nspath1 := "/path/to/netns/1"
	nspath2 := "/path/to/netns/2"

	netns1, err := p.UpsertPodCache(pod, nspath1)
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}

	netns2, err := p.UpsertPodCache(pod, nspath2)
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}

	if !reflect.DeepEqual(netns1, netns2) {
		t.Fatalf("Expected the same Netns for the same uid, got %v and %v", netns1, netns2)

| ------------- | ------------- | ------------- |
| from CNI plugin (sidecar) | host $PATH  | pod netns context |
| from init container  (sidecar) | init container $PATH  | pod netns context |
| from CNI agent (ambient) | CNI container $PATH  | pod netns context |
| from CNI agent (ambient) | CNI container $PATH  | host netns context |

// (ref: https://github.com/torvalds/linux/commit/13b287e8d1cad951634389f85b8c9b816bd3bb1e)
const TCPKeepAliveTimeNamespacedKernelVersion = "4.5"

// TCPKeepAliveIntervalNamespacedKernelVersion is the kernel version in which net.ipv4.tcp_keepalive_intvl was namespaced(netns).
// (ref: https://github.com/torvalds/linux/commit/b840d15d39128d08ed4486085e5507d2617b9ae1)

	ConstructInitialSnapshot(ambientPods []*corev1.Pod) error
	Start(ctx context.Context)

	//	IsPodInMesh(ctx context.Context, pod *metav1.ObjectMeta, netNs string) (bool, error)
	AddPodToMesh(ctx context.Context, pod *corev1.Pod, podIPs []netip.Addr, netNs string) error
	RemovePodFromMesh(ctx context.Context, pod *corev1.Pod) error
	DelPodFromMesh(ctx context.Context, pod *corev1.Pod) error

	Stop()
}

	for _, ipc := range prevResIps {
		ncconfigs = append(ncconfigs, nodeagent.IPConfig{Interface: ipc.Interface, Address: ipc.Address, Gateway: ipc.Gateway})
	}
	// Currently we only use the netns from the original CNI event
	addEvent := nodeagent.CNIPluginAddEvent{Netns: event.Netns, PodName: podName, PodNamespace: podNamespace, IPs: ncconfigs}
	eventData, err := json.Marshal(addEvent)
	if err != nil {
		return err
	}
	var response *http.Response

// an instance of netlinkHandler with the initialized socket.
func newNetlinkHandler() (handler, error) {
	socket, err := nl.GetNetlinkSocketAt(netns.None(), netns.None(), unix.NETLINK_NETFILTER)
	if err != nil {
		return nil, err
	}
	return &netlinkHandler{socket: socket}, nil
}

// newRequest creates a netlink request tailored for the NFAcct subsystem encapsulating the

	return msg, nil
}

func (s *CniPluginServer) ReconcileCNIAddEvent(ctx context.Context, addCmd CNIPluginAddEvent) error {
	log := log.WithLabels("cni-event", addCmd)

	log.Debugf("netns: %s", addCmd.Netns)

	// The CNI node plugin should have already checked the pod against the k8s API before forwarding us the event,

            - mountPath: /var/run/istio-cni
              name: cni-socket-dir
            {{- if .Values.cni.ambient.enabled }}
            - mountPath: /host/var/run/netns
              mountPropagation: HostToContainer
              name: cni-netns-dir
            - mountPath: /var/run/ztunnel
              name: cni-ztunnel-sock-dir
            {{ end }}
          resources:
{{- if .Values.cni.resources }}

		var msg nodeagent.CNIPluginAddEvent
		err = json.Unmarshal(data, &msg)
		assert.NoError(t, err)
		assert.Equal(t, msg.PodName, testPod)
		assert.Equal(t, msg.PodNamespace, testNS)
		assert.Equal(t, msg.Netns, fakeCmdArgs.Netns)
		res.WriteHeader(http.StatusOK)
		res.Write([]byte("server happy"))
	}))
	defer func() { testServer.Close() }()

	cniC := fakeCNIEventClient(testServer.URL)

package plugin

// InterceptRuleMgr configures networking tables (e.g. iptables or nftables) for
// redirecting traffic to an Istio proxy.
type InterceptRuleMgr interface {
	Program(podName, netns string, redirect *Redirect) error
}

// Constructor for iptables InterceptRuleMgr
func IptablesInterceptRuleMgr() InterceptRuleMgr {
	return newIPTables()