}

func validateIptablesClean(t *testing.T) {
	cur := iptablesSave(t)
	if strings.Contains(cur, "ISTIO") {
		t.Fatalf("Istio rules leftover: %v", cur)
	}
	if strings.Contains(cur, "-A") {
		t.Fatalf("Rules: %v", cur)
	}
}

var initialized = &sync.Once{}

func setup(t *testing.T) {
	initialized.Do(func() {
		// Setup group namespace so iptables --gid-owner will work

    visibility = ["//visibility:public"],
)

# DO NOT ADD ANY NEW EXCEPTIONS TO THIS LIST!
# Instead, please use public APIs or public build rules TF provides.
# If you need functionality that is not exposed, we will work with you to expand our public APIs.
# TODO(b/173549186): Move Google-internal TF code out of learning/brain
package_group(
    name = "internal",

# If you're looking at this file in a different repo and want to make a change, please go to the
# common-files repo, make the change there and check it in. Then come back to this repo and run
# "make update-common".

rules:
  braces: disable
  brackets: disable
  colons: enable
  commas: disable
  comments: disable
  comments-indentation: disable
  document-end: disable
  document-start: disable
  empty-lines: disable

}

// FSGroupStrategyOptions defines the strategy type and options used to create the strategy.
message FSGroupStrategyOptions {
  // rule is the strategy that will dictate what FSGroup is used in the SecurityContext.
  // +optional
  optional string rule = 1;

  // ranges are the allowed ranges of fs groups.  If you would like to force a single

<code>"hello, world"</code>.  (It might print the empty string,
crash, or do something else.)
</p>

<p class="rule">
The <i>k</i>th receive on a channel with capacity <i>C</i> is synchronized before the completion of the <i>k</i>+<i>C</i>th send from that channel completes.
</p>

<p>
This rule generalizes the previous rule to buffered channels.
It allows a counting semaphore to be modeled by a buffered channel:

public final class mockwebserver3/junit4/MockWebServerRule : org/junit/rules/ExternalResource {
	public static final field Companion Lmockwebserver3/junit4/MockWebServerRule$Companion;
	public fun <init> ()V
	public final fun getServer ()Lmockwebserver3/MockWebServer;
}

public final class mockwebserver3/junit4/MockWebServerRule$Companion {

        // UrlQueue<?> urlQueue = (UrlQueue<?>) objs[1];
        final ResponseData responseData = (ResponseData) objs[2];
        // Rule rule = (Rule) objs[3];
        if (logger.isDebugEnabled()) {
            logger.debug("No ResponseProcessor for ({}, {}). PLEASE CHECK YOUR CONFIGURATION.", responseData.getUrl(),
                    responseData.getMimeType());
        }
    }

        final int m = cal.get(Calendar.MINUTE);
        final int d = cal.get(Calendar.DAY_OF_WEEK); // SUN(1) - SAT(7)
        for (final IntervalRule rule : ruleList) {
            if (rule.isTarget(h, m, d)) {
                return rule.getDelay();
            }
        }
        return 0;
    }

    protected Calendar getCurrentCal() {
        final Calendar cal = Calendar.getInstance();

- and the other end is in ztunnel's pod

and setting up iptables rules to funnel traffic thru that socket "tube" to ztunnel and back.

This effectively behaves like ztunnel is an in-pod sidecar, without actually requiring the injection of ztunnel as a sidecar into the pod manifest, or mutatating the application pod in any way.

   * PackageSanityTests. (The test would run on the JVM, too, if not for the suppression below, and
   * that would be a problem because it violates small-test rules. Note that we strip the
   * suppression externally, but it's OK because we don't enforce test-size rules there.)
   *
   * We'd just use PackageSanityTests directly, saving us from needing this separate type, but we're