DependencyNode resolverNode =
                        delegate.getMojoDescriptor().getPluginDescriptor().getDependencyNode();
                DefaultNode node = new DefaultNode(session, resolverNode, false);
                return Collections.unmodifiableMap(node.stream()
                        .filter(Objects::nonNull)
                        .map(Node::getDependency)

        key: node-role.kubernetes.io/control-plane
        operator: Exists
      volumes:
      - name: memberlist
        secret:
          defaultMode: 420
          secretName: memberlist
      - configMap:
          defaultMode: 256
          name: metallb-excludel2
        name: metallb-excludel2
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration

  // the volume setup will error unless it is marked optional. Paths must be
  // relative and may not contain the '..' path or start with '..'.
  // +optional
  repeated KeyToPath items = 2;

  // defaultMode is optional: mode bits used to set permissions on created files by default.
  // Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.

- Fixes an issue where an admission webhook can observe a v1 Pod object that does not have the `defaultMode` field set in the injected service account token volume in kube-api-server. ([#104523](https://github.com/kubernetes/kubernetes/pull/104523), [@liggitt](https://github.com/liggitt))