code: func (plugin *kubenetNetworkPlugin) ensureMasqRule() error {
  	if plugin.nonMasqueradeCIDR != "0.0.0.0/0" {
  		if _, err := plugin.iptables.EnsureRule(utiliptables.Append, utiliptables.TableNAT, utiliptables.ChainPostrouting,
  			"-m", "comment", "--comment", "kubenet: SNAT for outbound traffic from cluster",
  			"-m", "addrtype", "!", "--dst-type", "LOCAL",
  			"!", "-d", plugin.nonMasqueradeCIDR,
  			"-j", "MASQUERADE"); err != nil {
  			return fmt.Errorf("Failed to ensure that %s chain %s jumps to MASQUERADE: %v", utiliptables.TableNAT, utiliptables.ChainPostrouting, err)
  		}
  	}
  	return nil
  }
docs: // TODO: move thic logic into cni bridge plugin and remove this from kubenet