# - documentation
area: traffic-management

# releaseNotes is a markdown listing of any user facing changes. This will appear in the
# release notes.
releaseNotes:
- |

// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package ipset

import (
	"errors"
	"net/netip"
)

func RealNlDeps() NetlinkIpsetDeps {
	return &realDeps{}
}

type realDeps struct{}

func (m *realDeps) ipsetIPHashCreate(name string, v6 bool) error {

// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package ipset

import (
	"net/netip"

	"github.com/stretchr/testify/mock"
)

type MockedIpsetDeps struct {
	mock.Mock
}

func FakeNLDeps() *MockedIpsetDeps {
	return &MockedIpsetDeps{}
}

		return embeddedFieldIdent(e.X)
	case *ast.IndexListExpr:
		return embeddedFieldIdent(e.X)
	}
	return nil // invalid embedded field
}

func (check *Checker) declareInSet(oset *objset, pos token.Pos, obj Object) bool {
	if alt := oset.insert(obj); alt != nil {
		err := check.newError(DuplicateDecl)
		err.addf(atPos(pos), "%s redeclared", obj.Name())
		err.addAltDecl(alt)
		err.report()
		return false
	}

		return e.Sel
	case *syntax.IndexExpr:
		return embeddedFieldIdent(e.X)
	}
	return nil // invalid embedded field
}

func (check *Checker) declareInSet(oset *objset, pos syntax.Pos, obj Object) bool {
	if alt := oset.insert(obj); alt != nil {
		err := check.newError(DuplicateDecl)
		err.addf(pos, "%s redeclared", obj.Name())
		err.addAltDecl(alt)
		err.report()
		return false
	}
	return true

            # capabilities we actually require
            capabilities:
              drop:
              - ALL
              add:
              # CAP_NET_ADMIN is required to allow ipset and route table access
              - NET_ADMIN
              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
              - NET_RAW