INSECURE_PORT_MAPPING=""
  if [[ "${ENABLE_APISERVER_INSECURE_PORT:-false}" == "true" ]]; then
    # INSECURE_PORT_MAPPING is used by sed
    # shellcheck disable=SC2089
    INSECURE_PORT_MAPPING='{ "name": "local", "containerPort": 8080, "hostPort": 8080},'
  fi
  # shellcheck disable=SC2090
  export INSECURE_PORT_MAPPING
}

# A helper function that bind mounts kubelet dirs for running mount in a chroot

    # this puts the cert into pki/ca.crt and the key into pki/private/ca.key
    # PRIMARY_CN (expected to be) defined by caller
    # shellcheck disable=SC2153
    ./easyrsa --batch "--req-cn=${PRIMARY_CN}@$(date +%s)" build-ca nopass
    # SANS (expected to be) defined by caller
    # shellcheck disable=SC2153
    ./easyrsa --subject-alt-name="${SANS}" build-server-full "${MASTER_NAME}" nopass
    ./easyrsa build-client-full kube-apiserver nopass

// (https://policies.google.com/privacy).
//
// To view the current telemetry mode, run "go telemetry".
// To disable telemetry uploading, but keep local data collection, run
// "go telemetry local".
// To enable both collection and uploading, run “go telemetry on”.
// To disable both collection and uploading, run "go telemetry off".
//
// See https://go.dev/doc/telemetry for more information on telemetry.
//

	// But that would mean that if an analysis causes problems like
	// unexpected crashes there would be no way to turn it off.
	// It seems better to let the flags disable export analysis too.
	fmt.Fprintf(h, "vetflags %q\n", vetFlags)

	fmt.Fprintf(h, "pkg %q\n", a.Deps[0].actionID)
	for _, a1 := range a.Deps {
		if a1.Mode == "vet" && a1.built != "" {

	// the number of allowed pods per core
	podsPerCore int

	// enableControllerAttachDetach indicates the Attach/Detach controller
	// should manage attachment/detachment of volumes scheduled to this node,
	// and disable kubelet from executing any attach/detach operations
	enableControllerAttachDetach bool

	// trigger deleting containers in a pod
	containerDeletor *podContainerDeletor

	// config iptables util rules

	g.Expect(getTLSContext(t, clusters[0])).To(BeNil())
	g.Expect(clusters[0].TransportSocketMatches).To(HaveLen(2))

	// For 9090, use the TLS settings are explicitly specified in DR (which disable TLS)
	g.Expect(getTLSContext(t, clusters[1])).To(BeNil())

	// Sanity check: make sure TLS is not accidentally added to other clusters.
	for i := 2; i < len(clusters); i++ {
		cluster := clusters[i]

	// object layer not initialized we return with no decision.
	if newObjectLayerFn() == nil {
		return
	}

	// Disable server-side replication on object prefixes which are excluded
	// from versioning via the MinIO bucket versioning extension.
	if !globalBucketVersioningSys.PrefixEnabled(bucket, object) {
		return
	}

	sseConfig, _ := globalBucketSSEConfigSys.Get(bucket)
	sseConfig.Apply(r.Header, sse.ApplyOptions{
		AutoEncrypt: globalAutoEncryption,
	})

	var buf *bytebufferpool.ByteBuffer
	// Disable cache for encrypted objects - headers are applied with sseConfig.Apply if auto encrypted.
	if globalCacheConfig.MatchesSize(size) && !crypto.Requested(r.Header) {
		buf = bytebufferpool.Get()
		defer bytebufferpool.Put(buf)

	}
	expectedKey, _ = controller.KeyFunc(job2)
	if got, want := key, expectedKey; got != want {
		t.Errorf("queue.Get() = %v, want %v", got, want)
	}
}

func TestDeletePodOrphan(t *testing.T) {
	// Disable batching of pod updates to show it does not get requeued at all
	t.Cleanup(setDurationDuringTest(&syncJobBatchPeriod, 0))
	logger, ctx := ktesting.NewTestContext(t)