{"net.inet.ip.encdebug", []_C_int{4, 2, 0, 12}},
	{"net.inet.ip.forwarding", []_C_int{4, 2, 0, 1}},
	{"net.inet.ip.ifq.congestion", []_C_int{4, 2, 0, 30, 4}},
	{"net.inet.ip.ifq.drops", []_C_int{4, 2, 0, 30, 3}},
	{"net.inet.ip.ifq.len", []_C_int{4, 2, 0, 30, 1}},
	{"net.inet.ip.ifq.maxlen", []_C_int{4, 2, 0, 30, 2}},
	{"net.inet.ip.maxqueue", []_C_int{4, 2, 0, 11}},

	{"net.inet.ip.encdebug", []_C_int{4, 2, 0, 12}},
	{"net.inet.ip.forwarding", []_C_int{4, 2, 0, 1}},
	{"net.inet.ip.ifq.congestion", []_C_int{4, 2, 0, 30, 4}},
	{"net.inet.ip.ifq.drops", []_C_int{4, 2, 0, 30, 3}},
	{"net.inet.ip.ifq.len", []_C_int{4, 2, 0, 30, 1}},
	{"net.inet.ip.ifq.maxlen", []_C_int{4, 2, 0, 30, 2}},
	{"net.inet.ip.maxqueue", []_C_int{4, 2, 0, 11}},

  // those as well.
  int num_args = cloned_branches[0].getNumArguments();
  llvm::BitVector used_args(num_args);
  for (func::FuncOp func : branches) {
    for (BlockArgument arg : func.getArguments()) {
      if (!arg.use_empty()) used_args.set(arg.getArgNumber());
    }
  }

  // There are some unused args that we can drop. Also drop the corresponding
  // input operand.

	if err != nil {
		t.Errorf("unexpected error creating rule: %v", err)
	} else if existed {
		t.Errorf("wrong return value from EnsureRule with non-existent rule")
	}
	existed, err = fake.EnsureRule(iptables.Append, iptables.TableNAT, iptables.Chain("KUBE-TEST"), "-j", "DROP")
	if err != nil {
		t.Errorf("unexpected error creating rule: %v", err)

	add element ip testing no-endpoint-nodeports { tcp . 3001 comment "ns2/svc2:p80" : drop }
	add element ip testing no-endpoint-services { 1.2.3.4 . tcp . 80 comment "ns2/svc2:p80" : drop }
	add element ip testing no-endpoint-services { 192.168.99.22 . tcp . 80 comment "ns2/svc2:p80" : drop }
	`)

var testExpected = dedent.Dedent(`
	add table ip testing { comment "rules for kube-proxy" ; }

				:KUBE-FORWARD - [0:0]
				:KUBE-NODEPORTS - [0:0]
				-A KUBE-NODEPORTS -m comment --comment "ns2/svc2:p80 health check node port" -m tcp -p tcp --dport 30000 -j ACCEPT
				-A KUBE-FORWARD -m conntrack --ctstate INVALID -j DROP
				-A KUBE-FORWARD -m comment --comment "kubernetes forwarding rules" -m mark --mark 0x4000/0x4000 -j ACCEPT

            memory: 1Gi
          requests:
            cpu: 100m
            memory: 128Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
          runAsGroup: 1337
          runAsNonRoot: true
          runAsUser: 1337
        startupProbe:

			name:             "Ratcheting, For creation, FG disabled, no OptionalOldSelf, no field drop",
			enableRatcheting: false,
			crd:              &apiextensions.CustomResourceDefinition{},
			oldCRD:           nil,
			expectedCRD:      &apiextensions.CustomResourceDefinition{},
		},
		{
			name:             "Ratcheting, For creation, FG disabled, set OptionalOldSelf, drop OptionalOldSelf",
			enableRatcheting: false,

	gp.m.newSigstack = true

	minitSignalMask()
}

// Called from dropm to undo the effect of an minit.
//
//go:nosplit
func unminit() {
	unminitSignals()
	// Don't clear procid, it is used by locking (semawake), and locking
	// must continue working after unminit.
}

// Called from exitm, but not from drop, to undo the effect of thread-owned

      - role: endpoints
      relabel_configs:
      - action: keep
        regex: true
        source_labels:
        - __meta_kubernetes_service_annotation_prometheus_io_scrape
      - action: drop
        regex: true
        source_labels:
        - __meta_kubernetes_service_annotation_prometheus_io_scrape_slow
      - action: replace
        regex: (https?)
        source_labels: