// NodeRuntimeHandlerFeaturesApplyConfiguration represents an declarative configuration of the NodeRuntimeHandlerFeatures type for use
// with apply.
type NodeRuntimeHandlerFeaturesApplyConfiguration struct {
	RecursiveReadOnlyMounts *bool `json:"recursiveReadOnlyMounts,omitempty"`
}

// NodeRuntimeHandlerFeaturesApplyConfiguration constructs an declarative configuration of the NodeRuntimeHandlerFeatures type for use with
// apply.

    machineID: machineIDValue
    operatingSystem: operatingSystemValue
    osImage: osImageValue
    systemUUID: systemUUIDValue
  phase: phaseValue
  runtimeHandlers:
  - features:
      recursiveReadOnlyMounts: true
    name: nameValue
  volumesAttached:
  - devicePath: devicePathValue
    name: nameValue
  volumesInUse:

    machineID: machineIDValue
    operatingSystem: operatingSystemValue
    osImage: osImageValue
    systemUUID: systemUUIDValue
  phase: phaseValue
  runtimeHandlers:
  - features:
      recursiveReadOnlyMounts: true
    name: nameValue
  volumesAttached:
  - devicePath: devicePathValue
    name: nameValue
  volumesInUse:

        }
      },
      "error": "errorValue"
    },
    "runtimeHandlers": [
      {
        "name": "nameValue",
        "features": {
          "recursiveReadOnlyMounts": true
        }
      }
    ]
  }

        }
      },
      "error": "errorValue"
    },
    "runtimeHandlers": [
      {
        "name": "nameValue",
        "features": {
          "recursiveReadOnlyMounts": true
        }
      }
    ]
  }

		node.Status.Config = nil
	}

	// for update
	if !nodeConfigSourceInUse(oldNode) && oldNode != nil {
		node.Spec.ConfigSource = nil
	}

	if !utilfeature.DefaultFeatureGate.Enabled(features.RecursiveReadOnlyMounts) {
		node.Status.RuntimeHandlers = nil
	}
}

// nodeConfigSourceInUse returns true if node's Spec ConfigSource is set(used)
func nodeConfigSourceInUse(node *api.Node) bool {
	if node == nil {

	}
	retHandlers := make([]kubecontainer.RuntimeHandler, len(handlers))
	for i, h := range handlers {
		supportsRRO := false
		supportsUserns := false
		if h.Features != nil {
			supportsRRO = h.Features.RecursiveReadOnlyMounts
			supportsUserns = h.Features.UserNamespaces
		}
		retHandlers[i] = kubecontainer.RuntimeHandler{
			Name:                            h.Name,
			SupportsRecursiveReadOnlyMounts: supportsRRO,

		if !utilfeature.DefaultFeatureGate.Enabled(features.RecursiveReadOnlyMounts) {
			return nil
		}
		handlers := fn()
		node.Status.RuntimeHandlers = make([]v1.NodeRuntimeHandler, len(handlers))
		for i, h := range handlers {
			node.Status.RuntimeHandlers[i] = v1.NodeRuntimeHandler{
				Name: h.Name,
				Features: &v1.NodeRuntimeHandlerFeatures{
					RecursiveReadOnlyMounts: &h.SupportsRecursiveReadOnlyMounts,
				},
			}

	SELinuxMount featuregate.Feature = "SELinuxMount"

	// owner: @AkihiroSuda
	// kep: https://kep.k8s.io/3857
	// alpha: v1.30
	//
	// Allows recursive read-only mounts.
	RecursiveReadOnlyMounts featuregate.Feature = "RecursiveReadOnlyMounts"

	// owner: @everpeace
	// kep: https://kep.k8s.io/3619
	// alpha: v1.31
	//
	// Enable SupplementalGroupsPolicy feature in PodSecurityContext

			podSpec.InitContainers[i].RestartPolicy = nil
		}
		// For other types of containers, validateContainers will handle them.
	}

	if !utilfeature.DefaultFeatureGate.Enabled(features.RecursiveReadOnlyMounts) && !rroInUse(oldPodSpec) {
		for i := range podSpec.Containers {
			for j := range podSpec.Containers[i].VolumeMounts {
				podSpec.Containers[i].VolumeMounts[j].RecursiveReadOnly = nil
			}
		}