java-version: 11
      - id: determine-sys-prop-args
        uses: actions/github-script@v7
        with:
          script: |
            if (context.payload.pull_request && context.payload.pull_request.head.repo.fork) {
                core.setOutput('sys-prop-args', '-DagreePublicBuildScanTermOfService=yes -DcacheNode=us')
            } else {
                core.setOutput('sys-prop-args', '-DcacheNode=us')
            }

    resources:
  {{ template "resources" . }}
    securityContext:
      allowPrivilegeEscalation: true
      capabilities:
        add:
        - SYS_ADMIN
        drop:
        - ALL
      privileged: true
      readOnlyRootFilesystem: false
      runAsGroup: 0
      runAsNonRoot: false
      runAsUser: 0
  {{ end }}
  {{ if not $nativeSidecar }}

    resources:
  {{ template "resources" . }}
    securityContext:
      allowPrivilegeEscalation: true
      capabilities:
        add:
        - SYS_ADMIN
        drop:
        - ALL
      privileged: true
      readOnlyRootFilesystem: false
      runAsGroup: 0
      runAsNonRoot: false
      runAsUser: 0
  {{ end }}
  {{ if not $nativeSidecar }}

3-89b0-0a2f4af8362c"]],"distributionAlgo":"SIPMOD+PARITY"}} multisitea/data/disterasure/xl12/.minio.sys/tmp/5ad898e2-6621-448d-8a43-e5db08a0055c multisitea/data/disterasure/xl12/.minio.sys/tmp/.trash/.writable-check-3b45260e-10d3-49fa-93f0-af1103cccdd7.tmp multisitea/data/disterasure/xl12/.minio.sys/tmp/.trash/48d37e3b-c029-4237-bba7-316382d9c3d9/part.1 multisitea/data/disterasure/xl12/.minio.sys/config/history/38a3dbcb-a58f-4811-bf09-3bc6b7fbee05.kv/xl.meta XL2 Æ w Ä$•Ä Ó É ¸í80Ä yÅ Y Å Kƒ¤Type...

+    char ut_host[UT_HOSTSIZE]
+      __attribute_nonstring__;	/* Hostname for remote login.  */
     long int ut_time;
   };
 
diff --git a/misc/sys/cdefs.h b/misc/sys/cdefs.h
index 30482a1..551d5fd 100644
--- a/misc/sys/cdefs.h
+++ b/misc/sys/cdefs.h
@@ -391,6 +391,15 @@
 
 #include <bits/wordsize.h>
 
+#if __GNUC_PREREQ (8, 0)
+/* Describes a char array whose address can safely be passed as the first

 /* POSIX 2008 makes locale_t official.  */
 typedef __locale_t locale_t;
 
+#endif /* bits/types/__locale_t.h */
+
 #endif /* xlocale.h */
diff --git a/misc/sys/cdefs.h b/misc/sys/cdefs.h
index d1cb3dd..30482a1 100644
--- a/misc/sys/cdefs.h
+++ b/misc/sys/cdefs.h
@@ -423,4 +423,14 @@
 # endif
 #endif
 
+/* Undefine (also defined in libc-symbols.h).  */
+#undef __attribute_copy__
+#if __GNUC_PREREQ (9, 0)

              - NET_RAW
              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
              # network namespaces in `/proc` to obtain descriptors for entering pod netnamespaces.
              # There does not appear to be a more granular capability for this.
              - SYS_ADMIN
{{- if .Values.cni.seccompProfile }}
            seccompProfile:

          capabilities:
            drop:
            - ALL
            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
            - NET_ADMIN # Required for TPROXY and setsockopt
            - SYS_ADMIN # Required for `setns` - doing things in other netns
            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
          readOnlyRootFilesystem: true
          runAsGroup: 1337
          runAsNonRoot: false

"expr": "process_resident_memory_bytes{app=\"istiod\"}", "format": "time_series", "intervalFactor": 2, "legendFormat": "Resident Memory", "refId": "H", "step": 2 }, { "expr": "go_memstats_heap_sys_bytes{app=\"istiod\"}", "format": "time_series", "hide": true, "intervalFactor": 2, "legendFormat": "heap sys", "refId": "A" }, { "expr": "go_memstats_heap_alloc_bytes{app=\"istiod\"}", "format": "time_series", "hide": true, "intervalFactor": 2, "legendFormat": "heap alloc", "refId": "D" }, { "expr": "...

      # For example:
      # podAntiAffinityLabelSelector:
      # - key: security
      #   operator: In
      #   values: S1,S2
      #   topologyKey: "kubernetes.io/hostname"
      # This pod anti-affinity rule says that the pod requires not to be scheduled
      # onto a node if that node is already running a pod with label having key
      # "security" and value "S1".
      podAntiAffinityLabelSelector: []