)

// IPSetVersioner can query the current ipset version.
type IPSetVersioner interface {
	// returns "X.Y"
	GetVersion() (string, error)
}

// IPSet wraps util/ipset which is used by IPVS proxier.
type IPSet struct {
	utilipset.IPSet
	// activeEntries is the current active entries of the ipset.
	activeEntries sets.Set[string]
	// handle is the util ipset interface handle.
	handle utilipset.Interface
}

				"/.well-known/openid-configuration",
				"/.well-known/openid-configuration/",
				"/openid/v1/jwks",
				"/openid/v1/jwks/",
			).RuleOrDie(),
		},
	})

	// node-proxier role is used by kube-proxy.
	nodeProxierRules := []rbacv1.PolicyRule{
		rbacv1helpers.NewRule("list", "watch").Groups(legacyGroup).Resources("services", "endpoints").RuleOrDie(),

	"k8s.io/apimachinery/pkg/util/sets"
	"k8s.io/utils/ptr"
)

func (proxier *FakeProxier) addEndpointSlice(slice *discovery.EndpointSlice) {
	proxier.endpointsChanges.EndpointSliceUpdate(slice, false)
}

func (proxier *FakeProxier) updateEndpointSlice(oldSlice, slice *discovery.EndpointSlice) {
	proxier.endpointsChanges.EndpointSliceUpdate(slice, false)
}

func (proxier *FakeProxier) deleteEndpointSlice(slice *discovery.EndpointSlice) {

	}
	return s.directDialerCalled, nil
}

type fakeProxyServerConnector struct {
	connectorErr bool
	proxierErr   bool
}

func (f *fakeProxyServerConnector) connect(context.Context) (proxier, error) {
	if f.connectorErr {
		return nil, fmt.Errorf("fake error")
	}
	return &fakeProxier{err: f.proxierErr}, nil
}

type fakeProxier struct {
	err bool
}

		Port:           port,
		Protocol:       protocol,
	}
}

func makeServiceMap(proxier *Proxier, allServices ...*v1.Service) {
	for i := range allServices {
		proxier.OnServiceAdd(allServices[i])
	}

	proxier.mu.Lock()
	defer proxier.mu.Unlock()
	proxier.servicesSynced = true
}

type endpointExpectation struct {
	endpoint string
	isLocal  bool
}

	NodeBootstrapTokenAuthGroup = "system:bootstrappers:kubeadm:default-node-token"
	// KubeProxyClusterRoleName sets the name for the kube-proxy ClusterRole
	KubeProxyClusterRoleName = "system:node-proxier"
	// NodeBootstrapperClusterRoleName defines the name of the auto-bootstrapped ClusterRole for letting someone post a CSR
	NodeBootstrapperClusterRoleName = "system:node-bootstrapper"

	// in an immediate IPVS resync.
	MinSyncPeriod metav1.Duration
	// scheduler is the IPVS scheduler to use
	Scheduler string
	// excludeCIDRs is a list of CIDRs which the ipvs proxier should not touch
	// when cleaning up ipvs services.
	ExcludeCIDRs []string
	// strictARP configures arp_ignore and arp_announce to avoid answering ARP queries
	// from kube-ipvs0 interface
	StrictARP bool

      time_format %m%d %H:%M:%S.%N
      path /var/log/kubelet.log
      pos_file /var/log/gcp-kubelet.log.pos
      tag kubelet
    </source>

    # Example:
    # I1118 21:26:53.975789       6 proxier.go:1096] Port "nodePort for kube-system/default-http-backend:http" (:31429/tcp) was open before and is still needed
    <source>
      @type tail
      format multiline
      multiline_flush_interval 5s

      time_format %m%d %H:%M:%S.%N
      path /var/log/kubelet.log
      pos_file /var/log/gcp-kubelet.log.pos
      tag kubelet
    </source>

    # Example:
    # I1118 21:26:53.975789       6 proxier.go:1096] Port "nodePort for kube-system/default-http-backend:http" (:31429/tcp) was open before and is still needed
    <source>
      @type tail
      format multiline
      multiline_flush_interval 5s

  metadata:
    annotations:
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:node-proxier
  rules:
  - apiGroups:
    - ""
    resources:
    - endpoints
    - services
    verbs:
    - list
    - watch
  - apiGroups:
    - ""
    resources:
    - nodes