lines := strings.Split(strings.Trim(table, "\n"), "\n")
		// The first line should be, eg, "*nat" or "*filter"
		if lines[0][0] != '*' {
			return nil, fmt.Errorf("bad ruleData (table %d starts with %q)", i+1, lines[0])
		}
		// add back the "COMMIT" line that got eaten by the strings.Split above
		lines = append(lines, "COMMIT")
		tables[lines[0][1:]] = lines
	}

	if tables["nat"] == nil {

  // FallbackToLogsOnError will use the last chunk of container log output if the termination
  // message file is empty and the container exited with an error.
  // The log output is limited to 2048 bytes or 80 lines, whichever is smaller.
  // Defaults to File.
  // Cannot be updated.
  // +optional
  optional string terminationMessagePolicy = 20;

  // Image pull policy.
  // One of Always, Never, IfNotPresent.

  kube-proxy is responsible for, rather than only counting the number of rules
  that it re-synced on the last sync. The new `sync_proxy_rules_iptables_last`
  metric now gives the latter number. ([#119140](https://github.com/kubernetes/kubernetes/pull/119140), [@danwinship](https://github.com/danwinship)) [SIG Network]

	// +optional
	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty" protobuf:"bytes,4,opt,name=lastTransitionTime"`
	// reason is a unique, this should be a short, machine understandable string that gives the reason
	// for condition's last transition. If it reports "Resizing" that means the underlying
	// persistent volume is being resized.
	// +optional

	"imagePullPolicy":          "Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated. More...

	// topologically proximate to the client. The interpretation of "topologically
	// proximate" may vary across implementations and could encompass endpoints
	// within the same node, rack, zone, or even region. Setting this value gives
	// implementations permission to make different tradeoffs, e.g. optimizing for
	// proximity rather than equal distribution of load. Users should not set this
	// value if such tradeoffs are not acceptable.

- Fixes bug where OpenAPIV2 config was used instead of V3, and gives clear error message about OpenAPIV3 requirement ([#120612](https://github.com/kubernetes/kubernetes/pull/120612), [@alexzielenski](https://github.com/alexzielenski)) [SIG API Machinery]

- Promoted plugin subcommand resolution feature to `beta`. ([#120663](https://github.com/kubernetes/kubernetes/pull/120663), [@ardaguclu](https://github.com/ardaguclu))

}

func helpTestCreateUpdateDeleteWithFamilies(t *testing.T, testCases []cudTestCase, ipFamilies []api.IPFamily) {
	// NOTE: do not call t.Helper() here.  It's more useful for errors to be
	// attributed to lines in this function than the caller of it.

	storage, _, server := newStorage(t, ipFamilies)
	defer server.Terminate(t)
	defer storage.Store.DestroyFunc()

	for _, tc := range testCases {
		name := tc.name

func validateNodeAffinity(na *core.NodeAffinity, fldPath *field.Path) field.ErrorList {
	allErrs := field.ErrorList{}
	// TODO: Uncomment the next three lines once RequiredDuringSchedulingRequiredDuringExecution is implemented.
	// if na.RequiredDuringSchedulingRequiredDuringExecution != nil {