}
			}
		})
	}
}

type preEnqueuePlugin struct {
	allowlists []string
}

func (pl *preEnqueuePlugin) Name() string {
	return "preEnqueuePlugin"
}

func (pl *preEnqueuePlugin) PreEnqueue(ctx context.Context, p *v1.Pod) *framework.Status {
	for _, allowed := range pl.allowlists {
		for label := range p.Labels {
			if label == allowed {
				return nil
			}

// respective namespaces with the host. This check is only possible for sysctls on
// the static default allowlist, not those on the custom allowlist provided by the admin.
func (w *patternAllowlist) validateSysctl(sysctl string, hostNet, hostIPC bool) error {
	sysctl = utilsysctl.NormalizeName(sysctl)
	nsErrorFmt := "%q not allowed with host %s enabled"
	if ns, found := w.sysctls[sysctl]; found {
		if ns == utilsysctl.IPCNamespace && hostIPC {

	} {
		_, err := NewAllowlist(append(SafeSysctlAllowlist(), test.sysctls...))
		if test.err && err == nil {
			t.Errorf("expected an error creating a allowlist for %v", test.sysctls)
		} else if !test.err && err != nil {
			t.Errorf("got unexpected error creating a allowlist for %v: %v", test.sysctls, err)
		}
	}
}

func TestAllowlist(t *testing.T) {
	type Test struct {
		sysctl           string
		hostNet, hostIPC bool

zirain <******@****.***> 1666116203 +0800

Steven Landow <******@****.***> 1655333092 -0700

      "github.com/hashicorp/go-sockaddr": "MPL license not in CNCF allowlist",
      "github.com/hashicorp/go-uuid": "MPL license not in CNCF allowlist",
      "github.com/hashicorp/golang-lru": "MPL license not in CNCF allowlist",
      "github.com/hashicorp/hcl": "MPL license not in CNCF allowlist",
      "github.com/hashicorp/logutils": "MPL license not in CNCF allowlist",
      "github.com/hashicorp/memberlist": "MPL license not in CNCF allowlist",

// The cmd line flag to specify the allowlist of functions. Rest are trimmed
// after this pass is run.
namespace mlir {
namespace TFL {
namespace {
#define GEN_PASS_DEF_TRIMFUNCTIONSPASS
#include "tensorflow/compiler/mlir/lite/transforms/passes.h.inc"

// The pass to trim functions before we legalize to TFL
// dialect using the specified allowlist.
class TrimFunctionsPass

  let summary = "Trim functions to restrict them to a specified allowlist prior to legalization to TensorFlow lite dialect";
  let constructor = "CreateTrimFunctionsPass()";
  let options = [
      ListOption<"trim_funcs_allowlist_", "trim-funcs-allowlist", "std::string",
                 "comma separated list of allowlisted functions. The first "
                 "function specified will be used as main">
  ];
}

  // Flag is turned on, but no device is allowlisted.
  auto& rollout_config = GetXlaOpsCommonFlags()->tf_xla_use_device_api;
  rollout_config.enabled_for_xla_launch_ = true;

  EXPECT_FALSE(UsePjRtForSingleDeviceCompilation(DeviceType(DEVICE_CPU)));

  // Flag is turned on, some device is allowlisted, but the requested one isn't.
  rollout_config.AllowForDeviceInXlaLaunch(DeviceType(DEVICE_GPU));

      allowlist.insert(string(s));
    }
  }

  if (VLOG_IS_ON(2) && !allowlist.empty()) {
    std::vector<string> vallowlist(allowlist.begin(), allowlist.end());
    absl::c_sort(vallowlist);
    VLOG(2) << "XLA clustering will only consider the following TF operations: "
            << absl::StrJoin(vallowlist, " ");
  }
  return allowlist;
}