capabilities:
            add:
            - NET_BIND_SERVICE
            drop:
            - ALL
          readOnlyRootFilesystem: true
      dnsPolicy: Default
      volumes:
        - name: config-volume
          configMap:
            name: coredns
            items:
            - key: Corefile
              path: Corefile
---
apiVersion: v1
kind: Service
metadata:

        volumeMounts:
        - mountPath: /run/xtables.lock
          name: xtables-lock
          readOnly: false
        - name: config-volume
          mountPath: /etc/coredns
        - name: kube-dns-config
          mountPath: /etc/kube-dns
      volumes:
      - name: xtables-lock
        hostPath:
          path: /run/xtables.lock
          type: FileOrCreate
      - name: kube-dns-config

          readOnly: true
      securityContext:
        runAsGroup: 1337
        runAsNonRoot: true
        runAsUser: 1337
      serviceAccountName: istio-ingressgateway-service-account
      volumes:
      - emptyDir: {}
        name: workload-socket
      - emptyDir: {}
        name: credential-socket
      - emptyDir: {}
        name: workload-certs
      - configMap:

				VolumeMounts: []v1.VolumeMount{
					{
						Name:      "ctb-volume",
						MountPath: "/var/run/ctb-volume",
					},
				},
			}},
			Volumes: []v1.Volume{
				{
					Name: "ctb-volume",
					VolumeSource: v1.VolumeSource{
						Projected: &v1.ProjectedVolumeSource{
							Sources: []v1.VolumeProjection{
								{

	// It is safe to query d.vol once and reuse the value.
	// Hard links are not allowed to reference files in other volumes.
	// Junctions and symbolic links can reference files and directories in other volumes,
	// but the reparse point should still live in the parent volume.
	var flags uint32
	err := windows.GetVolumeInformationByHandle(h, nil, 0, &d.vol, nil, &flags, nil, 0)
	if err != nil {

          name: custom-bootstrap-volume
        {{- end }}
        {{- end }}
{{- if $.IncludeExtAuthz }}
      - name: ext-authz
        image: {{ $.ImageHub }}/ext-authz:{{ $.ImageTag }}
        imagePullPolicy: {{ $.ImagePullPolicy }}
        ports:
        - containerPort: 8000
        - containerPort: 9000
{{- end }}
      volumes:
      - emptyDir: {}
        name: istio-data

		{`C:\foo\bar`, `C:\foo\`, `bar`},
		// if prefix is not s's prefix, return s
		{`C:\foo`, `C:\bar`, `C:\foo`},
		{`C:\foo`, `C:\foo\bar`, `C:\foo`},
		{`C:`, `C:\`, `C:`},
		// if volumes are different, return s
		{`C:`, ``, `C:`},
		{`C:\`, ``, `C:\`},
		{`C:\foo`, ``, `C:\foo`},
		{`C:\foo`, `\foo`, `C:\foo`},
		{`C:\foo`, `D:\foo`, `C:\foo`},

		//UNC path

		UID:               types.UID("a671734a-e8e5-11e4-8fde-42010af09327"),
		ResourceVersion:   "22",
		CreationTimestamp: parseTimeOrDie("2015-04-22T11:49:36Z"),
	},
	Spec: api.PodSpec{
		Volumes: []api.Volume{
			{
				Name: "varetcd",
				VolumeSource: api.VolumeSource{
					HostPath: &api.HostPathVolumeSource{
						Path: "/mnt/master-pd/var/etcd",
					},
				},
			},
		},

}

// newPod returns a new pod for the specified namespace
func newPod(namespace string) api.Pod {
	return api.Pod{
		ObjectMeta: metav1.ObjectMeta{Name: "123", Namespace: namespace},
		Spec: api.PodSpec{
			Volumes:    []api.Volume{{Name: "vol"}},
			Containers: []api.Container{{Name: "ctr", Image: "image"}},
		},
	}
}

// TestAdmissionNamespaceExists verifies pod is admitted only if namespace exists.

	return nil
}

type defaultFunc func(pod *api.Pod) error

// A static pod tried to use a ClusterTrustBundle projected volume source.
var ErrStaticPodTriedToUseClusterTrustBundle = errors.New("static pods may not use ClusterTrustBundle projected volume sources")

// tryDecodeSinglePod takes data and tries to extract valid Pod config information from it.