// text must be valid UTF-8, and must not contain control characters.
	AddWarning(agent, text string)
}

// WithWarningRecorder returns a new context that wraps the provided context and contains the provided Recorder implementation.
// The returned context can be passed to AddWarning().
func WithWarningRecorder(ctx context.Context, recorder Recorder) context.Context {
	return context.WithValue(ctx, warningRecorderKey, recorder)
}

	"k8s.io/apiserver/pkg/warning"
)

// WithWarningRecorder attaches a deduplicating k8s.io/apiserver/pkg/warning#WarningRecorder to the request context.
func WithWarningRecorder(handler http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
		recorder := &recorder{writer: w}
		req = req.WithContext(warning.WithWarningRecorder(req.Context(), recorder))
		handler.ServeHTTP(w, req)
	})
}

			defer server.Terminate(t)
			defer storage.Job.Store.DestroyFunc()
			dc := dummyRecorder{agent: "", text: ""}
			ctx = genericapirequest.WithRequestInfo(ctx, test.requestInfo)
			ctxWithRecorder := warning.WithWarningRecorder(ctx, &dc)
			// Create the object
			if err := storage.Job.Storage.Create(ctxWithRecorder, key, job, nil, 0, false); err != nil {
				t.Fatalf("unexpected error: %v", err)
			}

		},
	}

	for k, tc := range tests {
		dc := dummyRecorder{agent: "", text: ""}
		ctx := genericapirequest.NewDefaultContext()
		ctxWithRecorder := warning.WithWarningRecorder(ctx, &dc)
		req, _ := http.NewRequestWithContext(ctxWithRecorder, "GET", "/", nil)
		for _, h := range tc.AuthorizationHeaders {
			req.Header.Add("Authorization", h)
		}

		bearerAuth := New(tc.TokenAuth)

		defer cancel()

		if audsOk {
			ctx = authenticator.WithAudiences(ctx, auds)
		}
		recorder := &recorder{}
		ctx = warning.WithWarningRecorder(ctx, recorder)

		ctx = audit.WithAuditContext(ctx)
		ac := audit.AuditContextFrom(ctx)
		// since this is shared work between multiple requests, we have no way of knowing if any

		admission.Update, &metav1.UpdateOptions{}, false,
		&user.DefaultInfo{Name: "myuser"},
	)
	b.ResetTimer()
	for i := 0; i < b.N; i++ {
		dc := dummyRecorder{agent: "", text: ""}
		ctxWithRecorder := warning.WithWarningRecorder(ctx, &dc)
		if err := p.Validate(ctxWithRecorder, attrs, nil); err != nil {
			b.Fatal(err)
		}
		// should either be a single aggregated warning, or a unique warning per pod

	})

	testContext := setupFakeTest(t, compiler, matcher)
	require.NoError(t, testContext.UpdateAndWait(fakeParams, denyPolicy, denyBinding))

	warningRecorder := newWarningRecorder()
	warnCtx := warning.WithWarningRecorder(testContext, warningRecorder)
	attr := attributeRecord(nil, fakeParams, admission.Create)
	err := testContext.Plugin.Dispatch(
		warnCtx,
		// Object is irrelevant/unchecked for this test. Just test that

	handler = genericfilters.WithCORS(handler, c.CorsAllowedOriginList, nil, nil, nil, "true")

	// WithWarningRecorder must be wrapped by the timeout handler
	// to make the addition of warning headers threadsafe
	handler = genericapifilters.WithWarningRecorder(handler)

	// WithTimeoutForNonLongRunningRequests will call the rest of the request handling in a go-routine with the

			assert.Nil(t, pod.Spec.Containers[0].SecurityContext)
		},
	}}

	for _, test := range tests {
		t.Run(test.description, func(t *testing.T) {
			warnings := &warningRecorder{}
			ctx := warning.WithWarningRecorder(context.Background(), warnings)
			applyAppArmorVersionSkew(ctx, test.pod)
			test.validation(t, test.pod)

			if test.expectWarning {
				if assert.NotEmpty(t, warnings.warnings, "expect warnings") {

		t.Run(c.name, func(t *testing.T) {
			validator := NewValidator(c.schema, false, celconfig.PerCallLimit)
			require.NotNil(t, validator)
			recorder := &warningRecorder{}
			ctx := warning.WithWarningRecorder(context.TODO(), recorder)
			budget := c.runtimeCostBudget
			if budget == 0 {
				budget = celconfig.RuntimeCELCostBudget
			}
			errs, _ := validator.Validate(
				ctx,
				field.NewPath("root"),