{{ end -}}
    securityContext:
      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
      allowPrivilegeEscalation: true
      capabilities:
        add:
        - NET_ADMIN
        drop:
        - ALL
      privileged: true

    {{ end -}}
    securityContext:
      {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }}
      allowPrivilegeEscalation: true
      capabilities:
        add:
        - NET_ADMIN
        drop:
        - ALL
      privileged: true

)

var log = istiolog.RegisterScope("iptables", "iptables helper")

type Config struct {
	RestoreFormat bool `json:"RESTORE_FORMAT"`
	TraceLogging  bool `json:"IPTABLES_TRACE_LOGGING"`
	EnableIPv6    bool `json:"ENABLE_INBOUND_IPV6"`
	RedirectDNS   bool `json:"REDIRECT_DNS"`
}

type IptablesConfigurator struct {
	ext    dep.Dependencies
	nlDeps NetlinkDependencies
	cfg    *Config

apiVersion: apps/v1
kind: Deployment
metadata:
  creationTimestamp: null
  name: hello
spec:
  replicas: 7
  selector:
    matchLabels:
      app: hello
      tier: backend
      track: stable
  strategy: {}
  template:
    metadata:
      annotations:
        prometheus.io/path: /stats/prometheus
        prometheus.io/port: "15020"
        prometheus.io/scrape: "true"

  // otherwise identical (parallel requests, requests when earlier requests did not modify etc)
  // The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
  // It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
  optional string uid = 1;

                  "max_connections": 4294967295,
                  "max_pending_requests": 4294967295,
                  "max_requests": 4294967295,
                  "max_retries": 4294967295,
                  "track_remaining": true
                }
              ]
            },
            "metadata": {
              "filter_metadata": {
                "istio": {
                  "default_original_port": 9080,

Note: `Full` only refers to whether a `PushContext` recomputation is needed. Even within a `Full` push, we keep track of which configuration updates triggered this, so we could have "Full update of Config X" or "Full update of all configs".

      includeIPRanges: "*"
      excludeIPRanges: ""
      includeOutboundPorts: ""
      excludeOutboundPorts: ""
      # Log level for proxy, applies to gateways and sidecars.
      # Expected values are: trace|debug|info|warning|error|critical|off
      logLevel: warning
      #If set to true, istio-proxy container will have privileged securityContext
      privileged: false

cloud.google.com/go/security v1.16.0 h1:dzc3oYxFG/9+uMwmxpnG+te4ZEEkbzvBoAFR1Va36N4=
cloud.google.com/go/security v1.16.0/go.mod h1:e1GsICfB1nLCRXOq0yaRlKE/6RUAlBqmalTYQH4J2Xo=
cloud.google.com/go/trace v1.10.6 h1:XF0Ejdw0NpRfAvuZUeQe3ClAG4R/9w5JYICo7l2weaw=
cloud.google.com/go/trace v1.10.6/go.mod h1:EABXagUjxGuKcZMy4pXyz0fJpE5Ghog3jzTxcEsVJS4=
github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=

                          "typed_config": {
                            "@type": "type.googleapis.com/envoy.extensions.request_id.uuid.v3.UuidRequestIdConfig",
                            "use_request_id_for_trace_sampling": true
                          }
                        },
                        "path_with_escaped_slashes_action": "KEEP_UNCHANGED"
                      }
                    }
                  ],