},
		{
			name:        "invalid-drop",
			annotations: map[string]string{annotation.SidecarStatus.Name: "true"},
			proxyEnv:    []corev1.EnvVar{{Name: cmd.InvalidDropByIptables, Value: "true"}},
			golden:      filepath.Join(env.IstioSrc, "cni/pkg/plugin/testdata/invalid-drop.txt.golden"),
		},
		{
			name:        "custom-uid",

            # But we don't need _everything_ in `privileged`, so drop+readd capabilities based on feature.
            # privileged is redundant with CAP_SYS_ADMIN
            # since it's redundant, hardcode it to `true`, then manually drop ALL + readd granular
            # capabilities we actually require
            capabilities:
              drop:
              - ALL
              add:

	}
}

type PodNetnsFinder interface {
	FindNetnsForPods(filter map[types.UID]*corev1.Pod) (PodToNetns, error)
}

type PodNetnsProcFinder struct {
	proc fs.FS
}

func NewPodNetnsProcFinder(proc fs.FS) *PodNetnsProcFinder {
	return &PodNetnsProcFinder{proc: proc}
}

func isNotNumber(r rune) bool {
	return r < '0' || r > '9'
}

// limitations under the License.

package nodeagent

import "testing"

func TestOpenNetns(t *testing.T) {
	ns, err := OpenNetns("/proc/self/ns/net")
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	// the inode for netns is proc dynamic, so it needs to be higher than
	// #define PROC_DYNAMIC_FIRST 0xF0000000U

	if ns.Inode() < 0xF0000000 {
		t.Fatalf("unexpected inode: %v", ns.Inode())
	}
	defer ns.Close()

	}
	output := out.String()
	expectedProfiles := []string{"default", "demo", "empty", "minimal", "openshift", "preview", "remote"}
	for _, prof := range expectedProfiles {
		g.Expect(output).To(ContainSubstring(prof))
	}

{{- with .Values.imagePullPolicy }}
        imagePullPolicy: {{ . }}
{{- end }}
        securityContext:
          allowPrivilegeEscalation: false
          privileged: false
          capabilities:
            drop:
            - ALL
            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
            - NET_ADMIN # Required for TPROXY and setsockopt

{{- end }}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            capabilities:
              drop:
              - ALL
{{- if .Values.pilot.seccompProfile }}
            seccompProfile:
{{ toYaml .Values.pilot.seccompProfile | trim | indent 14 }}
{{- end }}
          volumeMounts:

              protocol: {{ $val.protocol | default "TCP" }}
            {{- end }}
            - containerPort: 15090
              protocol: TCP
              name: http-envoy-prom
          args:
          - proxy
          - router
          - --domain
          - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
        {{- if .Values.global.proxy.logLevel }}

			return
		}

		// Creates a basic health endpoint server that reports health status
		// based on atomic flag, as set by installer
		// TODO nodeagent watch server should affect this too, and drop atomic flag
		installDaemonReady, watchServerReady := nodeagent.StartHealthServer()

		if cfg.InstallConfig.AmbientEnabled {
			// Start ambient controller

	createCmd.PersistentFlags().StringSliceVarP(&resourceLabels, "labels", "l", nil, "The labels to apply to the workload instances; e.g. -l env=prod,vers=2")
	createCmd.PersistentFlags().StringSliceVarP(&annotations, "annotations", "a", nil, "The annotations to apply to the workload instances")