test:linux_cpu_pycpp_test_filters --test_tag_filters=-no_oss,-oss_excluded,-oss_serial,-gpu,-tpu,-benchmark-test,-v1only
test:linux_cpu_pycpp_test_filters --build_tag_filters=-no_oss,-oss_excluded,-oss_serial,-gpu,-tpu,-benchmark-test,-v1only
test:linux_cpu_pycpp_test_filters --test_lang_filters=cc,py --test_size_filters=small,medium

	@bin/check_samples.sh
	@testlinter
	@envvarlinter istioctl pilot security

# Allow-list:
# (k8s) Machinery, utils, klog
# (proto) Istio API non-CRDs, MeshConfig and ProxyConfig
# (proto) Envoy TLS proto for SDS
# (proto) Envoy Wasm filters for wasm xDS proxy
# (proto) xDS discovery service for xDS proxy
.PHONY: check-agent-deps

	registerStringParameter(constants.RepairLabelSelectors, "",
		"A set of label selectors in label=value format that will be added to the pod list filters")
	registerStringParameter(constants.RepairFieldSelectors, "",
		"A set of field selectors in label=value format that will be added to the pod list filters")
}

func registerStringParameter(name, value, usage string) {
	rootCmd.Flags().String(name, value, usage)

* Why is this change done? What's the use case?
* For user facing features, what will the API look like?
* What test cases should it have? What could go wrong?
* How will it roughly be implemented? We'll happily provide code pointers to save you time.

We may ask you to answer these questions directly in the GitHub issue or (for large changes) in a shared Google Doc.

	// Whether to fix race condition by repairing them
	RepairPods bool

	// Whether to fix race condition by delete broken pods
	DeletePods bool

	// Whether to label broken pods
	LabelPods bool

	// Filters for race repair, including name of sidecar annotation, name of init container,
	// init container termination message and exit code.
	SidecarAnnotation  string
	InitContainerName  string
	InitTerminationMsg string

				if err == nil {
					ip = haddrs[0]
				}
			}
		}
		ifs, _ := net.Interfaces()
		for _, interf := range ifs {
			addrs, err := interf.Addrs()
			if err == nil {
				for _, addr := range addrs {
					if strings.SplitN(addr.String(), "/", 2)[0] == ip {
						globalInternodeInterface = interf.Name
					}
				}
			}
		}
	})
}

			opts: ObjectOpts{
				IsLatest: true,
				UserTags: "key1=val1",
				Name:     "obj-1",
				Size:     2 * humanize.MiByte,
			},
			hasRules: true,
		},
		{ // PUT version with size based filters
			lc: Lifecycle{
				Rules: []Rule{
					rules[1],
					rules[2],
					rules[3],
					rules[4],
					rules[5],
				},
			},
			opts: ObjectOpts{
				IsLatest: true,

          preload_modules:
          - httpx
          - starlette
          inherited_members: true
          members_order: source
          separate_signature: true
          unwrap_annotated: true
          filters:
          - '!^_'
          merge_init_into_class: true
          docstring_section_style: spacy
          signature_crossrefs: true
          show_symbol_type_heading: true
          show_symbol_type_toc: true
nav:

					continue
				}
				// We only need to match x-amz-meta or standardHeaders
				if kv.Match(BatchJobKV{Key: k, Value: v}) {
					return true
				}
			}
		}

		// None of the provided filters match
		return false
	}

	u, err := url.Parse(r.Source.Endpoint)
	if err != nil {
		return err
	}

	cred := r.Source.Creds

	c, err := miniogo.New(u.Host, &miniogo.Options{

		"--mark", inpodMark,
		"-j", "CONNMARK",
		"--set-xmark", inpodTproxyMark)

	// Handle healthcheck probes from the host node. In the host netns, before the packet enters the pod, we SNAT
	// the healthcheck packet to a fixed IP if the packet is coming from a node-local process with a socket.
	//