)

var nsLabelT1 = map[string]string{"team": "team1"}
var nsLabelT2 = map[string]string{"team": "team2"}
var namespaces = []runtime.Object{
	&v1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "subteam1.team1", Labels: nsLabelT1}},
	&v1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "subteam2.team1", Labels: nsLabelT1}},
	&v1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "subteam1.team2", Labels: nsLabelT2}},

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: ratings
  namespace: team2
spec:
  hosts:
  - ratings.team1.svc.cluster.local # shouldn't generate an error as this VirtualService doesn't conflict with VirtualService ratings.team1 due to exportTo setting
  - google.com # conflict with bar/ratings host `google.com` which export to all namespaces
  exportTo:
  - "."
  gateways:
  - istio-ingressgateway
  - mesh

			},
			claims: fmt.Sprintf(`{
				"iss": "https://auth.example.com",
				"aud": "my-client",
				"username": "jane",
				"groups": ["team1", "team2"],
				"exp": %d
			}`, valid.Unix()),
			want: &user.DefaultInfo{
				Name:   "jane",
				Groups: []string{"team1", "team2"},
			},
		},
		{
			name: "groups-distributed",
			options: Options{
				JWTAuthenticator: apiserver.JWTAuthenticator{

								{
									Key:      "team",
									Operator: metav1.LabelSelectorOpIn,
									Values:   []string{"team1"},
								},
							},
						},
						TopologyKey: "region",
					},
				}, nil),
			pods: []*v1.Pod{{Spec: v1.PodSpec{NodeName: "node1"}, ObjectMeta: metav1.ObjectMeta{Namespace: "subteam1.team1", Labels: podLabel}}},
			node: &node1,
		},
		{

	if err := DB.Model(&user2).Association("Team").Append(&teams); err != nil {
		t.Fatalf("Error happened when append team, got %v", err)
	}

	for _, team := range teams {
		team := team
		if team.ID == 0 {
			t.Fatalf("Team's ID should be created")
		}

		user.Team = append(user.Team, team)
	}

	CheckUser(t, user2, user)

		*GetUser("slice-many2many-1", Config{Team: 2}),
		*GetUser("slice-many2many-2", Config{Team: 0}),
		*GetUser("slice-many2many-3", Config{Team: 4}),
	}

	DB.Create(&users)

	// Count
	AssertAssociationCount(t, users, "Team", 6, "")

	// Find
	var teams []User
	if DB.Model(&users).Association("Team").Find(&teams); len(teams) != 6 {
		t.Errorf("teams count should be %v, but got %v", 6, len(teams))
	}

name: 'Requeue stale team-triage items'
on:
  schedule:
    # Execute every day at 00:05 to avoid conflicts with other workflows
    - cron: '5 0 * * *'

permissions: {}

jobs:
  requeue:
    permissions:
      issues: write
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/stale@v9
        with:
          operations-per-run: 50
          remove-stale-when-updated: false

ADRs can be written by any team.
Like code, they should be reviewed by any other relevant teams.
The goal is not to *own* a decision, but to *share* it with other teams, and improve the build tool together.

### Format

The format for ADR should follow this template:

```markdown
# ADR-000X - Title

## Date

20YY-MM-DD

## Context

Maintainer: TensorFlow DevInfra

Issue Reporting: File an issue against this repo and tag
[@devinfra](https://github.com/orgs/tensorflow/teams/devinfra)

********************************************************************************

A directory for build and CI related scripts and jobs managed by the TensorFlow

- Better security: separate Istio components reside in different namespaces, allowing different teams or
roles to manage different parts of Istio. For example, a security team would maintain the
root CA and policy, a telemetry team may only have access to Prometheus,
and a different team may maintain the control plane components (which are highly security sensitive).