{{runAsUser}}
            {{runAsGroup}}
            {{supplementalGroups}}
            "seccompProfile": {
                "type": "RuntimeDefault"
            }
        },
        "hostNetwork": true,
        "containers": [
            {
                "name": "cluster-autoscaler",
                "image": "registry.k8s.io/autoscaling/cluster-autoscaler:v1.26.1",
                "livenessProbe": {

apiVersion: v1
kind: Pod
metadata:
  name: kube-proxy
  namespace: kube-system
  labels:
    tier: node
    component: kube-proxy
spec:
  priorityClassName: system-node-critical
  priority: 2000001000
  hostNetwork: true
  tolerations:
  - operator: "Exists"
    effect: "NoExecute"
  - operator: "Exists"
    effect: "NoSchedule"
  containers:
  - name: kube-proxy

	if in.SecurityContext != nil {
		// the host namespace fields have to be handled here for backward compatibility
		// with v1.0.0
		out.HostPID = in.SecurityContext.HostPID
		out.HostNetwork = in.SecurityContext.HostNetwork
		out.HostIPC = in.SecurityContext.HostIPC
		out.ShareProcessNamespace = in.SecurityContext.ShareProcessNamespace
		out.HostUsers = in.SecurityContext.HostUsers
	}

	return nil
}

	// If this option is set, the ports that will be used must be specified.
	// Default to false.
	// +k8s:conversion-gen=false
	// +optional
	HostNetwork bool `json:"hostNetwork,omitempty" protobuf:"varint,11,opt,name=hostNetwork"`
	// Use the host's pid namespace.
	// Optional: Default to false.
	// +k8s:conversion-gen=false
	// +optional

},
"spec":{
"securityContext": {
  {{runAsUser}}
  {{runAsGroup}}
  {{supplementalGroups}}
  "seccompProfile": {
      "type": "RuntimeDefault"
  }
},
"priorityClassName": "system-node-critical",
"hostNetwork": true,
"containers":[
    {
    "name": "cloud-controller-manager",
    "image": "gcr.io/k8s-staging-cloud-provider-gcp/cloud-controller-manager:v30.0.0",
    "resources": {
      "requests": {

the kernel netfilter subsystem.

## General theory of netfilter

Packet flow through netfilter looks something like:

```text
             +================+      +=====================+
             | hostNetwork IP |      | hostNetwork process |
             +================+      +=====================+
                         ^                |
  -  -  -  -  -  -  -  - | -  -  -  -  - [*] -  -  -  -  -  -  -  -  -

		tracker := &basicPodStartupLatencyTracker{
			pods:  map[types.UID]*perPodState{},
			clock: fakeClock,
		}

		// hostNetwork pods should not be tracked
		hostNetworkPodInitializing := buildInitializingPod()
		hostNetworkPodInitializing.UID = "11111-22222"
		hostNetworkPodInitializing.Spec.HostNetwork = true
		tracker.ObservedPodOnWatch(hostNetworkPodInitializing, frozenTime)

		hostNetworkPodStarted := buildRunningPod()

  "namespace": "kube-system"
},
"spec":{
"securityContext": {
    "seccompProfile": {
        "type": "RuntimeDefault"
    }
},
"priorityClassName": "system-node-critical",
"priority": 2000001000,
"hostNetwork": true,
"containers":[
    {
    "name": "etcd-container",
    {{security_context}}
    "image": "{{ pillar.get('etcd_docker_repository', 'registry.k8s.io/etcd') }}:{{ pillar.get('etcd_docker_tag', '3.5.14-0') }}",

		},
	}

	for name, tc := range testCases {
		t.Run(name, func(t *testing.T) {
			fhu := hostutil.NewFakeHostUtil(nil)
			fsp := &subpath.FakeSubpath{}
			pod := v1.Pod{
				Spec: v1.PodSpec{
					HostNetwork: true,
				},
			}

			mounts, _, err := makeMounts(&pod, "/pod", &tc.container, "fakepodname", "", []string{""}, tc.podVolumes, fhu, fsp, nil, tc.supportsRRO)

			// validate only the error if we expect an error

      annotations:
        prometheus.io/port: "9253"
        prometheus.io/scrape: "true"
    spec:
      priorityClassName: system-node-critical
      serviceAccountName: node-local-dns
      hostNetwork: true
      dnsPolicy: Default  # Don't use cluster DNS.
      tolerations:
      - key: "CriticalAddonsOnly"
        operator: "Exists"
      - effect: "NoExecute"
        operator: "Exists"