success: true,
		},
		{
			name: "hostUsers is nil",
			pod: &v1.Pod{
				Spec: v1.PodSpec{
					HostUsers: nil,
				},
			},
			success: true,
		},
		{
			name: "hostUsers is true",
			pod: &v1.Pod{
				Spec: v1.PodSpec{
					HostUsers: &trueVal,
				},
			},
		},
		{
			name: "hostUsers is false",
			pod: &v1.Pod{
				Spec: v1.PodSpec{
					HostUsers: &falseVal,
				},
			},
		},
	}

	}
	if *pod.Spec.HostUsers {
		return &runtimeapi.UserNamespace{
			Mode: runtimeapi.NamespaceMode_NODE,
		}, nil
	}

	// From here onwards, hostUsers=false and the feature gate is enabled.

	// if the pod requested a user namespace and the runtime doesn't support user namespaces then return an error.

		},
		{
			name: "opt-in to host user namespace",
			pod: &v1.Pod{
				Spec: v1.PodSpec{
					HostUsers: &trueVal,
				},
			},
			expMode: runtimeapi.NamespaceMode_NODE,
			success: true,
		},
		{
			name: "user namespace",
			pod: &v1.Pod{
				Spec: v1.PodSpec{
					HostUsers: &falseVal,
				},
			},
			expMode:       runtimeapi.NamespaceMode_POD,
			runtimeUserns: true,

	return b
}

// WithHostUsers sets the HostUsers field in the declarative configuration to the given value
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
// If called multiple times, the HostUsers field is set to the value of the last call.
func (b *PodSpecApplyConfiguration) WithHostUsers(value bool) *PodSpecApplyConfiguration {
	b.HostUsers = &value
	return b
}

		out.HostNetwork = in.SecurityContext.HostNetwork
		out.HostIPC = in.SecurityContext.HostIPC
		out.ShareProcessNamespace = in.SecurityContext.ShareProcessNamespace
		out.HostUsers = in.SecurityContext.HostUsers
	}

	return nil
}

func Convert_core_NodeSpec_To_v1_NodeSpec(in *core.NodeSpec, out *v1.NodeSpec, s conversion.Scope) error {

	// If the feature is disabled and not in use, drop the hostUsers field.
	if !utilfeature.DefaultFeatureGate.Enabled(features.UserNamespacesSupport) && !hostUsersInUse(oldPodSpec) {
		// Drop the field in podSpec only if SecurityContext is not nil.
		// If it is nil, there is no need to set hostUsers=nil (it will be nil too).
		if podSpec.SecurityContext != nil {
			podSpec.SecurityContext.HostUsers = nil
		}
	}

		pod          func() *api.Pod
	}{
		{
			description:  "with hostUsers=true",
			hasHostUsers: true,
			pod:          podWithHostUsersTrue,
		},
		{
			description:  "with hostUsers=false",
			hasHostUsers: true,
			pod:          podWithHostUsersFalse,
		},
		{
			description: "with hostUsers=nil",
			pod:         func() *api.Pod { return nil },
		},
	}

		gracePeriod = *spec.TerminationGracePeriodSeconds
	}

	// The default for hostUsers is true, so a spec with no SecurityContext or no HostUsers field will be true.
	// If the default ever changes, this condition will need to be changed.
	hostUsers := spec.SecurityContext == nil || spec.SecurityContext.HostUsers == nil || *spec.SecurityContext.HostUsers

	vols, vErrs := ValidateVolumes(spec.Volumes, podMeta, fldPath.Child("volumes"), opts)

              "matchLabelKeysValue"
            ]
          }
        ],
        "setHostnameAsFQDN": true,
        "os": {
          "name": "nameValue"
        },
        "hostUsers": true,
        "schedulingGates": [
          {
            "name": "nameValue"
          }
        ],
        "resourceClaims": [
          {
            "name": "nameValue",

              "matchLabelKeysValue"
            ]
          }
        ],
        "setHostnameAsFQDN": true,
        "os": {
          "name": "nameValue"
        },
        "hostUsers": true,
        "schedulingGates": [
          {
            "name": "nameValue"
          }
        ],
        "resourceClaims": [
          {
            "name": "nameValue",