iptables -t mangle -N ISTIO_PRERT
iptables -t nat -N ISTIO_OUTPUT
iptables -t mangle -N ISTIO_OUTPUT
iptables -t mangle -A PREROUTING -j ISTIO_PRERT
iptables -t mangle -A OUTPUT -j ISTIO_OUTPUT
iptables -t nat -A OUTPUT -j ISTIO_OUTPUT
iptables -t mangle -A ISTIO_PRERT -m mark --mark 0x539/0xfff -j CONNMARK --set-xmark 0x111/0xfff
iptables -t mangle -A ISTIO_PRERT -s e9ac:1e77:90ca:399f:4d6d:ece2:2f9b:3164 -p tcp -m tcp -j ACCEPT

	assert.Equal(t, len(fds), 0)

	sent := m.Payload.(*zdsapi.WorkloadRequest_SnapshotSent).SnapshotSent
	if sent == nil {
		panic("expected snapshot sent")
	}
	sendAck(ztunClient)
	ztunClient.Close()
	// this will retry for a bit, so shouldn't flake
	mt.Assert(ztunnelConnected.Name(), nil, monitortest.Exactly(0))
}

func TestZtunnelRemovePod(t *testing.T) {
	ztunnelKeepAliveCheckInterval = time.Second / 10
	mt := monitortest.New(t)

DOWNLOAD_COMMAND=""
function set_download_command () {
  # Try curl.
  if command -v curl > /dev/null; then
    if curl --version | grep Protocols  | grep https > /dev/null; then
      DOWNLOAD_COMMAND="curl -fLSs --retry 5 --retry-delay 1 --retry-connrefused"
      return
    fi
    echo curl does not support https, will try wget for downloading files.
  else
    echo curl is not installed, will try wget for downloading files.
  fi

function check_default_cluster_yaml() {
  if [[ -z "${DEFAULT_CLUSTER_YAML:-}" ]]; then
    echo 'DEFAULT_CLUSTER_YAML file must be specified. Exiting...'
    return 1
  fi
}

function setup_kind_cluster_retry() {
  retry setup_kind_cluster "$@"
}

# setup_kind_cluster creates new KinD cluster with given name, image and configuration
# 1. NAME: Name of the Kind cluster (optional)
# 2. IMAGE: Node image used by KinD (optional)

portion of the URL with this value. type: string type: object retries: description: Retry policy for HTTP requests. properties: attempts: description: Number of retries to be allowed for a given request. format: int32 type: integer perTryTimeout: description: Timeout per attempt for a given request, including the initial call and any retries. type: string retryOn: description: Specifies the conditions under which retry takes place. type: string retryRemoteLocalitie: description: Flag to specify whether...

	InpodMark            = 1337 // this needs to match the inpod config mark in ztunnel.
	InpodMask            = 0xfff
	InpodRestoreMask     = 0xffffffff
	ChainInpodOutput     = "ISTIO_OUTPUT"
	ChainInpodPrerouting = "ISTIO_PRERT"
	ChainHostPostrouting = "ISTIO_POSTRT"
	RouteTableInbound    = 100

	DNSCapturePort              = 15053
	ZtunnelInboundPort          = 15008
	ZtunnelOutboundPort         = 15001
	ZtunnelInboundPlaintextPort = 15006

	scheme *runtime.Scheme

	tokenWaitBackoff = time.Second
)

func init() {
	scheme = runtime.NewScheme()
	utilruntime.Must(v1.AddToScheme(scheme))
	opt := json.SerializerOptions{
		Yaml:   true,
		Pretty: false,
		Strict: false,
	}
	yamlSerializer := json.NewSerializerWithOptions(json.DefaultMetaFactory, scheme, scheme, opt)
	codec = versioning.NewDefaultingCodecForScheme(
		scheme,
		yamlSerializer,
		yamlSerializer,

                      "timeout": "0s",
                      "retry_policy": {
                        "retry_on": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",
                        "num_retries": 2,
                        "retry_host_predicate": [
                          {
                            "name": "envoy.retry_host_predicates.previous_hosts"
                          }

                      "timeout": "0s",
                      "retry_policy": {
                        "retry_on": "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes",
                        "num_retries": 2,
                        "retry_host_predicate": [
                          {
                            "name": "envoy.retry_host_predicates.previous_hosts"
                          }

      # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
      # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
      repairPods: true

      initContainerName: "istio-validation"