def mutate_toxiproxy(self, body, spec):
    """
      This plugs a toxiproxy in as a side-car
      It also uses an init container with iptables to reroute
    """
    # 1. Precompute the ports that need to be proxied
    # for every port specified in the containers' definitions
    containers_ports = []
    for container in body.spec.template.spec.containers:
      for port in container.ports:
        containers_ports.append(port.container_port)
    containers_mapping = dict()
    # add a mapping port, that starts at 10000
    counter = 10000
    for port in containers_ports:
      while counter in containers_ports or counter in containers_mapping.values():
        counter += 1
      containers_mapping[port] = counter

    # 2. Prepare proxies in the toxiproxy format
    proxies = spec.get("proxies", [])
    for ingress_port, proxy_port in containers_mapping.items():
      proxies.append(dict(
        name="auto%s" % ingress_port,
        listen="0.0.0.0:%s" % proxy_port,
        upstream="127.0.0.1:%s" % ingress_port,
        ingress_port=ingress_port,
      ))

    # 3. Prepare the Toxiproxy setup command through the startup probe
    toxiproxy_cli = spec.get("toxiproxyCli", "/go/bin/toxiproxy-cli")
    populate_cmd = "true"
    for proxy in proxies:
      populate_cmd += " && {cli} create {name} -l {listen} -u {upstream}".format(
        cli=toxiproxy_cli,
        **proxy
      )
    toxics = spec.get("toxics", [])
    for toxic in toxics:
      # if the user specifies directly port, assume they mean the autogenerated one
      name = toxic.get("targetProxy")
      try:
        parsed = int(name)
        name = "auto" + name
      except ValueError:
        pass
      populate_cmd += " && {cli} toxic add {name} -t {type} {attributes}".format(
        cli=toxiproxy_cli,
        name=name,
        type=toxic.get("toxicType"),
        attributes=" ".join([
          "-a {name}={value}".format(
            **attr
          ) for attr in toxic.get("toxicAttributes", [])
        ])
      )

    # add the toxiproxy side-car container
    body.spec.template.spec.containers.append(
      kubernetes.client.V1Container(
        name="chaos-toxiproxy",
        image=spec.get("imageToxiproxy", DEFAULT_TOXIPROXY_IMAGE),
        startup_probe=kubernetes.client.V1Probe(
          _exec=kubernetes.client.V1ExecAction(
            command=["/bin/sh", "-c", populate_cmd],
          )
        ),
      )
    )

    # precompute the iptables command
    def get_port(listen_string):
      parts = listen_string.split(":")
      if len(parts) == 2:
        return parts[-1]
      return "80"
    iptables_cmd = "iptables -t filter -A INPUT -s 127.0.0.1 -j ACCEPT"
    names = []
    for proxy in proxies:
      ingress_port = proxy.get("ingress_port")
      if ingress_port is not None:
        iptables_cmd += (
          ' && iptables -t nat -A PREROUTING -i eth0'
          ' -p tcp --dport {ingress_port}'
          ' -j REDIRECT --to-port {egress_port}'
          ' -m comment --comment "{comment}"'
        ).format(
          ingress_port=str(ingress_port),
          egress_port=get_port(proxy.get("listen")),
          comment=proxy.get("name")
        )
        names.append(
          "{src}->{dst}".format(
            src=ingress_port,
            dst=get_port(proxy.get("listen")),
          )
        )
    iptables_cmd += ' && echo "iptables rules setup successfully: {names}"'.format(
      names=", ".join(names)
    )

    # add an init container with the iptables config
    if body.spec.template.spec.init_containers is None:
      body.spec.template.spec.init_containers = []
    body.spec.template.spec.init_containers.append(
      kubernetes.client.V1Container(
        name="iptables-setup",
        command=["/bin/sh", "-c", iptables_cmd],
        args=[],
        image=spec.get("imageIptables", DEFAULT_IPTABLES_IMAGE),
        security_context=kubernetes.client.V1SecurityContext(
          run_as_user=spec.get("user"),
          capabilities=kubernetes.client.V1Capabilities(
            add=[
              "NET_ADMIN"
            ]
          )
        )
      )
    )

      This plugs a toxiproxy in as a side-car
      It also uses an init container with iptables to reroute
    
powerfulseal/policy/action_clone.py