# shellcheck disable=SC2086
  iptables -w ${command} OUTPUT -p tcp --dport 80 -d ${METADATA_SERVER_IP} -m owner ${invert:-} --uid-owner=${METADATA_SERVER_ALLOWED_UID_RANGE:-0-2999} -j ${action}
}

# WARNING: DO NOT USE THE FILTER TABLE! Some implementations of network policy
# think they own it and will stomp all over your changes. At this time, the
# mangle table is less contentious so use that if possible.

* Added rkt binary to GCI ([#35321](https://github.com/kubernetes/kubernetes/pull/35321), [@vishh](https://github.com/vishh))
* Fixed mutation warning in Attach/Detach controller ([#35273](https://github.com/kubernetes/kubernetes/pull/35273), [@jsafrane](https://github.com/jsafrane))

            assert self.version, "A version must be provided for OpenAPI, e.g.: '2.1.0'"
        # TODO: remove when discarding the openapi_prefix parameter
        if openapi_prefix:
            logger.warning(
                '"openapi_prefix" has been deprecated in favor of "root_path", which '
                "follows more closely the ASGI standard, is simpler, and more "
                "automatic. Check the docs at "

	testKubelet.kubelet.recorder = fakeRecorder
	testKubelet.kubelet.secretManager = secret.NewFakeManagerWithSecrets(secrets)
	defer testKubelet.Cleanup()

	expectedEvent := "Warning FailedToRetrieveImagePullSecret Unable to retrieve some image pull secrets (secretFoo); attempting to pull the image may not succeed."

	testPod := &v1.Pod{
		ObjectMeta: metav1.ObjectMeta{
			Namespace:   "nsFoo",

//		Comma-separated list of toolchain experiments to enable or disable.
//		The list of available experiments may change arbitrarily over time.
//		See src/internal/goexperiment/flags.go for currently valid values.
//		Warning: This variable is provided for the development and testing
//		of the Go toolchain itself. Use beyond that purpose is unsupported.
//	GO_EXTLINK_ENABLED
//		Whether the linker should use external linking mode

			return
		}
		defer c.Close()
		if _, err := c.Write([]byte(wantBody)); err != nil {
			t.Errorf("Write to hijacked body: %v", err)
		}
	}), func(ts *httptest.Server) {
		// Don't spam log with warning about superfluous WriteHeader call.
		ts.Config.ErrorLog = log.New(tlogWriter{t}, "log: ", 0)
	}).ts

	conn, err := net.Dial("tcp", ts.Listener.Addr().String())
	if err != nil {
		t.Fatalf("net.Dial: %v", err)

and there stood the Queen in front of them, with her arms folded,
frowning like a thunderstorm.

  `A fine day, your Majesty!' the Duchess began in a low, weak
voice.

  `Now, I give you fair warning,' shouted the Queen, stamping on
the ground as she spoke; `either you or your head must be off,
and that in about half no time!  Take your choice!'

  The Duchess took her choice, and was gone in a moment.

and there stood the Queen in front of them, with her arms folded,
frowning like a thunderstorm.

  `A fine day, your Majesty!' the Duchess began in a low, weak
voice.

  `Now, I give you fair warning,' shouted the Queen, stamping on
the ground as she spoke; `either you or your head must be off,
and that in about half no time!  Take your choice!'

  The Duchess took her choice, and was gone in a moment.