[conscrypt]: https://github.com/google/conscrypt/
 [conscrypt_dependency]: https://github.com/google/conscrypt/#download
 [grpc_http2]: https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md
 [https_server_sample]: https://github.com/square/okhttp/blob/master/samples/guide/src/main/java/okhttp3/recipes/HttpsServer.java
 [jetty_8_252]: https://webtide.com/jetty-alpn-java-8u252/

  // by sending a graceful termination signal to the containers in the pod. After that 30 seconds,
  // the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup,
  // remove the pod from the API. In the presence of network partitions, this object may still
  // exist after this timestamp, until an administrator or automated process can determine the
  // resource is fully terminated.

    visibility = ["//visibility:public"],
)

# Sometimes Bazel reports darwin_x86_64 as "darwin" and sometimes as
# "darwin_x86_64". The former shows up when building on a Mac x86_64 host for a Mac x86_64 target.
# The latter shows up when cross-compiling for Mac x86_64 from a Mac ARM machine and in internal
# Google builds.
config_setting(
    name = "macos_x86_64_default",
    constraint_values = if_google(

Read more about sections `cluster_id`, `client_id` on [NATS documentation](https://github.com/nats-io/nats-streaming-server/blob/master/README.md). Section `maxPubAcksInflight` is explained [here](https://github.com/nats-io/stan.go#publisher-rate-limiting).

### Step 2: Enable NATS bucket notification using MinIO client

     *
     * N.B. Even if the [wholeQualifierElement] is not strictly in the [selection],
     * some outer part of it might be, and we want to shorten that.
     * So we have to check all the outer qualifiers.
     */
    private fun findClassifierQualifierToShorten(
        wholeQualifierClassId: ClassId,
        wholeQualifierElement: KtElement,

# TODO: also enable this flag after fixing the visibility violations
# build --incompatible_config_setting_private_default_visibility

# Default options should come above this line.

# Android configs. Bazel needs to have --cpu and --fat_apk_cpu both set to the
# target CPU to build transient dependencies correctly. See
# https://docs.bazel.build/versions/master/user-manual.html#flag--fat_apk_cpu

  * Retry Pod/RC updates in kubectl rolling-update.
  * Stop 'kubectl drain' deleting pods with local storage.
  * Add `kubectl rollout status`
* Security/Auth
  * L7 LB controller and disk attach controllers run on master, so nodes do not need those privileges.
  * Setting TLS1.2 minimum
  * `kubectl create secret tls` command
  * Webhook Token Authenticator