java-version: 11
      - id: determine-sys-prop-args
        uses: actions/github-script@v7
        with:
          script: |
            if (context.payload.pull_request && context.payload.pull_request.head.repo.fork) {
                core.setOutput('sys-prop-args', '-DagreePublicBuildScanTermOfService=yes -DcacheNode=us')
            } else {
                core.setOutput('sys-prop-args', '-DcacheNode=us')
            }

    resources:
  {{ template "resources" . }}
    securityContext:
      allowPrivilegeEscalation: true
      capabilities:
        add:
        - SYS_ADMIN
        drop:
        - ALL
      privileged: true
      readOnlyRootFilesystem: false
      runAsGroup: 0
      runAsNonRoot: false
      runAsUser: 0
  {{ end }}
  {{ if not $nativeSidecar }}

    resources:
  {{ template "resources" . }}
    securityContext:
      allowPrivilegeEscalation: true
      capabilities:
        add:
        - SYS_ADMIN
        drop:
        - ALL
      privileged: true
      readOnlyRootFilesystem: false
      runAsGroup: 0
      runAsNonRoot: false
      runAsUser: 0
  {{ end }}
  {{ if not $nativeSidecar }}

      # Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
      # This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
      repairPods: true

      initContainerName: "istio-validation"

      brokenPodLabelKey: "cni.istio.io/uninitialized"
      brokenPodLabelValue: "true"

3-89b0-0a2f4af8362c"]],"distributionAlgo":"SIPMOD+PARITY"}} multisitea/data/disterasure/xl12/.minio.sys/tmp/5ad898e2-6621-448d-8a43-e5db08a0055c multisitea/data/disterasure/xl12/.minio.sys/tmp/.trash/.writable-check-3b45260e-10d3-49fa-93f0-af1103cccdd7.tmp multisitea/data/disterasure/xl12/.minio.sys/tmp/.trash/48d37e3b-c029-4237-bba7-316382d9c3d9/part.1 multisitea/data/disterasure/xl12/.minio.sys/config/history/38a3dbcb-a58f-4811-bf09-3bc6b7fbee05.kv/xl.meta XL2 Æ w Ä$•Ä Ó É ¸í80Ä yÅ Y Å Kƒ¤Type...

              - NET_RAW
              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open
              # network namespaces in `/proc` to obtain descriptors for entering pod netnamespaces.
              # There does not appear to be a more granular capability for this.
              - SYS_ADMIN
{{- if .Values.cni.seccompProfile }}
            seccompProfile:

          capabilities:
            drop:
            - ALL
            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
            - NET_ADMIN # Required for TPROXY and setsockopt
            - SYS_ADMIN # Required for `setns` - doing things in other netns
            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
          readOnlyRootFilesystem: true
          runAsGroup: 1337
          runAsNonRoot: false