// See the License for the specific language governing permissions and
// limitations under the License.

package plugin

import (
	"fmt"
	"net/http"
	"net/http/httptest"
	"reflect"
	"testing"

	"github.com/containernetworking/cni/pkg/skel"
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"

	"istio.io/api/annotation"

	node := actual.(map[string]any)
	got, f, err := tpath.GetPathContext(node, util.PathFromString(pv.path), false)
	if err != nil || !f {
		return false, err
	}
	if reflect.TypeOf(got.Node).Kind() != reflect.String || reflect.TypeOf(pv.value).Kind() != reflect.String {
		return false, fmt.Errorf("comparison types must both be string: got %v(%T), want %v(%T)", got.Node, got.Node, pv.value, pv.value)
	}
	gotS := got.Node.(string)

  //
  // +optional
  // +listType=atomic
  repeated TokenRequest tokenRequests = 6;

  // requiresRepublish indicates the CSI driver wants `NodePublishVolume`
  // being periodically called to reflect any possible change in the mounted
  // volume. This field defaults to false.
  //
  // Note: After a successful initial NodePublishVolume call, subsequent calls

      nodeSelector:
        kubernetes.io/os: linux
      serviceAccountName: speaker
      terminationGracePeriodSeconds: 2
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/master
        operator: Exists
      - effect: NoSchedule
        key: node-role.kubernetes.io/control-plane
        operator: Exists
      volumes:
      - name: memberlist
        secret:

        sale, have made, import, and otherwise transfer either its Contributions
        or its Contributor Version.

2.2. Effective Date

     The licenses granted in Section 2.1 with respect to any Contribution become
     effective for each Contribution on the date the Contributor first distributes
     such Contribution.

2.3. Limitations on Grant Scope

  // +optional
  optional string value = 3;

  // Effect indicates the taint effect to match. Empty means match all taint effects.
  // When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
  // +optional
  optional string effect = 4;

  // TolerationSeconds represents the period of time the toleration (which must be
  // of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,

	ret := make(chan updateResponse, 1)
	req := updateRequest{
		Update: data,
		Fd:     fd,
		Resp:   ret,
	}
	select {
	case z.Updates <- req:
	case <-ctx.Done():
		return nil, ctx.Err()
	}

	select {
	case r := <-ret:
		return r.resp, r.err
	case <-ctx.Done():
		return nil, ctx.Err()
	}
}

  # These settings that determine how long an old Envoy
  # process should be kept alive after an occasional reload.
  drainDuration: 2s
  #
  # The mode used to redirect inbound connections to Envoy. This setting
  # has no effect on outbound traffic: iptables REDIRECT is always used for
  # outbound connections.
  # If "REDIRECT", use iptables REDIRECT to NAT and redirect to Envoy.
  # The "REDIRECT" mode loses source addresses during redirection.

  //
  // The data must consist only of PEM certificate blocks that parse as valid
  // X.509 certificates.  Each certificate must include a basic constraints
  // extension with the CA bit set.  The API server will reject objects that
  // contain duplicate certificates, or that use PEM block headers.
  //
  // Users of ClusterTrustBundles, including Kubelet, are free to reorder and

message TokenRequestSpec {
  // Audiences are the intendend audiences of the token. A recipient of a
  // token must identify themself with an identifier in the list of
  // audiences of the token, and otherwise should reject the token. A
  // token issued for multiple audiences may be used to authenticate
  // against any of the audiences listed but implies a high degree of
  // trust between the target audiences.
  repeated string audiences = 1;