// Append our rules here
	builder := cfg.appendInpodRules(hostProbeSNAT)

	if err := cfg.addLoopbackRoute(); err != nil {
		return err
	}

	if err := cfg.addInpodMarkIPRule(); err != nil {
		return err
	}

	log.Debug("Adding iptables rules")
	if err := cfg.executeCommands(builder); err != nil {
		log.Errorf("failed to restore iptables rules: %v", err)
		return err
	}

				ext := &dep.DependenciesStub{}
				iptConfigurator, _ := NewIptablesConfigurator(cfg, ext, EmptyNlDeps())
				var probeIP *netip.Addr
				if ipv6 {
					probeIP = &probeSNATipv6
				} else {
					probeIP = &probeSNATipv4
				}
				err := iptConfigurator.CreateInpodRules(probeIP)
				if err != nil {
					t.Fatal(err)
				}

				compareToGolden(t, ipv6, tt.name, ext.ExecutedAll)
			})
		}
	}
}

	expectPodAddedToIPSet(fixture.ipsetDeps, podMeta)
	err := netServer.AddPodToMesh(ctx, &corev1.Pod{ObjectMeta: podMeta}, podIPs, "faksens")
	// no calls to ztunnel if iptables failed
	assert.Equal(t, ztunnelServer.addedPods.Load(), 0)

	// error is not partial error
	if errors.Is(err, ErrPartialAdd) {
		t.Fatal("expected not a partial error")
	}
}

func TestConstructInitialSnap(t *testing.T) {

			kubeClient, err := ctx.CLIClient()
			if err != nil {
				return err
			}
			var podNames []string
			var podNamespace string
			if len(args) == 1 {
				podName, ns, err := getComponentPodName(ctx, args[0])
				if err != nil {
					return err
				}
				ztunnelPod := ambientutil.IsZtunnelPod(kubeClient, podName, ns)
				if !ztunnelPod {

		// the CNI binary installed.
		if err = installer.Run(ctx); err != nil {
			if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
				log.Infof("installer complete: %v", err)
				// Error was caused by interrupt/termination signal
				err = nil
			} else {
				log.Errorf("installer failed: %v", err)
			}
		}

		if cleanErr := installer.Cleanup(); cleanErr != nil {

          of the following places: within a NOTICE text file distributed
          as part of the Derivative Works; within the Source form or
          documentation, if provided along with the Derivative Works; or,
          within a display generated by the Derivative Works, if and
          wherever such third-party notices normally appear. The contents
          of the NOTICE file are for informational purposes only and

func (m *realDeps) clearEntriesWithComment(name, comment string) error {
	res, err := netlink.IpsetList(name)
	if err != nil {
		return fmt.Errorf("failed to list ipset %s: %w", name, err)
	}
	for _, entry := range res.Entries {
		if entry.Comment == comment {
			err := netlink.IpsetDel(name, &entry)
			if err != nil {
				return fmt.Errorf("failed to delete IP %s from ipset %s: %w", entry.IP, name, err)
			}
		}
	}

			// choose to do so.
			//
			// NOTE: This is a warning and not an error because the user may not intend to label their namespace as ambient.
			//
			// e.g. Users are handling ambient redirection per workload rather than at the namespace level.
			if enrollNamespace {
				namespaceIsLabeledAmbient, err := namespaceIsLabeledAmbient(kubeClient, ns)
				if err != nil {

			args: args{
				namespace: unlabelledNamespace,
				pod:       podWithSidecarAndAmbientEnabledLabel,
			},
			want: false,
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			if got := PodRedirectionEnabled(tt.args.namespace, tt.args.pod); got != tt.want {
				t.Errorf("PodRedirectionEnabled() = %v, want %v", got, tt.want)
			}
		})
	}

	log.Debug("pod netns was not found, trying to find it using procfs")
	// this can happen if the pod was dynamically added to the mesh after it was created.
	// in that case, try finding the netns using procfs.
	if err := s.rescanPod(pod); err != nil {
		log.Errorf("error scanning proc: error was %s", err)
		return nil, err
	}
	// try again. we can still get here if the pod is in the process of being created.