)

const (
	// to reliably identify kubelet healthprobes from inside the pod (versus standard kube-proxy traffic,
	// since the IP is normally the same), we SNAT identified host probes in the host netns to a fixed
	// APIPA/"link-local" IP.
	//
	// It doesn't matter what this IP is, so long as it's not routable and doesn't collide with anything else.
	//

  reserved 4;
  string name = 1;
  string namespace = 2;
  string service_account = 3;
}

// Add a workload to the ztunnel. this will be accompanied by ancillary data contianing
// the workload's netns file descriptor.
message AddWorkload {
  string uid = 1;
  WorkloadInfo workload_info = 2;
}

// Keep workload that we can't find in the fd cache. This can only be sent before SnapshotSent is sent

	defer cancel()

	pods := &fakePodCache{}

	pod, f := podAndNetns()
	f.Close()
	pods.pods = map[string]WorkloadInfo{
		string(pod.UID): {}, // simulate unknown netns
	}

	fixture := connectWithPods(ctx, pods)
	ztunClient := fixture.ztunClient
	// read initial pod add
	keep, fds := readRequest(t, ztunClient)
	assert.Equal(t, len(fds), 0)

				log.Infof("pod %s update event skipped, reason: added/labeled by CNI plugin", pod.Name)
				return nil
			}

			log.Debugf("pod %s now matches, adding to mesh", newPod.Name)
			// netns == ""; at this point netns should have been added via the initial snapshot,
			// or via the cni plugin. If it happens to get here before the cni plugin somehow,

	// (https://github.com/torvalds/linux/blob/v4.10/net/netfilter/nf_conntrack_core.c#L1795-L1796).
	// Usually that's fine. But in some configurations such as with github.com/kinvolk/kubeadm-nspawn,
	// kube-proxy is in another netns.
	// Therefore, check if writing in hashsize is necessary and skip the writing if not.
	hashsize, err := readIntStringFile("/sys/module/nf_conntrack/parameters/hashsize")
	if err != nil {
		return err
	}

			Name:      testNSName,
			Namespace: "",
			Labels:    map[string]string{},
		},
	}

	return fakePod, fakeNS
}

func (mrdir *mockInterceptRuleMgr) Program(podName, netns string, redirect *Redirect) error {
	mrdir.lastRedirect = append(mrdir.lastRedirect, redirect)
	return nil
}

// returns the test server URL and a dispose func for the test server

		"--mark", inpodMark,
		"-j", "CONNMARK",
		"--set-xmark", inpodTproxyMark)

	// Handle healthcheck probes from the host node. In the host netns, before the packet enters the pod, we SNAT
	// the healthcheck packet to a fixed IP if the packet is coming from a node-local process with a socket.
	//

	log.Debugf("Setting up redirect")

	redirect, err := NewRedirect(pi)
	if err != nil {
		log.Errorf("redirect failed due to bad params: %v", err)
		return err
	}

	if err := rulesMgr.Program(podName, args.Netns, redirect); err != nil {
		return err
	}

	return nil
}

func setupLogging(conf *Config) {
	if conf.LogUDSAddress != "" {
		// reconfigure log output with tee to UDS if UDS log is enabled.

	github.com/spf13/viper v1.19.0
	github.com/stoewer/go-strcase v1.3.0
	github.com/stretchr/testify v1.9.0
	github.com/vishvananda/netlink v1.2.1-beta.2.0.20240411215012-578e95cc3190
	github.com/vishvananda/netns v0.0.4
	github.com/yl2chen/cidranger v1.0.2
	go.opentelemetry.io/otel v1.27.0
	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.27.0
	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0

	github.com/robfig/cron/v3 v3.0.1
	github.com/spf13/cobra v1.8.0
	github.com/spf13/pflag v1.0.5
	github.com/stretchr/testify v1.8.4
	github.com/vishvananda/netlink v1.1.0
	github.com/vishvananda/netns v0.0.4
	go.etcd.io/etcd/api/v3 v3.5.13
	go.etcd.io/etcd/client/pkg/v3 v3.5.13
	go.etcd.io/etcd/client/v3 v3.5.13
	go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful v0.42.0