owner := cred.AccessKey == globalActiveCred.AccessKey || (cred.ParentUser == globalActiveCred.AccessKey && cred.AccessKey != siteReplicatorSvcAcc)
	if owner && !globalAPIConfig.permitRootAccess() {
		// We disable root access and its service accounts if asked for.
		return cred, owner, ErrAccessKeyDisabled
	}

	if _, ok := claims[policy.SessionPolicyName]; ok {
		owner = false
	}

	return cred, owner, ErrNone
}

		JSONYamlPrintFlags:     genericclioptions.NewJSONYamlPrintFlags(),
		KubeTemplatePrintFlags: genericclioptions.NewKubeTemplatePrintFlags(),
		TextPrintFlags:         textPrintFlags,
	}

	// disable deprecated --template option
	pf.KubeTemplatePrintFlags.TemplateArgument = nil

	return pf
}

// Printer is a common printing interface in Kubeadm
type Printer interface {

	errDeleteReplicationMissing               = Errorf("Delete replication must be specified")
	errInvalidDeleteReplicationStatus         = Errorf("Delete replication is either enable|disable")
	errInvalidExistingObjectReplicationStatus = Errorf("Existing object replication status is invalid")
	errTagsDeleteMarkerReplicationDisallowed  = Errorf("Delete marker replication is not supported if any Tag filter is specified")

		t.Errorf("unexpected \"unexpected SPWRITE\" in traceback:\n%s", tb)
	}
}

func init() {
	if len(os.Args) >= 2 && os.Args[1] == "testPanicSystemstackInternal" {
		// Complete any in-flight GCs and disable future ones. We're going to
		// block goroutines on runtime locks, which aren't ever preemptible for the
		// GC to scan them.
		runtime.GC()
		debug.SetGCPercent(-1)

	// WDS does not suffer this limitation, so we could almost safely ignore these.
	// However, other code will merge "Partial push + Full push -> Full push", so skipping full pushes isn't viable.
	full := (isReq && w.Wildcard) || (!isReq && req.Full && len(req.ConfigsUpdated) == 0)

	// Nothing to do
	if len(addresses) == 0 && !full {
		if isReq {