Russ Cox <******@****.***> 1613759983 -0500

	tt := struct {
		name   string
		config func(cfg *Config)
	}{
		"default",
		func(cfg *Config) {
			cfg.RedirectDNS = true
		},
	}

	probeSNATipv4 := netip.MustParseAddr("169.254.7.127")

	cfg := constructTestConfig()
	tt.config(cfg)
	ext := &dep.DependenciesStub{}
	iptConfigurator, _ := NewIptablesConfigurator(cfg, ext, EmptyNlDeps())

	switch cfg.Version {
	case "29":
		// V29 -> V30
		cfg.Compression.Enabled = false
		cfg.Compression.Extensions = strings.Split(compress.DefaultExtensions, config.ValueSeparator)
		cfg.Compression.MimeTypes = strings.Split(compress.DefaultMimeTypes, config.ValueSeparator)
	case "30":
		// V30 -> V31
		cfg.OpenID = openid.Config{}
		cfg.Policy.OPA = opa.Args{
			URL:       &xnet.URL{},

	tempDir := t.TempDir()

	cfg := &config.InstallConfig{
		MountedCNINetDir: tempDir,
		KubeCAFile:       kubeCAFilepath,
		K8sServiceHost:   k8sServiceHost,
		K8sServicePort:   k8sServicePort,
	}

	expectedKC, err := createKubeConfig(cfg)
	if err != nil {
		t.Fatalf("expected no error: %+v", err)
	}
	err = checkExistingKubeConfigFile(cfg, expectedKC)

	if err == nil {

type NetlinkDependencies interface {
	AddInpodMarkIPRule(cfg *Config) error
	DelInpodMarkIPRule(cfg *Config) error
	AddLoopbackRoutes(cfg *Config) error
	DelLoopbackRoutes(cfg *Config) error
}

func RealNlDeps() NetlinkDependencies {
	return &realDeps{}
}

type realDeps struct{}

func (r *realDeps) AddInpodMarkIPRule(cfg *Config) error {
	return AddInpodMarkIPRule(cfg)
}

)

func AddInpodMarkIPRule(cfg *Config) error {
	err := forEachInpodMarkIPRule(cfg, netlink.RuleAdd)
	if errors.Is(err, unix.EEXIST) {
		log.Debugf("Ignoring exists error adding inpod mark ip rule: %v", err)
		return nil
	}
	return err
}

func DelInpodMarkIPRule(cfg *Config) error {
	return forEachInpodMarkIPRule(cfg, netlink.RuleDel)
}

func forEachInpodMarkIPRule(cfg *Config, f func(*netlink.Rule) error) error {

	cfg := config.DefaultConfig()
	cfg.CNIMode = true
	cfg.NetworkNamespace = netns
	cfg.ProxyPort = rdrct.targetPort
	cfg.ProxyUID = rdrct.noRedirectUID
	cfg.ProxyGID = rdrct.noRedirectGID
	cfg.InboundInterceptionMode = rdrct.redirectMode
	cfg.OutboundIPRangesInclude = rdrct.includeIPCidrs
	cfg.InboundPortsExclude = rdrct.excludeInboundPorts
	cfg.InboundPortsInclude = rdrct.includeInboundPorts

	if err != nil {
		return cfg, err
	}
	if eduration < 0 {
		return cfg, config.ErrInvalidBatchExpirationWorkersWait(nil)
	}

	if rduration > 0 {
		cfg.ReplicationWorkersWait = rduration
	}

	if kduration > 0 {
		cfg.KeyRotationWorkersWait = kduration
	}

	if eduration > 0 {
		cfg.ExpirationWorkersWait = eduration
	}

	return cfg, nil

	defer c.mu.RUnlock()

	return c.cfg.TransitionWorkers
}

func (c *ilmConfig) update(cfg ilm.Config) {
	c.mu.Lock()
	defer c.mu.Unlock()

	c.cfg = cfg

		if kvs.Empty() {
			return cfg, nil
		}
		return cfg, err
	}
	if !cfg.Enabled {
		return cfg, nil
	}

	allowEnc := env.Get(EnvCompressAllowEncryption, kvs.Get(AllowEncrypted))
	if allowEnc == "" {
		allowEnc = env.Get(EnvCompressAllowEncryptionLegacy, "")
	}

	cfg.AllowEncrypted, err = config.ParseBool(allowEnc)
	if err != nil {
		return cfg, err
	}