)
    assert response.status_code == 403, response.text
    assert response.json() == {"detail": "You can only update the item: plumbus"}


@needs_py39
def test_admin(client: TestClient):
    response = client.post(
        "/admin/?token=jessica", headers={"X-Token": "fake-super-secret-token"}
    )
    assert response.status_code == 200, response.text

    )
    assert response.status_code == 403, response.text
    assert response.json() == {"detail": "You can only update the item: plumbus"}


def test_admin(client: TestClient):
    response = client.post(
        "/admin/?token=jessica", headers={"X-Token": "fake-super-secret-token"}
    )
    assert response.status_code == 200, response.text

    )
    assert response.status_code == 403, response.text
    assert response.json() == {"detail": "You can only update the item: plumbus"}


def test_admin(client: TestClient):
    response = client.post(
        "/admin/?token=jessica", headers={"X-Token": "fake-super-secret-token"}
    )
    assert response.status_code == 200, response.text

            requests:
              cpu: 100m
              memory: 128Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              add:
              - NET_ADMIN
              - NET_RAW
              drop:
              - ALL
            privileged: false
            readOnlyRootFilesystem: false
            runAsGroup: 0
            runAsNonRoot: false

          requests:
            cpu: 100m
            memory: 128Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            add:
            - NET_ADMIN
            - NET_RAW
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: false
          runAsGroup: 0
          runAsNonRoot: false
          runAsUser: 0

			b.ResetTimer()
			b.RunParallel(func(pb *testing.PB) {
				for pb.Next() {
					wh.Admit(context.TODO(), attr, objectInterfaces)
				}
			})
		})
	}
}

// TestAdmit tests that MutatingWebhook#Admit works as expected
func TestAdmit(t *testing.T) {
	testServer := webhooktesting.NewTestServer(t)
	testServer.StartTLS()
	defer testServer.Close()
	serverURL, err := url.ParseRequestURI(testServer.URL)
	if err != nil {

      privileged: {{ .Values.global.proxy.privileged }}
      capabilities:
    {{- if not (or .Values.pilot.cni.enabled .Values.istio_cni.enabled) }}
        add:
        - NET_ADMIN
        - NET_RAW
    {{- end }}
        drop:
        - ALL
    {{- if not (or .Values.pilot.cni.enabled .Values.istio_cni.enabled) }}
      readOnlyRootFilesystem: false
      runAsGroup: 0

      privileged: {{ .Values.global.proxy.privileged }}
      capabilities:
    {{- if not (or .Values.pilot.cni.enabled .Values.istio_cni.enabled) }}
        add:
        - NET_ADMIN
        - NET_RAW
    {{- end }}
        drop:
        - ALL
    {{- if not (or .Values.pilot.cni.enabled .Values.istio_cni.enabled) }}
      readOnlyRootFilesystem: false
      runAsGroup: 0

- In ambient mode, the CNI plugin does not configure any networking, but is only responsible for synchronously pushing...

    certificatePinner.check("anotherexample.co.uk", listOf(certB1.certificate))
    certificatePinner.check("foo.anotherexample.co.uk", listOf(certB1.certificate))
  }

  @Test
  fun testBadPin() {
    assertFailsWith<IllegalArgumentException> {
      CertificatePinner.Pin(
        "example.co.uk",
        "sha256/a",
      )
    }
  }

  @Test
  fun testBadAlgorithm() {