expected:  true,
		},
		{
			name:      "a not critical pod with higher priority preempts a critical pod",
			preemptor: getTestPod(configSourceAnnotation(ApiserverSource), &systemPriorityUpper, ""),
			preemptee: getTestPod(configSourceAnnotation(FileSource), &systemPriority, ""),
			expected:  true,
		},
		{
			name:      "a critical pod with less priority do not preempts a critical pod",

            extensions =
              listOf(
                Extension(
                  id = keyUsage,
                  critical = true,
                  value = "03020106".decodeHex(),
                ),
                Extension(
                  id = BASIC_CONSTRAINTS,
                  critical = true,
                  value =
                    BasicConstraints(
                      ca = true,

			expectedDidOverrideInhibitDelay:  false,
			expectedPodToGracePeriodOverride: map[string]int64{"normal-pod-nil-grace-period": 20, "critical-pod-nil-grace-period": 10, "normal-pod-grace-period": 2, "critical-pod-grace-period": 2},
		},
		{
			desc:                             "no override (total=30s, critical=10s) pod with long terminationGracePeriod is overridden",

	kubetypes "k8s.io/kubernetes/pkg/kubelet/types"
)

const message = "Preempted in order to admit critical pod"

// CriticalPodAdmissionHandler is an AdmissionFailureHandler that handles admission failure for Critical Pods.
// If the ONLY admission failures are due to insufficient resources, then CriticalPodAdmissionHandler evicts pods
// so that the critical pod can be admitted.  For evictions, the CriticalPodAdmissionHandler evicts a set of pods that

template: metadata: labels: k8s-app: istio-cni-node sidecar.istio.io/inject: "false" annotations: # This, along with the CriticalAddonsOnly toleration below, # marks the pod as a critical add-on, ensuring it gets # priority scheduling and that its resources are reserved # if it ever gets evicted. scheduler.alpha.kubernetes.io/critical-pod: '' sidecar.istio.io/inject: "false" # Add Prometheus Scrape annotations prometheus.io/scrape: 'true' prometheus.io/port: "15014" prometheus.io/path: '/metrics' # Custom...

				}
			default:
				// Unknown extensions are recorded if critical.
				unhandled = true
			}
		} else if e.Id.Equal(oidExtensionAuthorityInfoAccess) {
			// RFC 5280 4.2.2.1: Authority Information Access
			if e.Critical {
				// Conforming CAs MUST mark this extension as non-critical
				return errors.New("x509: authority info access incorrectly marked critical")
			}
			val := cryptobyte.String(e.Value)

	"k8s.io/client-go/tools/record"
	kubeapi "k8s.io/kubernetes/pkg/apis/core"
	"k8s.io/kubernetes/pkg/apis/scheduling"
)

const (
	clusterCritical       = "cluster-critical"
	nodeCritical          = "node-critical"
	bestEffort            = "bestEffort"
	burstable             = "burstable"
	highRequestBurstable  = "high-request-burstable"
	guaranteed            = "guaranteed"

	{"tighten tuple selectors", "schedule"},
	// remove critical edges before phi tighten, so that phi args get better placement
	{"critical", "phi tighten"},
	// don't layout blocks until critical edges have been removed
	{"critical", "layout"},
	// regalloc requires the removal of all critical edges
	{"critical", "regalloc"},
	// regalloc requires all the values in a block to be scheduled

      extensionValue,
      decompose = {
        listOf(
          it.id,
          it.critical,
          it.value,
        )
      },
      construct = {
        Extension(
          id = it[0] as String,
          critical = it[1] as Boolean,
          value = it[2],
        )
      },
    )

  /**
   * ```

# this pod fixture is used for benchmarks and should be kept updated to pass the latest restricted policy
apiVersion: v1
kind: Pod
metadata:
  annotations:
    scheduler.alpha.kubernetes.io/critical-pod: ""
    seccomp.security.alpha.kubernetes.io/pod: runtime/default
  creationTimestamp: "2021-08-20T14:35:04Z"
  generateName: kube-dns-76dbc85bd5-
  labels:
    k8s-app: kube-dns
    pod-template-hash: 76dbc85bd5
  managedFields:
  - apiVersion: v1