rbac: warning
  redis: warning
  router: warning
  runtime: warning
  stats: warning
  secret: warning
  tap: warning
  testing: warning
  thrift: warning
  tracing: warning
  upstream: warning
  udp: warning

	)

	// CLI: -A ISTIO_OUTPUT ! -o lo -p udp -m udp --dport 53 -j REDIRECT --to-port 15053
	//
	// DESC: If this is a UDP DNS request to a non-localhost resolver, send it to ztunnel DNS proxy port
	if redirectDNS {
		iptablesBuilder.AppendRule(
			iptableslog.UndefinedCommand, ChainInpodOutput, iptablesconstants.NAT,
			"!", "-o", "lo",
			"-p", "udp",
			"-m", "udp",
			"--dport", "53",
			"-j", "REDIRECT",

  // * must start and end with an alphanumeric character.
  // Default is empty string.
  optional string name = 1;

  // protocol represents the IP protocol for this port.
  // Must be UDP, TCP, or SCTP.
  // Default is TCP.
  optional string protocol = 2;

  // port represents the port number of the endpoint.
  // If this is not specified, ports are not restricted and must be

iptables -t mangle -A ISTIO_OUTPUT -m connmark --mark 0x111/0xfff -j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff
iptables -t nat -A ISTIO_OUTPUT ! -o lo -p udp -m udp --dport 53 -j REDIRECT --to-port 15053
iptables -t nat -A ISTIO_OUTPUT -p tcp -m mark --mark 0x111/0xfff -j ACCEPT
iptables -t nat -A ISTIO_OUTPUT ! -d 127.0.0.1/32 -o lo -j ACCEPT

KUBE_DNS_PORT_53_TCP_PROTO=tcp
# shellcheck disable=SC2034
KUBE_DNS_PORT_53_UDP=udp://10.110.0.10:53
# shellcheck disable=SC2034
KUBE_DNS_PORT_53_UDP_PROTO=udp
# shellcheck disable=SC2034
KUBERNETES_PORT_443_TCP_PROTO=tcp
# shellcheck disable=SC2034
KUBERNETES_PORT_443_TCP_ADDR=10.110.0.1
# shellcheck disable=SC2034
KUBE_DNS_PORT_53_UDP_ADDR=10.110.0.10
# shellcheck disable=SC2034
KUBERNETES_PORT=tcp://10.110.0.1:443

        ports:
        - containerPort: 7472
          name: monitoring
        - containerPort: 7946
          name: memberlist-tcp
        - containerPort: 7946
          name: memberlist-udp
          protocol: UDP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /metrics
            port: monitoring
          initialDelaySeconds: 0
          periodSeconds: 10

iptables -t mangle -A ISTIO_OUTPUT -m connmark --mark 0x111/0xfff -j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff
iptables -t nat -A ISTIO_OUTPUT ! -o lo -p udp -m udp --dport 53 -j REDIRECT --to-port 15053
iptables -t nat -A ISTIO_OUTPUT -p tcp -m mark --mark 0x111/0xfff -j ACCEPT
iptables -t nat -A ISTIO_OUTPUT ! -d 127.0.0.1/32 -o lo -j ACCEPT

-A ISTIO_OUTPUT -j ISTIO_REDIRECT
-A OUTPUT -p udp --dport 53 -m owner --uid-owner 1337 -j RETURN
-A OUTPUT -p udp --dport 53 -m owner --gid-owner 1337 -j RETURN
-A OUTPUT -p udp --dport 53 -j REDIRECT --to-port 15053
COMMIT
* raw
-A OUTPUT -p udp --dport 53 -m owner --uid-owner 1337 -j CT --zone 1
-A OUTPUT -p udp --sport 15053 -m owner --uid-owner 1337 -j CT --zone 2
-A OUTPUT -p udp --dport 53 -m owner --gid-owner 1337 -j CT --zone 1

  optional int32 hostPort = 2;

  // Number of port to expose on the pod's IP address.
  // This must be a valid port number, 0 < x < 65536.
  optional int32 containerPort = 3;

  // Protocol for port. Must be UDP, TCP, or SCTP.
  // Defaults to "TCP".
  // +optional
  // +default="TCP"
  optional string protocol = 4;

  // What host IP to bind the external port to.
  // +optional
  optional string hostIP = 5;
}

  // * must start and end with an alphanumeric character.
  // Default is empty string.
  optional string name = 1;

  // protocol represents the IP protocol for this port.
  // Must be UDP, TCP, or SCTP.
  // Default is TCP.
  optional string protocol = 2;

  // port represents the port number of the endpoint.
  // If this is not specified, ports are not restricted and must be