}
        },

                  on which this `DestinationRule` configuration should be applied.
                properties:
                  matchLabels:
                    additionalProperties:
                      type: string
                    description: One or more labels that indicate a specific set of
                      pods/VMs on which a policy should be applied.

                  on which this patch configuration should be applied.
                properties:
                  labels:
                    additionalProperties:
                      type: string
                    description: One or more labels that indicate a specific set of
                      pods/VMs on which the configuration should be applied.

- Fixed a regression which prevented pods with `docker/default` seccomp annotations from being created in 1.19 if a PodSecurityPolicy was in place which did not allow `runtime/default` seccomp profiles. ([#95990](https://github.com/kubernetes/kubernetes/pull/95990), [@saschagrunert](https://github.com/saschagrunert)) [SIG Auth]

		}, {
			old: core.Pod{
				Spec: core.PodSpec{
					NodeSelector: map[string]string{
						"foo": "bar",
					},
				},
			},
			new:  core.Pod{},
			err:  "Forbidden: pod updates may not change fields other than `spec.containers[*].image",
			test: "removing node selector is not allowed for non-gated pods",
		}, {
			old: core.Pod{

    *   Added a short doc explaining how `Estimator`s save checkpoints.
    *   Add documentation for ops supported by the `tf2xla` bridge.
    *   Fix minor typos in the doc of `SpaceToDepth` and `DepthToSpace`.
    *   Updated documentation comments in `mfcc_mel_filterbank.h` and `mfcc.h`
        to clarify that the input domain is squared magnitude spectra and the