-t table -N chain
-t table -A chain -f foo -b bar
-t table -I chain 2 -f foo -b bar
-t table -A chain -f foo -b baz

apiVersion: release-notes/v2
kind: bug-fix
area: networking
issue: []
releaseNotes:
- |

	// Flush and delete the istio chains from NAT table.
	chains := []string{constants.ISTIOOUTPUT, constants.ISTIOINBOUND}
	flushAndDeleteChains(ext, iptV, constants.NAT, chains)
	// Flush and delete the istio chains from MANGLE table.
	chains = []string{constants.ISTIOINBOUND, constants.ISTIODIVERT, constants.ISTIOTPROXY}
	flushAndDeleteChains(ext, iptV, constants.MANGLE, chains)

	if cfg.InboundInterceptionMode == constants.TPROXY {

	chain, topErr := verifyChain(c, topCtx, opts)
	if topErr == nil {
		chains = append(chains, chain)
	}

	if lqCtxCount := topCtx.LowerQualityChainCount; lqCtxCount > 0 {
		lqCtxs := unsafe.Slice(topCtx.LowerQualityChains, lqCtxCount)
		for _, ctx := range lqCtxs {
			chain, err := verifyChain(c, ctx, opts)
			if err == nil {
				chains = append(chains, chain)
			}
		}
	}

    public void addChain(final AuthenticationChain chain) {
        chains = ArrayUtils.addAll(chains, chain);
    }

    protected StreamOf<AuthenticationChain> chains() {
        return stream(chains);
    }

		return nil, fmt.Errorf("unsupported auth type: %q", authType)
	}

	tlsInfo := peer.AuthInfo.(credentials.TLSInfo)
	chains := tlsInfo.State.VerifiedChains
	if len(chains) == 0 || len(chains[0]) == 0 {
		return nil, fmt.Errorf("no verified chain is found")
	}

	ids, err := util.ExtractIDs(chains[0][0].Extensions)
	if err != nil {
		return nil, err
	}

	return &security.Caller{

	expected := sets.New(
		ChainPrerouting,
		Chain("INPUT"),
		Chain("OUTPUT"),
		ChainPostrouting,
		Chain("DOCKER"),
		Chain("KUBE-NODEPORT-CONTAINER"),
		Chain("KUBE-NODEPORT-HOST"),
		Chain("KUBE-PORTALS-CONTAINER"),
		Chain("KUBE-PORTALS-HOST"),
		Chain("KUBE-SVC-1111111111111111"),
		Chain("KUBE-SVC-2222222222222222"),
		Chain("KUBE-SVC-3333333333333333"),
		Chain("KUBE-SVC-4444444444444444"),

	// now, and record the time that they become stale in staleChains so they can be
	// deleted later.
	existingChains, err := proxier.nftables.List(context.TODO(), "chains")
	if err == nil {
		for _, chain := range existingChains {
			if isServiceChainName(chain) {
				if !activeChains.Has(chain) {
					tx.Flush(&knftables.Chain{
						Name: chain,
					})

}

func (dump *IPTablesDump) GetChain(table iptables.Table, chain iptables.Chain) (*Chain, error) {
	t, err := dump.GetTable(table)
	if err != nil {
		return nil, err
	}
	for i := range t.Chains {
		if t.Chains[i].Name == chain {
			return &t.Chains[i], nil
		}
	}
	return nil, fmt.Errorf("no such chain %q", chain)
}

* table
-N chain
-A chain -f foo -b bar
-I chain 2 -f foo -b bar
-I chain 1 -f foo -b bar