ingress:
  enabled: false
  ingressClassName: ~
  labels:
    {}
    # node-role.kubernetes.io/ingress: platform
  annotations:
    {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
    # kubernetes.io/ingress.allow-http: "false"
    # kubernetes.io/ingress.global-static-ip-name: ""
    # nginx.ingress.kubernetes.io/secure-backends: "true"

	if err != nil {
		return nil, nil, fmt.Errorf("failed to generate serial number: %w", err)
	}

	template := x509.Certificate{
		SerialNumber: serialNumber,
		Subject: pkix.Name{
			Organization: []string{"Acme Co"},
		},
		NotBefore: notBefore,
		NotAfter:  notAfter,

		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,

// SPECIFICALLY DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY OF FITNESS FOR
// HIGH RISK ACTIVITIES.
//
//
// The rest is:
//
// Copyright (C) 1996 by Jef Poskanzer <jef@acme.com>.  All rights reserved.
//
// Copyright (C) 1996 by Wolfgang Platzer
// email: ******@****.***
//
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without

 * and access mask of each ACE. If the SID matches, the allow/deny flags
 * and access mask are considered. If the ACE is a "deny"
 * ACE and <i>any</i> of the desired access bits match bits in the access
 * mask of the ACE, the whole access check fails. If the ACE is an "allow"
 * ACE and <i>all</i> of the bits in the desired access bits match bits in
 * the access mask of the ACE, the access check is successful. Otherwise,

 * and access mask of each ACE. If the SID matches, the allow/deny flags
 * and access mask are considered. If the ACE is a "deny"
 * ACE and <i>any</i> of the desired access bits match bits in the access
 * mask of the ACE, the whole access check fails. If the ACE is an "allow"
 * ACE and <i>all</i> of the bits in the desired access bits match bits in
 * the access mask of the ACE, the access check is successful. Otherwise,

 * and access mask of each ACE. If the SID matches, the allow/deny flags
 * and access mask are considered. If the ACE is a "deny"
 * ACE and <i>any</i> of the desired access bits match bits in the access
 * mask of the ACE, the whole access check fails. If the ACE is an "allow"
 * ACE and <i>all</i> of the bits in the desired access bits match bits in
 * the access mask of the ACE, the access check is successful. Otherwise,

}

// IsARM64CMP reports whether the op (as defined by an arm64.A* constant) is
// one of the comparison instructions that require special handling.
func IsARM64CMP(op obj.As) bool {
	switch op {
	case arm64.ACMN, arm64.ACMP, arm64.ATST,
		arm64.ACMNW, arm64.ACMPW, arm64.ATSTW,
		arm64.AFCMPS, arm64.AFCMPD,
		arm64.AFCMPES, arm64.AFCMPED:
		return true
	}
	return false
}

            int[] accessConstants = { ACE.FILE_READ_DATA, ACE.FILE_WRITE_DATA, ACE.FILE_APPEND_DATA, ACE.FILE_READ_EA, ACE.FILE_WRITE_EA,
                    ACE.FILE_EXECUTE, ACE.FILE_DELETE, ACE.FILE_READ_ATTRIBUTES, ACE.FILE_WRITE_ATTRIBUTES, ACE.DELETE, ACE.READ_CONTROL,
                    ACE.WRITE_DAC, ACE.WRITE_OWNER, ACE.SYNCHRONIZE, ACE.GENERIC_ALL, ACE.GENERIC_EXECUTE, ACE.GENERIC_WRITE,
                    ACE.GENERIC_READ };

        // Test combinations with FLAGS_INHERITED
        ace.flags = ACE.FLAGS_INHERITED | ACE.FLAGS_OBJECT_INHERIT;
        assertTrue(ace.isInherited());

        ace.flags = ACE.FLAGS_INHERITED | ACE.FLAGS_CONTAINER_INHERIT;
        assertTrue(ace.isInherited());

        ace.flags = ACE.FLAGS_INHERITED | ACE.FLAGS_NO_PROPAGATE;
        assertTrue(ace.isInherited());

            if (numAces > 4096) {
                throw new SMBProtocolDecodingException("Invalid SecurityDescriptor");
            }

            this.aces = new ACE[numAces];
            for (int i = 0; i < numAces; i++) {
                this.aces[i] = new ACE();
                bufferIndex += this.aces[i].decode(buffer, bufferIndex, len - bufferIndex);
            }
        } else {
            this.aces = null;
        }