switch cfg.Version {
	case "29":
		// V29 -> V30
		cfg.Compression.Enabled = false
		cfg.Compression.Extensions = strings.Split(compress.DefaultExtensions, config.ValueSeparator)
		cfg.Compression.MimeTypes = strings.Split(compress.DefaultMimeTypes, config.ValueSeparator)
	case "30":
		// V30 -> V31
		cfg.OpenID = openid.Config{}
		cfg.Policy.OPA = opa.Args{
			URL:       &xnet.URL{},

	tempDir := t.TempDir()

	cfg := &config.InstallConfig{
		MountedCNINetDir: tempDir,
		KubeCAFile:       kubeCAFilepath,
		K8sServiceHost:   k8sServiceHost,
		K8sServicePort:   k8sServicePort,
	}

	expectedKC, err := createKubeConfig(cfg)
	if err != nil {
		t.Fatalf("expected no error: %+v", err)
	}
	err = checkExistingKubeConfigFile(cfg, expectedKC)

	if err == nil {

type NetlinkDependencies interface {
	AddInpodMarkIPRule(cfg *Config) error
	DelInpodMarkIPRule(cfg *Config) error
	AddLoopbackRoutes(cfg *Config) error
	DelLoopbackRoutes(cfg *Config) error
}

func RealNlDeps() NetlinkDependencies {
	return &realDeps{}
}

type realDeps struct{}

func (r *realDeps) AddInpodMarkIPRule(cfg *Config) error {
	return AddInpodMarkIPRule(cfg)
}

			cfg.S3.AccessKey = creds.AccessKey
			cfg.S3.SecretKey = creds.SecretKey
		}
	case madmin.Azure:
		if creds.SecretKey != "" {
			cfg.Azure.AccountKey = creds.SecretKey
		}
		if creds.AzSP.TenantID != "" {
			cfg.Azure.SPAuth.TenantID = creds.AzSP.TenantID
		}
		if creds.AzSP.ClientID != "" {
			cfg.Azure.SPAuth.ClientID = creds.AzSP.ClientID
		}
		if creds.AzSP.ClientSecret != "" {

)

func AddInpodMarkIPRule(cfg *Config) error {
	err := forEachInpodMarkIPRule(cfg, netlink.RuleAdd)
	if errors.Is(err, unix.EEXIST) {
		log.Debugf("Ignoring exists error adding inpod mark ip rule: %v", err)
		return nil
	}
	return err
}

func DelInpodMarkIPRule(cfg *Config) error {
	return forEachInpodMarkIPRule(cfg, netlink.RuleDel)
}

func forEachInpodMarkIPRule(cfg *Config, f func(*netlink.Rule) error) error {

	pods         kclient.Client[*corev1.Pod]
	queue        controllers.Queue
	cfg          config.RepairConfig
	events       kclient.EventRecorder
	repairedPods map[types.NamespacedName]types.UID
}

func NewRepairController(client kube.Client, cfg config.RepairConfig) (*Controller, error) {
	c := &Controller{
		cfg:          cfg,
		client:       client,
		events:       kclient.NewEventRecorder(client, "cni-repair"),

	cfg := config.DefaultConfig()
	cfg.CNIMode = true
	cfg.NetworkNamespace = netns
	cfg.ProxyPort = rdrct.targetPort
	cfg.ProxyUID = rdrct.noRedirectUID
	cfg.ProxyGID = rdrct.noRedirectGID
	cfg.InboundInterceptionMode = rdrct.redirectMode
	cfg.OutboundIPRangesInclude = rdrct.includeIPCidrs
	cfg.InboundPortsExclude = rdrct.excludeInboundPorts
	cfg.InboundPortsInclude = rdrct.includeInboundPorts

	if err != nil {
		return cfg, err
	}
	if eduration < 0 {
		return cfg, config.ErrInvalidBatchExpirationWorkersWait(nil)
	}

	if rduration > 0 {
		cfg.ReplicationWorkersWait = rduration
	}

	if kduration > 0 {
		cfg.KeyRotationWorkersWait = kduration
	}

	if eduration > 0 {
		cfg.ExpirationWorkersWait = eduration
	}

	return cfg, nil

	if err != nil {
		return cfg, err
	}

	cfg.RequestsMax = requestsMax
	if requestsMax < 0 {
		return cfg, errors.New("invalid API max requests value")
	}

	requestsDeadline, err := time.ParseDuration(env.Get(EnvAPIRequestsDeadline, kvs.GetWithDefault(apiRequestsDeadline, DefaultKVS)))
	if err != nil {
		return cfg, err
	}
	cfg.RequestsDeadline = requestsDeadline

	t.replicationMaxWorkers = cfg.ReplicationMaxWorkers

	// N B api.transition_workers will be deprecated
	if globalTransitionState != nil {
		globalTransitionState.UpdateWorkers(cfg.TransitionWorkers)
	}
	t.transitionWorkers = cfg.TransitionWorkers

	t.staleUploadsExpiry = cfg.StaleUploadsExpiry
	t.staleUploadsCleanupInterval = cfg.StaleUploadsCleanupInterval
	t.deleteCleanupInterval = cfg.DeleteCleanupInterval