iptablesBuilder.AppendRule(
		iptableslog.UndefinedCommand, iptablesconstants.OUTPUT, iptablesconstants.NAT,
		"-j", ChainInpodOutput,
	)

	// From here on, we should be only inserting rules into our custom chains.

	// CLI: -A ISTIO_PRERT -m mark --mark 0x539/0xfff -j CONNMARK --set-xmark 0x111/0xfff
	//
	// DESC: If we have a packet mark, set a connmark.

    - unparam
    - unused
    - gci
    - gosec
  fast: false
linters-settings:
  errcheck:
    # report about not checking of errors in type assertions: `a := b.(MyStruct)`;
    # default is false: such cases aren't reported by default.
    check-type-assertions: false
    # report about assignment of errors to blank identifier: `num, _ := strconv.Atoi(numStr)`;
    # default is false: such cases aren't reported by default.

                "uid": "${datasource}"
              },
              "expr": "sum(rate(sidecar_injection_success_total[1m]))",
              "interval": "",
              "legendFormat": "Injections (Success)",
              "refId": "A"
            },
            {
              "datasource": {
                "type": "prometheus",
                "uid": "${datasource}"
              },

					if want, ok := predicate(s); ok {
						if want != found {
							t.Fatalf("expected webhook to go to service %q, found %q", want, found)
						}
						return
					}
					// Otherwise, look through our assertions for a matching one, and check that
					for _, w := range tt.checks {
						if w.namespaceLabel.String() == s.namespace.String() && w.objectLabel.String() == s.pod.String() {
							if found != w.match {

"seriesOverrides": [], "spaceLength": 10, "stack": false, "steppedLine": false, "targets": [ { "expr": "sum(rate(sidecar_injection_success_total[1m]))", "interval": "", "legendFormat": "Injections (Success)", "refId": "A" }, { "expr": "sum(rate(sidecar_injection_failure_total[1m]))", "interval": "", "legendFormat": "Injections (Failure)", "refId": "B" } ], "thresholds": [], "timeFrom": null, "timeRegions": [], "timeShift": null, "title": "Sidecar Injection", "tooltip": { "shared": true, "sort": 0, "value_type":...

                      properties:
                        filterClass:
                          description: |-
                            Determines the filter insertion order.

                            Valid Options: AUTHN, AUTHZ, STATS
                          enum:
                          - UNSPECIFIED
                          - AUTHN

                      properties:
                        filterClass:
                          description: |-
                            Determines the filter insertion order.

                            Valid Options: AUTHN, AUTHZ, STATS
                          enum:
                          - UNSPECIFIED
                          - AUTHN

* Be very, very careful.
* The cache has a builtin test, enabled with `UNSAFE_PILOT_ENABLE_RUNTIME_ASSERTIONS=true`, that runs in CI. This will panic if any key is written to with a different value.

#### Partial Computations