for _, b := range accInfo.Buckets {
		gotBuckets.Add(b.Name)
		if !b.Access.Read || !b.Access.Write {
			c.Fatalf("root user should have read and write access to bucket: %v", b.Name)
		}
	}
	shouldHaveBuckets := set.CreateStringSet(bucket2, bucket)
	if !gotBuckets.Equals(shouldHaveBuckets) {
		c.Fatalf("root user should have access to all buckets")
	}

	// This must fail.

        // Determine lease level based on access requirements
        // Check for delete access separately as it may require special handling
        final boolean hasDeleteAccess = (access & DELETE) != 0;
        final boolean hasWriteAccess =
                (access & (GENERIC_WRITE | FILE_WRITE_DATA | FILE_APPEND_DATA | FILE_WRITE_ATTRIBUTES | FILE_WRITE_EA)) != 0;

            send(new SmbComOpenAndX(unc, access, flags, null), response);
            f = response.fid;
        }

        return f;
    }

    void open(final int flags, final int access, final int attrs, final int options) throws SmbException {
        if (isOpen()) {
            return;
        }
        fid = open0(flags, access, attrs, options);
        opened = true;

- **Auth**
  - [alpha] Further polishing of the Role-based access control alpha API including a default set of cluster roles. ([docs](http://kubernetes.io/docs/admin/authorization/)) ([kubernetes/features#2](https://github.com/kubernetes/enhancements/issues/2))

     */
    @GuardedBy("this")
    final Queue<ReferenceEntry<K, V>> writeQueue;

    /**
     * A queue of elements currently in the map, ordered by access time. Elements are added to the
     * tail of the queue on access (note that writes count as accesses).
     */
    @GuardedBy("this")
    final Queue<ReferenceEntry<K, V>> accessQueue;

    /** Accumulates cache statistics. */

  private void checkLogged(Throwable t) {
    assertThat(popLoggedThrowable()).isSameInstanceAs(t);
  }

  /*
   * TODO(cpovirk): Can we replace makeLocalCache with a call to builder.build()? Some tests may
   * need access to LocalCache APIs, but maybe we can at least make makeLocalCache use
   * builder.build() and then cast?
   */

  private static <K, V> LocalCache<K, V> makeLocalCache(

  private void checkLogged(Throwable t) {
    assertThat(popLoggedThrowable()).isSameInstanceAs(t);
  }

  /*
   * TODO(cpovirk): Can we replace makeLocalCache with a call to builder.build()? Some tests may
   * need access to LocalCache APIs, but maybe we can at least make makeLocalCache use
   * builder.build() and then cast?
   */

  private static <K, V> LocalCache<K, V> makeLocalCache(

    public static final String LABELS_boost_document_rule_sort_order = "{labels.boost_document_rule_sort_order}";

    /** The key of the message: Access Token */
    public static final String LABELS_access_token_configuration = "{labels.access_token_configuration}";

    /** The key of the message: Access Token */
    public static final String LABELS_access_token_title_details = "{labels.access_token_title_details}";

- **Auth**
  - [alpha] Container Image Policy allows an access controller to determine whether a pod may be scheduled based on a policy ([docs](http://kubernetes.io/docs/admin/admission-controllers/#imagepolicywebhook)) ([kubernetes/features#59](https://github.com/kubernetes/enhancements/issues/59))

}

func (s *TestSuiteCommon) TestCors(c *check) {
	expectedMap := http.Header{}
	expectedMap.Set("Access-Control-Allow-Credentials", "true")
	expectedMap.Set("Access-Control-Allow-Origin", "http://foobar.com")
	expectedMap["Access-Control-Expose-Headers"] = []string{
		"Date",
		"Etag",
		"Server",
		"Connection",
		"Accept-Ranges",
		"Content-Range",