IP", DefaultHostProbeSNATIP, "").Get())
)

const (
	// to reliably identify kubelet healthprobes from inside the pod (versus standard kube-proxy traffic,
	// since the IP is normally the same), we SNAT identified host probes in the host netns to a fixed APIPA IP.
	//

      privileged: false

      # The number of successive failed probes before indicating readiness failure.
      readinessFailureThreshold: 4

      # The initial delay for readiness probes in seconds.
      readinessInitialDelaySeconds: 0

      # The period between readiness probes.
      readinessPeriodSeconds: 15

      # Enables or disables a startup probe.

  tlsConfig:
    ca:
      secret:
        name: {{ .Values.tls.certSecret }}
        key: {{ .Values.tls.publicCrt }}
    serverName: {{ template "minio.fullname" . }}
  {{- end }}
  prober:
    url: {{ template "minio.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.service.port }}
    path: /minio/v2/metrics/cluster
    {{- if .Values.tls.enabled }}
    scheme: https
    {{- else }}
    scheme: http

                                      description: The time duration between keep-alive
                                        probes.
                                      type: string
                                    probes:
                                      description: Maximum number of keepalive probes
                                        to send without response before deciding the

                                      description: The time duration between keep-alive
                                        probes.
                                      type: string
                                    probes:
                                      description: Maximum number of keepalive probes
                                        to send without response before deciding the

privileged securityContext privileged: false # The number of successive failed probes before indicating readiness failure. readinessFailureThre: 4 # The initial delay for readiness probes in seconds. readinessInitialDela: 0 # The period between readiness probes. readinessPeriodSecon: 15 # Enables or disables a startup probe. # For optimal startup times, changing this should be tied to the readiness probe values. # # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4....

## Healthcheck Probe

MinIO server has two healthcheck related un-authenticated endpoints, a liveness probe to indicate if server is responding, cluster probe to check if server can be taken down for maintenance.

- Liveness probe available at `/minio/health/live`
- Cluster probe available at `/minio/health/cluster`

	RouteTableInbound    = 100

	DNSCapturePort              = 15053
	ZtunnelInboundPort          = 15008
	ZtunnelOutboundPort         = 15001
	ZtunnelInboundPlaintextPort = 15006
	ProbeIPSet                  = "istio-inpod-probes"
)

var log = istiolog.RegisterScope("iptables", "iptables helper")

type Config struct {
	RestoreFormat     bool `json:"RESTORE_FORMAT"`
	TraceLogging      bool `json:"IPTABLES_TRACE_LOGGING"`