expiry:    *jwt.NewNumericDate(now().Add(-1_000 * time.Hour)),
			expectErr: "service account token has expired",
		},
		{
			name:      "not yet valid",
			getter:    fakeGetter{serviceAccount, nil, nil, nil},
			private:   &privateClaims{Kubernetes: kubernetes{Svcacct: ref{Name: "saname", UID: "sauid"}, Namespace: "ns"}},
			notBefore: *jwt.NewNumericDate(now().Add(1_000 * time.Hour)),
			expectErr: "service account token is not valid yet",

						},
						{
							Ready:                true,
							RestartCount:         3,
							State:                api.ContainerState{Running: &api.ContainerStateRunning{}},
							LastTerminationState: api.ContainerState{Terminated: &api.ContainerStateTerminated{FinishedAt: metav1.NewTime(time.Now().Add(-20 * 24 * time.Hour))}},
						},
					},
				},
			},

class DefaultCachePolicySpec extends Specification {
    private static final long SECOND = 1000;
    private static final long MINUTE = SECOND * 60;
    private static final long HOUR = MINUTE * 60;
    private static final long DAY = HOUR * 24;
    private static final long WEEK = DAY * 7;
    private static final long FOREVER = Long.MAX_VALUE

    DefaultCachePolicy cachePolicy = new DefaultCachePolicy()

          "interval": "1m",
          "intervalFactor": 2,
          "legendFormat": "Last Hour Failed Size [{{bucket}}]",
          "refId": "A"
        }
      ],
      "title": "Last Hour Failed Size",
      "type": "timeseries"
    },
    {
      "datasource": {
        "type": "prometheus",
        "uid": "${DS_PROMETHEUS}"

labels.searchlog_log_type_search_zeroclick=Zero Clicks
labels.searchlog_log_type_search_count_hour=Keyword by Hour
labels.searchlog_log_type_search_count_day=Keyword by Day
labels.searchlog_log_type_search_user_hour=User by Hour
labels.searchlog_log_type_search_user_day=User by Day
labels.searchlog_log_type_search_reqtimeavg_hour=Request Time Avg. by Hour
labels.searchlog_log_type_search_reqtimeavg_day=Request Time Avg. by Day

			workqueue.TypedRateLimitingQueueConfig[string]{Name: "RequestHeaderAuthRequestController"},
		),
	}

	// we construct our own informer because we need such a small subset of the information available.  Just one namespace.
	c.configmapInformer = coreinformers.NewFilteredConfigMapInformer(client, c.configmapNamespace, 12*time.Hour, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, func(listOptions *metav1.ListOptions) {

	trustDomainEnv = env.Register("TRUST_DOMAIN", "cluster.local",
		"The trust domain for spiffe certificates").Get()

	secretTTLEnv = env.Register("SECRET_TTL", 24*time.Hour,
		"The cert lifetime requested by istio agent").Get()

	fileDebounceDuration = env.Register("FILE_DEBOUNCE_DURATION", 100*time.Millisecond,

					CertDirectory: "/var/run/kubernetes",
					PairName:      "apiserver",
				},
				HTTP2MaxStreamsPerConnection: 42,
				Required:                     true,
			}).WithLoopback(),
			EventTTL: 1 * time.Hour,
			Audit: &apiserveroptions.AuditOptions{
				LogOptions: apiserveroptions.AuditLogOptions{
					Path:       "/var/log",
					MaxAge:     11,
					MaxBackups: 12,
					MaxSize:    13,
					Format:     "json",

		obj.OOMScoreAdj = utilpointer.Int32(int32(qos.KubeletOOMScoreAdj))
	}
	if obj.StreamingConnectionIdleTimeout == zeroDuration {
		obj.StreamingConnectionIdleTimeout = metav1.Duration{Duration: 4 * time.Hour}
	}
	if obj.NodeStatusReportFrequency == zeroDuration {
		// For backward compatibility, NodeStatusReportFrequency's default value is
		// set to NodeStatusUpdateFrequency if NodeStatusUpdateFrequency is set

	// CertificateValidityPeriod defines the validity period for all the signed certificates generated by kubeadm
	CertificateValidityPeriod = time.Hour * 24 * 365
	// CACertificateValidityPeriod defines the validity period for all the signed CA certificates generated by kubeadm
	CACertificateValidityPeriod = time.Hour * 24 * 365 * 10

	// DefaultCertificateDir defines default certificate directory
	DefaultCertificateDir = "pki"