HostProbeSNATIPV6 = netip.MustParseAddr(env.RegisterStringVar("HOST_PROBE_SNAT_IPV6", DefaultHostProbeSNATIPV6, "").Get())
)

const (
	// to reliably identify kubelet healthprobes from inside the pod (versus standard kube-proxy traffic,
	// since the IP is normally the same), we SNAT identified host probes in the host netns to a fixed

				// TCP starts sending keepalive probes
				_ = syscall.SetsockoptInt(fd, syscall.IPPROTO_TCP, syscall.TCP_KEEPIDLE, 15)

				// Number of probes.
				// ~ cat /proc/sys/net/ipv4/tcp_keepalive_probes (defaults to 9, we reduce it to 5)
				_ = syscall.SetsockoptInt(fd, syscall.IPPROTO_TCP, syscall.TCP_KEEPCNT, 5)

				// Wait time after successful probe in seconds.

      privileged: false
      # The number of successive failed probes before indicating readiness failure.
      readinessFailureThreshold: 4
      # The initial delay for readiness probes in seconds.
      readinessInitialDelaySeconds: 0
      # The period between readiness probes.
      readinessPeriodSeconds: 15
      # Enables or disables a startup probe.

      privileged: false

      # The number of successive failed probes before indicating readiness failure.
      readinessFailureThreshold: 4

      # The initial delay for readiness probes in seconds.
      readinessInitialDelaySeconds: 0

      # The period between readiness probes.
      readinessPeriodSeconds: 15

      # Enables or disables a startup probe.

                                      description: The time duration between keep-alive
                                        probes.
                                      type: string
                                    probes:
                                      description: Maximum number of keepalive probes
                                        to send without response before deciding the

                                      description: The time duration between keep-alive
                                        probes.
                                      type: string
                                    probes:
                                      description: Maximum number of keepalive probes
                                        to send without response before deciding the

## Healthcheck Probe

MinIO server has two healthcheck related un-authenticated endpoints, a liveness probe to indicate if server is responding, cluster probe to check if server can be taken down for maintenance.

- Liveness probe available at `/minio/health/live`
- Cluster probe available at `/minio/health/cluster`

  repeated VolumeDevice volumeDevices = 21;

  // Probes are not allowed for ephemeral containers.
  // +optional
  optional Probe livenessProbe = 10;

  // Probes are not allowed for ephemeral containers.
  // +optional
  optional Probe readinessProbe = 11;

  // Probes are not allowed for ephemeral containers.
  // +optional
  optional Probe startupProbe = 22;

iptables -t nat -A ISTIO_POSTRT -m owner --socket-exists -p tcp -m set --match-set istio-inpod-probes-v4 dst -j SNAT --to-source 169.254.7.127
ip6tables -t nat -N ISTIO_POSTRT
ip6tables -t nat -A POSTROUTING -j ISTIO_POSTRT

	RouteTableInbound    = 100

	DNSCapturePort              = 15053
	ZtunnelInboundPort          = 15008
	ZtunnelOutboundPort         = 15001
	ZtunnelInboundPlaintextPort = 15006
	ProbeIPSet                  = "istio-inpod-probes"
)

var log = istiolog.RegisterScope("iptables", "iptables helper")

type Config struct {
	RestoreFormat bool `json:"RESTORE_FORMAT"`
	TraceLogging  bool `json:"IPTABLES_TRACE_LOGGING"`