// CLI: -t mangle -A ISTIO_PRERT -s 169.254.7.127 -p tcp -m tcp --dport <PROBEPORT> -j ACCEPT
	//
	// DESC: If this is one of our node-probe ports and is from our SNAT-ed/"special" hostside IP, short-circuit out here
	iptablesBuilder.AppendRule(iptableslog.UndefinedCommand, ChainInpodPrerouting, iptablesconstants.MANGLE,
		"-s", hostProbeSNAT.String(),
		"-p", "tcp",
		"-m", "tcp",
		"-j", "ACCEPT",
	)

		UID:       "123",
	}
	podIP := netip.MustParseAddr("99.9.9.9")
	podIPs := []netip.Addr{podIP}

	fixture.ipsetDeps.On("addIP",
		"foo-v4",
		netip.MustParseAddr("99.9.9.9"),
		uint8(unix.IPPROTO_TCP),
		string(podMeta.UID),
		true,
	).Return(nil)

	err := netServer.AddPodToMesh(ctx, &corev1.Pod{ObjectMeta: podMeta}, podIPs, "fakenetns")
	assert.NoError(t, err)

iptables -t nat -A POSTROUTING -j ISTIO_POSTRT
iptables -t nat -A ISTIO_POSTRT -m owner --socket-exists -p tcp -m set --match-set istio-inpod-probes-v4 dst -j SNAT --to-source 169.254.7.127
ip6tables -t nat -N ISTIO_POSTRT
ip6tables -t nat -A POSTROUTING -j ISTIO_POSTRT

  loadBalancerIP: {{ .Values.consoleService.loadBalancerIP }}
  {{- end }}
  ports:
    - name: {{ $scheme }}
      port: {{ .Values.consoleService.port }}
      protocol: TCP
      {{- if (and (eq .Values.consoleService.type "NodePort") ( .Values.consoleService.nodePort)) }}
      nodePort: {{ .Values.consoleService.nodePort }}
      {{- else }}
      targetPort: {{ .Values.minioConsolePort }}

  loadBalancerIP: {{ default "" .Values.service.loadBalancerIP | quote }}
  {{- end }}
  ports:
    - name: {{ $scheme }}
      port: {{ .Values.service.port }}
      protocol: TCP
      {{- if (and (eq .Values.service.type "NodePort") ( .Values.service.nodePort)) }}
      nodePort: {{ .Values.service.nodePort }}
      {{- else }}
      targetPort: {{ .Values.minioAPIPort }}
      {{- end }}

iptables -t nat -N ISTIO_POSTRT
iptables -t nat -A POSTROUTING -j ISTIO_POSTRT

	// Add the pod UID as an ipset entry comment, so we can (more) easily find and delete
	// all relevant entries for a pod later.
	podUID := string(pod.ObjectMeta.UID)
	ipProto := uint8(unix.IPPROTO_TCP)

	var ipsetAddrErrs []error

	// For each pod IP
	for _, pip := range podIPs {
		// Add to host ipset
		log.Debugf("adding pod %s probe to ipset %s with ip %s", pod.Name, hostsideProbeSet.Prefix, pip)

.Release.Name }} heritage: {{ .Release.Service }} spec: endpointSelector: matchLabels: app: {{ template "minio.name" . }} release: {{ .Release.Name }} ingress: - toPorts: - ports: - port: "{{ .Values.minioAPIPort }}" protocol: TCP - port: "{{ .Values.minioConsolePort }}" protocol: TCP {{- if not .Values.networkPolicy.allowExternal }} fromEndpoints: - matchLabels: {{ template "minio.name" . }}-client: "true" {{- end }} egress: {{- range $entity := .Values.networkPolicy.egressEntities }} - toEntities: -...