# Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
      labelPods: false
      # deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
      # Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
      deletePods: false

kind: feature
area: documentation
docs:
- 'https://istio.io/latest/docs/setup/platform-setup/openshift/'
releaseNotes:
- |

kind: feature
area: installation
docs:
- 'https://istio.io/latest/docs/setup/platform-setup/openshift/'
releaseNotes:
- |

		Patch(
			context.Background(),
			pod.Name,
			types.MergePatchType,
			annotationPatch,
			metav1.PatchOptions{},
			// Both "pods" and "pods/status" can mutate the metadata. However, pods/status is lower privilege, so we use that instead.
			"status",
		)
	return err
}

func AnnotateUnenrollPod(client kubernetes.Interface, pod *metav1.ObjectMeta) error {

	// setuid binaries from executing because of the missing g+rx, so we need to set the parent
	// directory to better permissions before anything else. We created this directory, so we
	// shouldn't need to do any privilege trickery.
	if err := privesc("chmod", "0777", filepath.Dir(bin)); err != nil {
		t.Skipf("unable to set permissions on %q, likely no passwordless sudo/su: %s", filepath.Dir(bin), err)
	}

	"istio.io/istio/pkg/env"
	"istio.io/istio/pkg/log"
)

var TraceLoggingEnabled = env.Register(
	"IPTABLES_TRACE_LOGGING",
	false,
	"When enable, all iptables actions will be logged. "+
		"This requires NET_ADMIN privilege and has noisy logs; as a result, this is intended for debugging only").Get()

var iptablesTrace = log.RegisterScope("iptables", "trace logs for iptables")

// ReadNFLOGSocket reads from the nflog socket, sending output to logs.

See the License for the specific language governing permissions and
limitations under the License.
*/

// Package policybased implements a standard storage for Role that prevents privilege escalation.
package policybased

import (
	"context"

	"k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"

See the License for the specific language governing permissions and
limitations under the License.
*/

// Package policybased implements a standard storage for RoleBinding that prevents privilege escalation.
package policybased

import (
	"context"

	rbacv1 "k8s.io/api/rbac/v1"
	"k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"

 * This class ensures that at most one thread is running at a time. This is initially the JUnit test
 * thread, which yields its execution privilege while calling [runTasks], [runNextTask], or
 * [advanceUntil]. These functions don't return until the task threads are all idle.
 *
 * Task threads release their execution privilege in these ways:
 *
 *  * By yielding in [TaskRunner.Backend.coordinatorWait].
 *  * By yielding in [BlockingQueue.poll].

See the License for the specific language governing permissions and
limitations under the License.
*/

// Package policybased implements a standard storage for ClusterRole that prevents privilege escalation.
package policybased

import (
	"context"
	"errors"

	apierrors "k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"