case "${action}" in
    LOG)
      action="LOG --log-prefix "${prefix}:" --log-uid --log-tcp-options --log-ip-option"
      ;;
  esac

  # Deliberately allow word split here
  # shellcheck disable=SC2086
  iptables -w ${command} OUTPUT -p tcp --dport 80 -d ${METADATA_SERVER_IP} -m owner ${invert:-} --uid-owner=${METADATA_SERVER_ALLOWED_UID_RANGE:-0-2999} -j ${action}
}

// cannot. "pod" is new pod, while "pods" are all admitted pods
// The function returns a boolean value indicating whether the pod
// can be admitted, a brief single-word reason and a message explaining why
// the pod cannot be admitted.
func (kl *Kubelet) canAdmitPod(pods []*v1.Pod, pod *v1.Pod) (bool, string, string) {
	// the kubelet will invoke each pod admit handler in sequence

(Phi (Const64 [c]) (Const64 [c])) => (Const64 [c])

// slice and interface comparisons
// The frontend ensures that we can only compare against nil,
// so we need only compare the first word (interface type or slice ptr).
(EqInter x y)  => (EqPtr  (ITab x) (ITab y))
(NeqInter x y) => (NeqPtr (ITab x) (ITab y))
(EqSlice x y)  => (EqPtr  (SlicePtr x) (SlicePtr y))
(NeqSlice x y) => (NeqPtr (SlicePtr x) (SlicePtr y))

// should use a negation:
//
//	//go:build !amd64.v2
//
// To keep a file from being considered for any build:
//
//	//go:build ignore
//
// (Any other unsatisfied word will work as well, but "ignore" is conventional.)
//
// To build a file only when using cgo, and only on Linux and OS X:
//
//	//go:build cgo && (linux || darwin)
//

	{AUNPCKLPS, yxm, Pm, opBytes{0x14}},
	{AUMONITOR, ywrfsbase, Pf3, opBytes{0xae, 06}},
	{AVERR, ydivl, Pm, opBytes{0x00, 04}},
	{AVERW, ydivl, Pm, opBytes{0x00, 05}},
	{AWAIT, ynone, Px, opBytes{0x9b}},
	{AWORD, ybyte, Px, opBytes{2}},
	{AXCHGB, yml_mb, Pb, opBytes{0x86, 0x86}},
	{AXCHGL, yxchg, Px, opBytes{0x90, 0x90, 0x87, 0x87}},
	{AXCHGQ, yxchg, Pw, opBytes{0x90, 0x90, 0x87, 0x87}},