// stomped by the controller.
  // +optional
  optional AggregationRule aggregationRule = 3;
}

// ClusterRoleBinding references a ClusterRole, but not contain it.  It can reference a ClusterRole in the global namespace,
// and adds who information via Subject.
// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBinding, and will no longer be served in v1.22.

  // stomped by the controller.
  // +optional
  optional AggregationRule aggregationRule = 3;
}

// ClusterRoleBinding references a ClusterRole, but not contain it.  It can reference a ClusterRole in the global namespace,
// and adds who information via Subject.
// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBinding, and will no longer be served in v1.22.

  // X.509 certificates.  Each certificate must include a basic constraints
  // extension with the CA bit set.  The API server will reject objects that
  // contain duplicate certificates, or that use PEM block headers.
  //
  // Users of ClusterTrustBundles, including Kubelet, are free to reorder and
  // deduplicate certificate blocks in this file according to their own logic,

  // according to the corresponding EndpointSlice addressType field. Consumers
  // must handle different types of addresses in the context of their own
  // capabilities. This must contain at least one address but no more than
  // 100. These are all assumed to be fungible and clients may choose to only
  // use the first element. Refer to: https://issue.k8s.io/106267
  // +listType=set

	mockIntercept := testDoAddRun(t, buildMockConf(true, ""), testNSName, pod, ns)

	if len(mockIntercept.lastRedirect) != 0 {
		t.Fatalf("Didnt Expect nsenterFunc to be called because this pod does not contain a sidecar")
	}
}

func TestCmdAddExcludePod(t *testing.T) {
	pod, ns := buildFakePodAndNSForClient()

	mockIntercept := testDoAddRun(t, buildMockConf(true, ""), "testExcludeNS", pod, ns)

  // +optional
  optional string revision = 2;

  // directory is the target directory name.
  // Must not contain or start with '..'.  If '.' is supplied, the volume directory will be the
  // git repository.  Otherwise, if specified, the volume will contain the git repository in
  // the subdirectory with the given name.
  // +optional
  optional string directory = 3;
}

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time time = 1;

  // message represents the error encountered during Attach or Detach operation.
  // This string may be logged, so it should not contain sensitive
  // information.
  // +optional
  optional string message = 2;
}

// VolumeNodeResources is a set of resource limits for scheduling of volumes.
message VolumeNodeResources {

  // The list ordering isn't significant, may contain duplicates, and possibly be incomplete.
  repeated ResourceRule resourceRules = 1;

  // NonResourceRules is the list of actions the subject is allowed to perform on non-resources.
  // The list ordering isn't significant, may contain duplicates, and possibly be incomplete.
  repeated NonResourceRule nonResourceRules = 2;

	if err != nil {
		return nil, err
	}

	dal := make([]*admin.ListenersConfigDump_DynamicListener, 0)
	for _, l := range listenerDump.DynamicListeners {
		// If a listener was reloaded, it would contain both the active and draining state
		// delete the draining state for proper comparison
		l.DrainingState = nil
		if l.ActiveState != nil {
			dal = append(dal, l)
		}
	}

	if err != nil {
		return err
	}
	for k, v := range ret {
		if !strings.EqualFold(k, "authorization") {
			if _, ok := dst[k]; ok {
				return fmt.Errorf("underlying %s credentials contain a %s header which is already present in the combined credentials", kind, k)
			}
			dst[k] = v
		} else {
			dst[dstHdr] = v
		}
	}
	return nil
}

type hubMembership struct {