Patch(
			context.Background(),
			pod.Name,
			types.MergePatchType,
			annotationPatch,
			metav1.PatchOptions{},
			// Both "pods" and "pods/status" can mutate the metadata. However, pods/status is lower privilege, so we use that instead.
			"status",
		)
	return err
}

func AnnotateUnenrollPod(client kubernetes.Interface, pod *metav1.ObjectMeta) error {

	"istio.io/istio/pkg/env"
	"istio.io/istio/pkg/log"
)

var TraceLoggingEnabled = env.Register(
	"IPTABLES_TRACE_LOGGING",
	false,
	"When enable, all iptables actions will be logged. "+
		"This requires NET_ADMIN privilege and has noisy logs; as a result, this is intended for debugging only").Get()

var iptablesTrace = log.RegisterScope("iptables", "trace logs for iptables")

// ReadNFLOGSocket reads from the nflog socket, sending output to logs.

# root of the module graph contains the package), whereas it is ambiguous in
# Go 1.16 (because two different modules contain plausible packages and Go 1.16
# does not privilege roots above other dependencies).
#
# However, the overall build list is identical for both versions.

cp go.mod go.mod.orig

! go mod tidy

  // Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
  // This requires no RBAC privilege, but will require the CNI agent to run as a privileged pod.
  bool repairPods = 11;

  // No longer used.
  string createEvents = 6 [deprecated = true];

}

type Tokenprivileges struct {
	PrivilegeCount uint32
	Privileges     [1]LUIDAndAttributes // Use AllPrivileges() for iterating.
}

// AllPrivileges returns a slice that can be used to iterate over the privileges in p.
func (p *Tokenprivileges) AllPrivileges() []LUIDAndAttributes {
	return (*[(1 << 27) - 1]LUIDAndAttributes)(unsafe.Pointer(&p.Privileges[0]))[:p.PrivilegeCount:p.PrivilegeCount]
}

    - [CVE-2023-3955: Insufficient input sanitization on Windows nodes leads to privilege escalation](#cve-2023-3955-insufficient-input-sanitization-on-windows-nodes-leads-to-privilege-escalation)
    - [CVE-2023-3676: Insufficient input sanitization on Windows nodes leads to privilege escalation](#cve-2023-3676-insufficient-input-sanitization-on-windows-nodes-leads-to-privilege-escalation)
  - [Changes by Kind](#changes-by-kind-10)

    - [CVE-2023-3955: Insufficient input sanitization on Windows nodes leads to privilege escalation](#cve-2023-3955-insufficient-input-sanitization-on-windows-nodes-leads-to-privilege-escalation)
    - [CVE-2023-3676: Insufficient input sanitization on Windows nodes leads to privilege escalation](#cve-2023-3676-insufficient-input-sanitization-on-windows-nodes-leads-to-privilege-escalation)
  - [Changes by Kind](#changes-by-kind-10)

	// Enables privileged securityContext for the istio-proxy container.
	//
	// See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
	Privileged *wrapperspb.BoolValue `protobuf:"bytes,19,opt,name=privileged,proto3" json:"privileged,omitempty"`
	// Sets the initial delay for readiness probes in seconds.

{
  "name": "istio build-tools",
  "image": "gcr.io/istio-testing/build-tools:master-89ff97db972e1ec7d61a7831bf9408f509e17d73",
  "privileged": true,
  "remoteEnv": {
    "USE_GKE_GCLOUD_AUTH_PLUGIN": "True",
    "BUILD_WITH_CONTAINER": "0",
    "CARGO_HOME": "/home/.cargo",
    "RUSTUP_HOME": "/home/.rustup"
  },
  "features": {
    "ghcr.io/devcontainers/features/docker-outside-of-docker:1": {},
    "ghcr.io/mpriscella/features/kind:1": {}
  },

        args:
          - --masq-chain=IP-MASQ
          - --nomasq-all-reserved-ranges
        resources:
          requests:
            cpu: 10m
            memory: 16Mi
        securityContext:
          privileged: true
        volumeMounts:
          - name: config
            mountPath: /etc/config
      nodeSelector:
        kubernetes.io/os: linux
        node.kubernetes.io/masq-agent-ds-ready: "true"
      volumes: