}

	// Must be last, the others refer to it
	chains = []string{constants.ISTIOREDIRECT, constants.ISTIOINREDIRECT}
	flushAndDeleteChains(ext, iptV, constants.NAT, chains)
}

// cleanupDNSUDP removes any IPv4/v6 UDP rules.
// TODO BML drop `HandleDSNUDP` and friends, no real need to tread UDP rules specially
// or create unique abstractions for them

        - mountPath: /var/run/secrets/tokens
          name: istio-token
        - mountPath: /etc/istio/pod
          name: istio-podinfo
      securityContext:
        sysctls:
        - name: net.ipv4.ip_unprivileged_port_start
          value: "0"
      serviceAccountName: default-istio
      volumes:
      - emptyDir: {}
        name: workload-socket
      - emptyDir: {}
        name: credential-socket

	// Also see https://github.com/istio/istio/issues/46719 why this flag is required
	EnableAdditionalIpv4OutboundListenerForIpv6Only = env.RegisterBoolVar("ISTIO_ENABLE_IPV4_OUTBOUND_LISTENER_FOR_IPV6_CLUSTERS", false,
		"If true, pilot will configure an additional IPv4 listener for outbound traffic in IPv6 only clusters, e.g. AWS EKS IPv6 only clusters.").Get()

                - Disabled
                type: string
              wireguardEnabled:
                description: 'WireguardEnabled controls whether Wireguard is enabled
                  for IPv4 (encapsulating IPv4 traffic over an IPv4 underlay network).
                  [Default: false]'
                type: boolean
              wireguardEnabledV6:

	}{
		{
			name: "internal k8s service with ipv4 & ipv6 endpoint for Kubernetes TCP protocol",
			instances: []*model.ServiceInstance{
				buildServiceInstance(svc, "10.10.10.10"),
				buildServiceInstance(svc, "fd00:10:244:1::11"),
			},
			services:    []*model.Service{svc},
			listenersOn: "0.0.0.0_9999",
		},
		{
			name: "external service with ipv4 & ipv6 endpoints for Kubernetes auto protocol",

// here to reuse a single install across tests.
func TestMain(m *testing.M) {
	// nolint: staticcheck
	framework.
		NewSuite(m).
		RequireMinVersion(24).
		Label(label.IPv4). // https://github.com/istio/istio/issues/41008
		Setup(func(t resource.Context) error {
			t.Settings().Ambient = true
			return nil
		}).
		Setup(istio.Setup(&i, func(ctx resource.Context, cfg *istio.Config) {

  // Defines which IP family to use for single stack or the order of IP families for dual-stack.
  // Valid list items are "IPv4", "IPv6".
  // More info: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
  repeated string ipFamilies = 29;

  // Controls whether Services are configured to use IPv4, IPv6, or both. Valid options
  // are PreferDualStack, RequireDualStack, and SingleStack.

    {{ end }}
  }
spec:
  securityContext:
  {{- if .Values.gateways.securityContext }}
    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
  {{- else }}
    sysctls:
    - name: net.ipv4.ip_unprivileged_port_start
      value: "0"
  {{- end }}
  containers:
  - name: istio-proxy
  {{- if contains "/" .Values.global.proxy.image }}

    {{ end }}
  }
spec:
  securityContext:
  {{- if .Values.gateways.securityContext }}
    {{- toYaml .Values.gateways.securityContext | nindent 4 }}
  {{- else }}
    sysctls:
    - name: net.ipv4.ip_unprivileged_port_start
      value: "0"
  {{- end }}
  containers:
  - name: istio-proxy
  {{- if contains "/" .Values.global.proxy.image }}

	passThroughBindIPs []string              // Passthrough IPs to be used while building clusters.
	supportsIPv4       bool                  // Whether Proxy IPs has IPv4 address.
	supportsIPv6       bool                  // Whether Proxy IPs has IPv6 address.
	sendHbone          bool                  // Does the proxy support HBONE