.that(mean)
            .isWithin(ALLOWED_ERROR)
            .of(MANY_VALUES_MEAN);
      }
    }
    assertThat(MANY_VALUES_STATS_ITERABLE.mean()).isWithin(ALLOWED_ERROR).of(MANY_VALUES_MEAN);
    assertThat(MANY_VALUES_STATS_ITERATOR.mean()).isWithin(ALLOWED_ERROR).of(MANY_VALUES_MEAN);
    assertThat(MANY_VALUES_STATS_SNAPSHOT.mean()).isWithin(ALLOWED_ERROR).of(MANY_VALUES_MEAN);

  // allowedUnsafeSysctls is a list of explicitly allowed unsafe sysctls, defaults to none.
  // Each entry is either a plain sysctl name or ends in "*" in which case it is considered
  // as a prefix of allowed sysctls. Single * means all unsafe sysctls are allowed.
  // Kubelet has to allowlist all allowed unsafe sysctls explicitly to avoid rejection.
  //
  // Examples:
  // e.g. "foo/*" allows "foo/bar", "foo/baz", etc.

  public void testReplaceEntry_absentKeyNullValueUnsupported() {
    try {
      assertFalse(getMap().replace(k3(), v3(), null));
    } catch (NullPointerException tolerated) {
      // the operation would be a no-op, so exceptions are allowed but not required
    }
    expectUnchanged();
  }

  @MapFeature.Require({SUPPORTS_PUT, ALLOWS_NULL_VALUE_QUERIES})

message SubjectAccessReviewStatus {
  // Allowed is required. True if the action would be allowed, false otherwise.
  optional bool allowed = 1;

  // Denied is optional. True if the action would be denied, otherwise
  // false. If both allowed is false and denied is false, then the
  // authorizer has no opinion on whether to authorize the action. Denied
  // may not be true if Allowed is true.
  // +optional

message SubjectAccessReviewStatus {
  // Allowed is required. True if the action would be allowed, false otherwise.
  optional bool allowed = 1;

  // Denied is optional. True if the action would be denied, otherwise
  // false. If both allowed is false and denied is false, then the
  // authorizer has no opinion on whether to authorize the action. Denied
  // may not be true if Allowed is true.
  // +optional

      assertThat(actualStats.mean()).isWithin(ALLOWED_ERROR).of(expectedStats.mean());
      assertThat(actualStats.populationVariance()).isWithin(0.0).of(0.0);
      assertThat(actualStats.min()).isWithin(ALLOWED_ERROR).of(expectedStats.min());
      assertThat(actualStats.max()).isWithin(ALLOWED_ERROR).of(expectedStats.max());
    } else {
      assertThat(actualStats.mean()).isWithin(ALLOWED_ERROR).of(expectedStats.mean());

  public void testReplaceEntry_absentKeyNullValueUnsupported() {
    try {
      assertFalse(getMap().replace(k3(), v3(), null));
    } catch (NullPointerException tolerated) {
      // the operation would be a no-op, so exceptions are allowed but not required
    }
    expectUnchanged();
  }

  @MapFeature.Require({SUPPORTS_PUT, ALLOWS_NULL_VALUE_QUERIES})

// errMethodNotAllowed means that method is not allowed.
var errMethodNotAllowed = errors.New("Method not allowed")

// errSignatureMismatch means signature did not match.
var errSignatureMismatch = errors.New("Signature does not match")

// When upload object size is greater than 5G in a single PUT/POST operation.
var errDataTooLarge = errors.New("Object size larger than allowed limit")

  optional string namespace = 3;
}

// ImageReviewStatus is the result of the review for the pod creation request.
message ImageReviewStatus {
  // Allowed indicates that all images were allowed to be run.
  optional bool allowed = 1;

  // Reason should be empty unless Allowed is false in which case it
  // may contain a short description of what is wrong.  Kubernetes
  // may truncate excessively long errors when displaying to the user.

      assertThat(actualStats.mean()).isWithin(ALLOWED_ERROR).of(expectedStats.mean());
      assertThat(actualStats.populationVariance()).isWithin(0.0).of(0.0);
      assertThat(actualStats.min()).isWithin(ALLOWED_ERROR).of(expectedStats.min());
      assertThat(actualStats.max()).isWithin(ALLOWED_ERROR).of(expectedStats.max());
    } else {
      assertThat(actualStats.mean()).isWithin(ALLOWED_ERROR).of(expectedStats.mean());