var waypointAddress *workloadapi.GatewayAddress
	if w != nil {
		waypointAddress = a.getWaypointAddress(w)
	}

	// TODO this is only checking one controller - we may be missing service vips for instances in another cluster
	res := make([]*workloadapi.Service, 0, len(svc.Spec.Hosts))
	for _, h := range svc.Spec.Hosts {
		res = append(res, &workloadapi.Service{
			Name:            svc.Name,

}

type ZtunnelService struct {
	Name         string          `json:"name"`
	Namespace    string          `json:"namespace"`
	Hostname     string          `json:"hostname"`
	Addresses    []string        `json:"vips"`
	Ports        map[string]int  `json:"ports"`
	LoadBalancer *LoadBalancer   `json:"loadBalancer"`
	Waypoint     *GatewayAddress `json:"waypoint"`
}

type PolicyMatch struct {

      # This should fail if grep returns non-zero exit
      - name: Test binary
        run: |
          docker run --rm minio/fips-test:latest ./minio --version

// resources (with delta updates), or on-demand and only get responses for specifically subscribed resources.
//
// Incoming requests may be for VIP or Pod IP addresses. However, all responses are Workload resources, which are pod based.
// This means subscribing to a VIP may end up pushing many resources of different name than the request.

	-f Dockerfile.release.old_cpu .

docker buildx prune -f

docker buildx build --push --no-cache \
	--build-arg RELEASE="${release}" \
	-t "minio/minio:${release}.fips" \
	-t "quay.io/minio/minio:${release}.fips" \
	--platform=linux/amd64 -f Dockerfile.release.fips .

docker buildx prune -f

		AddAuth:      newCachedAuthToken(),
		AuthRequest:  storageServerRequestValidate,
		BlockConnect: globalGridStart,
		TLSConfig: &tls.Config{
			RootCAs:          globalRootCAs,
			CipherSuites:     fips.TLSCiphers(),
			CurvePreferences: fips.TLSCurveIDs(),
		},
		// Record incoming and outgoing bytes.
		Incoming: globalConnStats.incInternodeInputBytes,
		Outgoing: globalConnStats.incInternodeOutputBytes,
		TraceTo:  globalTrace,
	})

}

// defaultCipherSuitesFIPS are the FIPS-allowed cipher suites.
var defaultCipherSuitesFIPS = []uint16{
	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
	TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
	TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
	TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
	TLS_RSA_WITH_AES_128_GCM_SHA256,
	TLS_RSA_WITH_AES_256_GCM_SHA384,
}

// defaultCipherSuitesTLS13FIPS are the FIPS-allowed cipher suites for TLS 1.3.

	if v := unsafe.Sizeof(si); v != 128 {
		t.Fatalf("sizeof: got %d, want 128", v)
	}

	ofSigno := 0
	ofErrno := 4
	ofCode := 8
	if strings.HasPrefix(runtime.GOARCH, "mips") {
		// These two fields are swapped on MIPS platforms.
		ofErrno, ofCode = ofCode, ofErrno
	}
	ofPid := 12
	if host64bit {
		ofPid = 16
	}
	ofUid := ofPid + 4
	ofStatus := ofPid + 8

	offsets := []struct {
		name string

// Copyright 2023 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

//go:build linux && !(mips || mipsle || mips64 || mips64le)

package unix

type siErrnoCode struct {
	Errno int32
	Code  int32

// functions for hashing bytes to arbitrary-length output.
//
//
// SHAKE implementation is based on FIPS PUB 202 [1]
// cSHAKE implementations is based on NIST SP 800-185 [2]
//
// [1] https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf
// [2] https://doi.org/10.6028/NIST.SP.800-185

import (
	"encoding/binary"
	"hash"
	"io"
)