// in-cluster-config for pod clients
	if !kubetypes.IsStaticPod(pod) && !kl.serviceHasSynced() {
		return nil, fmt.Errorf("services have not yet been read at least once, cannot construct envvars")
	}

	var result []kubecontainer.EnvVar
	// Note:  These are added to the docker Config, but are not included in the checksum computed

    public static final String LABELS_APPEND_QUERY_PARAMETER = "{labels.appendQueryParameter}";

    /** The key of the message: Config ID */
    public static final String LABELS_CONFIG_ID = "{labels.configId}";

    /** The key of the message: Config Parameters */
    public static final String LABELS_CONFIG_PARAMETER = "{labels.configParameter}";

    /** The key of the message: Content */

* Removed comments in json config when using kubectl edit with -o json ([#31685](https://github.com/kubernetes/kubernetes/pull/31685), [@jellonek](https://github.com/jellonek))

	if err := srv.setupHTTP2_ServeTLS(); err != nil {
		return err
	}

	config := cloneTLSConfig(srv.TLSConfig)
	if !slices.Contains(config.NextProtos, "http/1.1") {
		config.NextProtos = append(config.NextProtos, "http/1.1")
	}

	configHasCert := len(config.Certificates) > 0 || config.GetCertificate != nil || config.GetConfigForClient != nil
	if !configHasCert || certFile != "" || keyFile != "" {
		var err error

	"k8s.io/klog/v2/ktesting"
	"k8s.io/kubernetes/pkg/features"
	kubeletconfiginternal "k8s.io/kubernetes/pkg/kubelet/apis/config"
	cadvisortest "k8s.io/kubernetes/pkg/kubelet/cadvisor/testing"
	"k8s.io/kubernetes/pkg/kubelet/clustertrustbundle"
	"k8s.io/kubernetes/pkg/kubelet/cm"
	"k8s.io/kubernetes/pkg/kubelet/config"
	"k8s.io/kubernetes/pkg/kubelet/configmap"
	kubecontainer "k8s.io/kubernetes/pkg/kubelet/container"

istiod release: {{ .Release.Name }} rules: # permissions to verify the webhook is ready and rejecting # invalid config. We use --server-dry-run so no config is persisted. - apiGroups: ["networking.istio.io"] verbs: ["create"] resources: ["gateways"] # For storing CA secret - apiGroups: [""] resources: ["secrets"] # TODO lock this down to istio-ca-cert if not using the DNS cert mesh config verbs: ["create", "get", "watch", "list", "update", "delete"] # For status controller, so it can delete the distribution...

	}
}

// testServerAndClientConfig returns a server that listens and a config that can reference it
func testServerAndClientConfig(handler func(http.ResponseWriter, *http.Request)) (*httptest.Server, *restclient.Config) {
	srv := httptest.NewServer(http.HandlerFunc(handler))
	config := &restclient.Config{
		Host: srv.URL,
	}
	return srv, config
}

type garbageCollector struct {
	*GarbageCollector

    * Added --config-map and --config-map-namespace command line options.
    * If --config-map is set, kube-dns will load dynamic configuration from the config map
      referenced by --config-map-namespace, --config-map. The config-map supports
      the following properties: "federations".
    * --federations flag is now deprecated. Prefer to set federations via the config-map.

	return l.client.CoreV1().Nodes().Get(context.Background(), name, metav1.GetOptions{})
}

func (l delegatingNodeLister) List(selector labels.Selector) (ret []*v1.Node, err error) {
	opts := metav1.ListOptions{}
	if selector != nil {
		opts.LabelSelector = selector.String()
	}
	nodeList, err := l.client.CoreV1().Nodes().List(context.Background(), opts)
	if err != nil {

		t.Run(tt.name, func(t *testing.T) {
			_, ctx := ktesting.NewTestContext(t)
			ctx, cancel := context.WithCancel(ctx)
			defer cancel()
			args := &config.PodTopologySpreadArgs{
				DefaultConstraints: tt.defaultConstraints,
				DefaultingType:     config.ListDefaulting,
			}

			p := plugintesting.SetupPluginWithInformers(ctx, t, topologySpreadFunc, args, cache.NewSnapshot(tt.existingPods, tt.nodes), tt.objs)