// Append our rules here
	builder := cfg.appendHostRules(hostSNATIP, hostSNATIPV6)

	log.Info("Adding host netnamespace iptables rules")

	if err := cfg.executeCommands(builder); err != nil {
		log.Errorf("failed to add host netnamespace iptables rules: %v", err)
		return err
	}
	return nil
}

        assertTrue(roleSet.contains("role2"));

        encrypted = false;
        value = "role1,role2,role3";
        roleSet = decodedRoleList(roleQueryHelperImpl, value, encrypted);
        assertEquals(3, roleSet.size());
        assertTrue(roleSet.contains("role1"));
        assertTrue(roleSet.contains("role2"));
        assertTrue(roleSet.contains("role3"));
    }

for existing object replication are detected when scanner runs, and will be replicated if existing object replication is enabled and applicable replication rules are satisfied. Because replication depends on the immutability of versions, only pre-existing objects created while versioning was enabled can be replicated. Even if replication rules are disabled and re-enabled later, the objects created during the interim will be synced as the scanner queues them. For saving iops, objects qualifying for...

		rcfg:         replicationConfig{Config: &configs[0]},
		expectedSync: false,
	},
	{ // 4. existing object replication enabled, versioning enabled; no reset in progress
		name: "existing object replication enabled, versioning enabled; no reset in progress",
		info: ObjectInfo{
			Size:              100,
			ReplicationStatus: replication.Completed,
			VersionID:         "a3348c34-c352-4498-82f0-1098e8b34df9",
		},

        }

        if (defaultRoleList != null) {
            roleSet.addAll(defaultRoleList);
        }

        if (logger.isDebugEnabled()) {
            logger.debug("roleSet: {}", roleSet);
        }

        if (request != null) {
            request.setAttribute(USER_ROLES, roleSet);
        }
        return roleSet;
    }

  optional JobSpec spec = 2;
}

// PodFailurePolicy describes how failed pods influence the backoffLimit.
message PodFailurePolicy {
  // A list of pod failure policy rules. The rules are evaluated in order.
  // Once a rule matches a Pod failure, the remaining of the rules are ignored.
  // When no rule matches the Pod failure, the default handling applies - the
  // counter of pod failures is incremented and it is checked against

        if (queryContext.roleQueryEnabled()) {
            final Set<String> roleSet = ComponentUtil.getRoleQueryHelper().build(searchRequestType);
            if (!roleSet.isEmpty()) {
                queryContext.addQuery(boolQuery -> buildRoleQuery(roleSet, boolQuery));
            }
        }
    }

    public void buildRoleQuery(final Set<String> roleSet, final BoolQueryBuilder boolQuery) {

            final Set<String> roleSet = ComponentUtil.getRoleQueryHelper().build(SearchRequestType.JSON); // TODO SearchRequestType?
            final QueryHelper queryHelper = ComponentUtil.getQueryHelper();
            if (!roleSet.isEmpty()) {
                queryHelper.buildRoleQuery(roleSet, boolQuery);
            }
            builder.setQuery(boolQuery);

	}

	sys.Lock()
	sys.initialized = true
	sys.Unlock()

	if globalIsDistErasure {
		go sys.refreshBucketsMetadataLoop(ctx, failedBuckets)
	}
}

// Reset the state of the BucketMetadataSys.
func (sys *BucketMetadataSys) Reset() {
	sys.Lock()
	for k := range sys.metadataMap {
		delete(sys.metadataMap, k)
	}
	sys.Unlock()
}

// NewBucketMetadataSys - creates new policy system.

                    .collect(Collectors.toList());
        }

        final List<Map<String, String>> itemList = new ArrayList<>();
        final Set<String> roleSet = ComponentUtil.getRoleQueryHelper().build(searchRequestType);
        if (roleSet.isEmpty()) {
            for (final LabelTypeItem item : labelList) {
                if (item.getPermissions().length == 0) {