{"net.inet.ip.encdebug", []_C_int{4, 2, 0, 12}},
	{"net.inet.ip.forwarding", []_C_int{4, 2, 0, 1}},
	{"net.inet.ip.ifq.congestion", []_C_int{4, 2, 0, 30, 4}},
	{"net.inet.ip.ifq.drops", []_C_int{4, 2, 0, 30, 3}},
	{"net.inet.ip.ifq.len", []_C_int{4, 2, 0, 30, 1}},
	{"net.inet.ip.ifq.maxlen", []_C_int{4, 2, 0, 30, 2}},
	{"net.inet.ip.maxqueue", []_C_int{4, 2, 0, 11}},

	{"net.inet.ip.encdebug", []_C_int{4, 2, 0, 12}},
	{"net.inet.ip.forwarding", []_C_int{4, 2, 0, 1}},
	{"net.inet.ip.ifq.congestion", []_C_int{4, 2, 0, 30, 4}},
	{"net.inet.ip.ifq.drops", []_C_int{4, 2, 0, 30, 3}},
	{"net.inet.ip.ifq.len", []_C_int{4, 2, 0, 30, 1}},
	{"net.inet.ip.ifq.maxlen", []_C_int{4, 2, 0, 30, 2}},
	{"net.inet.ip.maxqueue", []_C_int{4, 2, 0, 11}},

  // those as well.
  int num_args = cloned_branches[0].getNumArguments();
  llvm::BitVector used_args(num_args);
  for (func::FuncOp func : branches) {
    for (BlockArgument arg : func.getArguments()) {
      if (!arg.use_empty()) used_args.set(arg.getArgNumber());
    }
  }

  // There are some unused args that we can drop. Also drop the corresponding
  // input operand.

	if err != nil {
		t.Errorf("unexpected error creating rule: %v", err)
	} else if existed {
		t.Errorf("wrong return value from EnsureRule with non-existent rule")
	}
	existed, err = fake.EnsureRule(iptables.Append, iptables.TableNAT, iptables.Chain("KUBE-TEST"), "-j", "DROP")
	if err != nil {
		t.Errorf("unexpected error creating rule: %v", err)

	add element ip testing no-endpoint-nodeports { tcp . 3001 comment "ns2/svc2:p80" : drop }
	add element ip testing no-endpoint-services { 1.2.3.4 . tcp . 80 comment "ns2/svc2:p80" : drop }
	add element ip testing no-endpoint-services { 192.168.99.22 . tcp . 80 comment "ns2/svc2:p80" : drop }
	`)

var testExpected = dedent.Dedent(`
	add table ip testing { comment "rules for kube-proxy" ; }

			}
		}

		// Capabilities
		{
			modifiedSC := nonNilSC(tc.newSC())
			m := NewContainerSecurityContextMutator(tc.newSC())
			modifiedSC.Capabilities = &api.Capabilities{Drop: []api.Capability{"test2"}}
			m.SetCapabilities(&api.Capabilities{Drop: []api.Capability{"test2"}})
			if !reflect.DeepEqual(m.ContainerSecurityContext(), modifiedSC) {

				:KUBE-FORWARD - [0:0]
				:KUBE-NODEPORTS - [0:0]
				-A KUBE-NODEPORTS -m comment --comment "ns2/svc2:p80 health check node port" -m tcp -p tcp --dport 30000 -j ACCEPT
				-A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP
				-A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT

      readOnlyRootFilesystem: true
      runAsGroup: 1001
      runAsUser: 1001
      runAsNonRoot: true
      capabilities:
        add:
        - NET_BIND_SERVICE
        drop:
        - ALL
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /kube-dns-config
      name: kube-dns-config

            memory: 1Gi
          requests:
            cpu: 100m
            memory: 128Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
          runAsGroup: 1337
          runAsNonRoot: true
          runAsUser: 1337
        startupProbe:

			name:             "Ratcheting, For creation, FG disabled, no OptionalOldSelf, no field drop",
			enableRatcheting: false,
			crd:              &apiextensions.CustomResourceDefinition{},
			oldCRD:           nil,
			expectedCRD:      &apiextensions.CustomResourceDefinition{},
		},
		{
			name:             "Ratcheting, For creation, FG disabled, set OptionalOldSelf, drop OptionalOldSelf",
			enableRatcheting: false,