delete(runtimeFlags, k)
			continue
		}
		// Envoy used to allow everything as string but stopped in https://github.com/envoyproxy/envoy/issues/27434
		// However, our API always takes in strings.
		// Convert strings to bools for backwards compat.
		switch v {
		case "false":
			runtimeFlags[k] = false
		case "true":
			runtimeFlags[k] = true
		default:
			runtimeFlags[k] = v

	runtimeapi "k8s.io/cri-api/pkg/apis/runtime/v1"
	"k8s.io/kubernetes/pkg/features"
	containertest "k8s.io/kubernetes/pkg/kubelet/container/testing"
	"k8s.io/kubernetes/pkg/kubelet/runtimeclass"
	rctest "k8s.io/kubernetes/pkg/kubelet/runtimeclass/testing"
	"k8s.io/utils/pointer"
)

const testPodLogsDirectory = "/var/log/pods"

func TestGeneratePodSandboxConfig(t *testing.T) {
	_, _, m, err := createTestRuntimeManager()

      {{- end }}
    },
    "metadata": {{ .meta_json_str }}
  },
  "layered_runtime": {
      "layers": [
          {
            "name": "global config",
            "static_layer": {{ .runtime_flags }}
          },
          {
              "name": "admin",
              "admin_layer": {}
          }
      ]
  },
  "bootstrap_extensions": [
    {{- if .metadata_discovery }}
    {

	if handlerSupportsUserns, err := m.kl.HandlerSupportsUserNamespaces(runtimeHandler); err != nil {
		return nil, err
	} else if !handlerSupportsUserns {
		return nil, fmt.Errorf("RuntimeClass handler %q does not support user namespaces", runtimeHandler)
	}

	m.lock.Lock()
	defer m.lock.Unlock()

	content, err := m.readMappingsFromFile(pod.UID)
	if err != nil && err != utilstore.ErrKeyNotFound {

  ADMISSION_CONTROL='NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,Priority,StorageObjectInUseProtection,PersistentVolumeClaimResize,RuntimeClass'
  # ResourceQuota must come last, or a creation is recorded, but the pod may be forbidden.
  ADMISSION_CONTROL="${ADMISSION_CONTROL},MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota"
else