the group can be found at [Early Disclosure Membership].

## Security Bulletins

Information about previous Istio vulnerabilities can be found on the
[Security Bulletins] page.

[Support Announcements]: https://istio.io/news/support/
[Istio Security Vulnerabilities]: https://istio.io/about/security-vulnerabilities/
[Security Bulletins]: https://istio.io/news/security/

     *
     * Note that, if [CoreJarFileSystem] is not given, a fresh instance will be used, which will create fresh instances of [VirtualFile],
     *   resulting in potential hash mismatch (e.g., if used in scope membership check).
     *
     * By default, given [jar], the root, will be included. Pass [includeRoot = false] if not needed.

	client := exClient.Dynamic()
	gvr := schema.GroupVersionResource{
		Group:    "hub.gke.io",
		Version:  "v1",
		Resource: "memberships",
	}
	u, err := client.Resource(gvr).Get(ctx, "membership", metav1.GetOptions{})
	if err != nil {
		return nil, err
	}
	spec, ok := u.Object["spec"].(map[string]any)
	if !ok {
		return nil, errors.New(`field "spec" is not a map`)
	}

	}
	// update filter state
	d.discoveryNamespaces = newDiscoveryNamespaces
	d.discoverySelectors = selectors
}

// namespaceCreated: if newly created namespace is selected, update namespace membership
func (d *discoveryNamespacesFilter) namespaceCreatedLocked(ns metav1.ObjectMeta) (membershipChanged bool) {
	if d.isSelectedLocked(ns.Labels) {
		d.discoveryNamespaces.Insert(ns.Name)

        }

        then:
        !registry.realize(collectionPath, collectionType).isEmpty()
        registry.realize(collectionPath, collectionType).size() == 2
    }

    def "can query set membership"() {
        when:
        mutate {
            create { name = '1' }
            create { name = '2' }
        }

        then:
        def set = registry.realize(collectionPath, collectionType)

	if isMCP {
		// Special credentials handling when using ASM Managed Control Plane.
		mem, err := getHubMembership(ctx, kubeClient)
		if err != nil {
			return nil, fmt.Errorf("failed to query Hub membership: %w", err)
		}
		aud = []string{mem.WorkloadIdentityPool}
	}
	k8sCreds, err := kubeClient.CreatePerRPCCredentials(ctx, ns, serviceAccount, aud, defaultExpirationSeconds)
	if err != nil {

func (s1 Int) IsSuperset(s2 Int) bool {
	return cast(s1).IsSuperset(cast(s2))
}

// Equal returns true if and only if s1 is equal (as a set) to s2.
// Two sets are equal if their membership is identical.
// (In practice, this means same elements, order doesn't matter)
func (s1 Int) Equal(s2 Int) bool {
	return cast(s1).Equal(cast(s2))
}

// List returns the contents as a sorted int slice.

	// nameHeaders are the headers to check (in order, case-insensitively) for an identity. The first header with a value wins.
	nameHeaders StringSliceProvider

	// groupHeaders are the headers to check (case-insensitively) for group membership.  All values of all headers will be added.
	groupHeaders StringSliceProvider

	// extraHeaderPrefixes are the head prefixes to check (case-insensitively) for filling in

     */
    public static final int NTLMSSP_NEGOTIATE_ANONYMOUS = 0x00000800;

    /**
     * Indicates whether the OEM-formatted domain name in which the
     * client workstation has membership is supplied in the Type-1 message.
     * This is used in the negotation of local authentication.
     */
    public static final int NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED = 0x00001000;

    /**

func (s1 Int32) IsSuperset(s2 Int32) bool {
	return cast(s1).IsSuperset(cast(s2))
}

// Equal returns true if and only if s1 is equal (as a set) to s2.
// Two sets are equal if their membership is identical.
// (In practice, this means same elements, order doesn't matter)
func (s1 Int32) Equal(s2 Int32) bool {
	return cast(s1).Equal(cast(s2))
}

// List returns the contents as a sorted int32 slice.