<organization>ASF</organization>
      <roles>
        <role>PMC Chair</role>
      </roles>
      <timezone>-5</timezone>
    </developer>
    <developer>
      <id>brett</id>
      <name>Brett Porter</name>
      <email>******@****.***</email>
      <organization>ASF</organization>
      <roles>
        <role>PMC Member</role>
      </roles>
      <timezone>+10</timezone>
    </developer>

iptables -t nat -N ISTIO_POSTRT
iptables -t nat -A POSTROUTING -j ISTIO_POSTRT

    {!> ../../../docs_src/request_files/tutorial001.py!}
    ```

Using `UploadFile` has several advantages over `bytes`:

* You don't have to use `File()` in the default value of the parameter.
* It uses a "spooled" file:
    * A file stored in memory up to a maximum size limit, and after passing this limit it will be stored in disk.

  // It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
  // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
  // +optional
  optional string evaluationError = 3;
}

// SubjectRulesReviewStatus contains the result of a rules check. This check can be incomplete depending on

        the already-constructed model instead.
    *   Code that requires very tricky shape manipulation via converted op
        layers in order to work, where the Keras symbolic shape inference proves
        insufficient.
    *   Code that tries manually walking a `tf.keras.Model` layer by layer and
        assumes layers only ever have one positional argument. This assumption

  <developers>
    <developer>
      <id>morgand</id>
      <name>Morgan Delagrange</name>
      <email>morgand at apache dot org</email>
      <organization>Apache</organization>
      <roles>
        <role>Java Developer</role>
      </roles>
    </developer>
    <developer>
      <id>rwaldhoff</id>
      <name>Rodney Waldhoff</name>
      <email>rwaldhoff at apache org</email>

apps may target different 'environments' which contain different instances and variants of Istio.

- Better security: separate Istio components reside in different namespaces, allowing different teams or
roles to manage different parts of Istio. For example, a security team would maintain the
root CA and policy, a telemetry team may only have access to Prometheus,

iptables -t nat -A ISTIO_POSTRT -m owner --socket-exists -p tcp -m set --match-set istio-inpod-probes-v4 dst -j SNAT --to-source 169.254.7.127
ip6tables -t nat -N ISTIO_POSTRT
ip6tables -t nat -A POSTROUTING -j ISTIO_POSTRT

不过，很多情况下，`UploadFile` 更好用。

## 含 `UploadFile` 的文件参数

定义文件参数时使用 `UploadFile`：

```Python hl_lines="12"
{!../../../docs_src/request_files/tutorial001.py!}
```

`UploadFile` 与 `bytes` 相比有更多优势：

* 使用 `spooled` 文件：
    * 存储在内存的文件超出最大上限时，FastAPI 会把文件存入磁盘；
* 这种方式更适于处理图像、视频、二进制文件等大型文件，好处是不会占用所有内存；
* 可获取上传文件的元数据；

  repeated RoleBinding items = 2;
}

// RoleList is a collection of Roles.
// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleList, and will no longer be served in v1.22.
message RoleList {
  // Standard object's metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is a list of Roles
  repeated Role items = 2;
}