#### CRD Watcher

For watches against custom types (CRDs), we want to gracefully handle missing CRDs. Naively starting informers against the missing types would result in errors and blocking startup. Instead, we introduce a "CRD Watcher" component that watches the CRDs in the cluster to determine if they are available or not.

# Simple OAuth2 with Password and Bearer

Now let's build from the previous chapter and add the missing parts to have a complete security flow.

## Get the `username` and `password`

We are going to use **FastAPI** security utilities to get the `username` and `password`.

OAuth2 specifies that when using the "password flow" (that we are using) the client/user must send a `username` and `password` fields as form data.

// This type is beta-level in 1.8
message NetworkPolicyEgressRule {
  // List of destination ports for outgoing traffic.
  // Each item in this list is combined using a logical OR. If this field is
  // empty or missing, this rule matches all ports (traffic not restricted by port).
  // If this field is present and contains at least one item, then this rule allows
  // traffic only if the traffic matches at least one port in the list.

  a result turning off certain services provided by m2 and providing a coherent
  way of predicting and reporting when network-related failures will take place.
  It means warning users that since the network is missing, certain features and
  operations will be unavailable, rather than simply waiting for those
  operations to fail, then trying to help users decipher the error messages they
  get as a result.

  // It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
  // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
  // +optional
  optional string evaluationError = 3;
}

        "Expected 'Sec-WebSocket-Accept' header value '$acceptExpected' but was '$headerAccept'",
      )
    }

    if (exchange == null) {
      throw ProtocolException("Web Socket exchange missing: bad interceptor?")
    }
  }

  fun initReaderAndWriter(
    name: String,
    streams: Streams,
  ) {
    val extensions = this.extensions!!
    synchronized(this) {
      this.name = name

!!! note
    Keep in mind that different tools might have different levels of OpenAPI support.

    Some of them might not show all the extra information declared yet, although in most of the cases, the missing feature is already planned for development.

You can add a `title`:

=== "Python 3.10+"

    ```Python hl_lines="10"
    {!> ../../../docs_src/query_params_str_validations/tutorial007_an_py310.py!}
    ```

    cat $BATS_TEST_TMPDIR/actual_extra_licenses
  fi

  if [[ -s $BATS_TEST_TMPDIR/actual_missing_licenses ]]; then
    echo "Please include the missing licenses for the following packages in $LICENSES_TARGET:"
    cat $BATS_TEST_TMPDIR/actual_missing_licenses
  fi

  # Fail if either of the two "extras" or "missing" lists are present. If so,
  # then the user will see the above error messages.

    cat $BATS_TEST_TMPDIR/actual_extra_licenses
  fi

  if [[ -s $BATS_TEST_TMPDIR/actual_missing_licenses ]]; then
    echo "Please include the missing licenses for the following packages in $LICENSES_TARGET:"
    cat $BATS_TEST_TMPDIR/actual_missing_licenses
  fi

  # Fail if either of the two "extras" or "missing" lists are present. If so,
  # then the user will see the above error messages.

// This type is beta-level in 1.8
message NetworkPolicyEgressRule {
  // ports is a list of destination ports for outgoing traffic.
  // Each item in this list is combined using a logical OR. If this field is
  // empty or missing, this rule matches all ports (traffic not restricted by port).
  // If this field is present and contains at least one item, then this rule allows
  // traffic only if the traffic matches at least one port in the list.