func hasNonControllerOwner(claim *v1.PersistentVolumeClaim, set *apps.StatefulSet, pod *v1.Pod) bool {
	for _, ownerRef := range claim.GetOwnerReferences() {
		if ownerRef.UID == set.GetUID() || ownerRef.UID == pod.GetUID() {
			if ownerRef.Controller == nil || !*ownerRef.Controller {
				return true
			}
		}
	}
	return false
}

			foundMismatch = true
		} else {
			for _, ownerRef := range dep.owners {
				// ... find the ownerRef with a matching uid ...
				if ownerRef.UID == matchOwnerIdentity.UID {
					// ... and check if it matches all coordinates
					if ownerReferenceMatchesCoordinates(ownerRef, matchOwnerIdentity.OwnerReference) {
						foundMatch = true
					} else {
						foundMismatch = true

		testCases := []struct {
			name      string
			ownerRef  []metav1.OwnerReference
			expectRef bool
		}{
			{
				name:      "bare PVC",
				expectRef: true,
			},
			{
				name:      "PVC already controller",
				ownerRef:  []metav1.OwnerReference{{Controller: ptr.To(true), Name: "foobar"}},
				expectRef: false,
			},
		}

			// resource that is owned by the service and sets blockOwnerDeletion=true in its ownerRef.
			rbacv1helpers.NewRule("update").Groups(legacyGroup).Resources("services/finalizers").RuleOrDie(),
			// The controller needs to be able to set a service's finalizers to be able to create an EndpointSlice
			// resource that is owned by the endpoint and sets blockOwnerDeletion=true in its ownerRef.

		ssc.enqueueStatefulSet(set)
		fakeWorker(ssc)
		*set.Spec.Replicas = 0 // Put an ownerRef for all scale-down deleted PVCs.
		ssc.enqueueStatefulSet(set)
		fakeWorker(ssc)

		hasNamedOwnerRef := func(claim *v1.PersistentVolumeClaim, name string) bool {
			for _, ownerRef := range claim.GetOwnerReferences() {
				if ownerRef.Name == name {
					return true
				}
			}
			return false
		}

	found, ok := gvk.ToGVR(gk)
	if !ok {
		return schema.GroupVersionResource{}, fmt.Errorf("unknown gvk: %v", gk)
	}
	return found, nil
}

// EnqueueForParentHandler returns a handler that will enqueue the parent (by ownerRef) resource
func EnqueueForParentHandler(q Queue, kind config.GroupVersionKind) func(obj Object) {
	handler := func(obj Object) {
		for _, ref := range obj.GetOwnerReferences() {

func newGCPermissionsEnforcement() (*gcPermissionsEnforcement, error) {
	// the pods/status endpoint is ignored by this plugin since old kubelets
	// corrupt them.  the pod status strategy ensures status updates cannot mutate
	// ownerRef.
	whiteList := []whiteListItem{
		{
			groupResource: schema.GroupResource{Resource: "pods"},
			subresource:   "status",
		},
	}
	gcAdmit := &gcPermissionsEnforcement{

	gvk := schema.GroupVersionKind{Version: "v1", Kind: "Service"}
	ownerRef := metav1.NewControllerRef(service, gvk)

	deletedTs := metav1.Now()
	endpointSlice := &discovery.EndpointSlice{
		ObjectMeta: metav1.ObjectMeta{
			Name:            "epSlice-1",
			Namespace:       ns,
			OwnerReferences: []metav1.OwnerReference{*ownerRef},
			Labels: map[string]string{
				discovery.LabelServiceName: serviceName,

					return fmt.Errorf("could not update claim %s for delete policy ownerRefs: %w", claimName, err)
				}
			}
		}
	}
	return nil
}

// PodClaimIsStale returns true for a stale PVC that should block pod creation. If the scaling
// policy is deletion, and a PVC has an ownerRef that does not match the pod, the PVC is stale. This
// includes pods whose UID has not been created.

					events:                 []string{`Warning OwnerRefInvalidNamespace ownerRef [v1/Pod, namespace: ns1, name: podname2, uid: poduid2] does not exist in namespace "ns1" involvedObject{kind=Pod,apiVersion=v1}`},
				}),
				// 6,7: handle queued delete of virtual parent
				processAttemptToDelete(1),