// init container termination message and exit code.
	SidecarAnnotation  string
	InitContainerName  string
	InitTerminationMsg string
	InitExitCode       int

	// Label and field selectors to select pods managed by race repair.
	LabelSelectors string
	FieldSelectors string
}

func (c InstallConfig) String() string {
	var b strings.Builder
	b.WriteString("CNINetDir: " + c.CNINetDir + "\n")

		Description:    "Other expressions are not allowed in the SELECT list when '*' is used without dot notation in the SQL expression.",
		HTTPStatusCode: http.StatusBadRequest,
	},
	ErrParseCannotMixSqbAndWildcardInSelectList: {
		Code:           "ParseCannotMixSqbAndWildcardInSelectList",
		Description:    "Cannot mix [] and * in the same expression in a SELECT list in SQL expression.",
		HTTPStatusCode: http.StatusBadRequest,
	},

		}
	}()
	// Should panic
	_, _, _ = Select(sCases)
}

func TestSelectNop(t *testing.T) {
	// "select { default: }" should always return the default case.
	chosen, _, _ := Select([]SelectCase{{Dir: SelectDefault}})
	if chosen != 0 {
		t.Fatalf("expected Select to return 0, but got %#v", chosen)
	}
}

	nodeSelectorsForServices map[host.Name]labels.Instance
	// map of node name and its address+labels - this is the only thing we need from nodes
	// for vm to k8s or cross cluster. When node port services select specific nodes by labels,
	// we run through the label selectors here to pick only ones that we need.
	// Only nodes with ExternalIP addresses are included in this map !
	nodeInfoMap map[string]kubernetesNode

<img src="/img/tutorial/security/image11.png">

If you don't select any scope, you will be "authenticated", but when you try to access `/users/me/` or `/users/me/items/` you will get an error saying that you don't have enough permissions. You will still be able to access `/status/`.

And if you select the scope `me` but not the scope `items`, you will be able to access `/users/me/` but not `/users/me/items/`.

	"k8s.io/kubernetes/pkg/securitycontext"
	"k8s.io/kubernetes/test/utils/ktesting"
)

const (
	TestSource = "test"
)

func expectEmptyChannel(t *testing.T, ch <-chan interface{}) {
	select {
	case update := <-ch:
		t.Errorf("Expected no update in channel, Got %v", update)
	default:
	}
}

type sortedPods []*v1.Pod

func (s sortedPods) Len() int {
	return len(s)
}

		return err
	}
	defer uploader.Close()
	return uploader.Run()
}

// uploader encapsulates a single upload operation, carrying parameters and
// shared state.
type uploader struct {
	// config is used to select counters to upload.
	config        *telemetry.UploadConfig //
	configVersion string                  // version of the config
	dir           telemetry.Dir           // the telemetry dir to process

	uploadServerURL string

	flag.Parse()

	localDisks, err := filterLocalDisks(node, args)
	if err != nil {
		log.Fatal(err)
	}

	if len(localDisks) == 0 {
		log.Fatal("Fix --local-node-name or/and --args to select local disks.")
	}

	format, err := getFormatJSON(localDisks[0].path)
	if err != nil {
		log.Fatal(err)
	}

	setSize := len(format.XL.Sets[0])

	expectedDisksName := make(map[string]string)

			return nil, nil, err
		}
		if err := fieldMutator(obj, fieldSet); err != nil {
			return nil, nil, err
		}
		return labelSet, fieldSet, nil
	}
}

// SelectionPredicate is used to represent the way to select objects from api storage.
type SelectionPredicate struct {
	Label               labels.Selector
	Field               fields.Selector
	GetAttrs            AttrFunc
	IndexLabels         []string

        // descriptors must be available in the binding context for the IR backend. Note that the full bytecode is only generated for
        // `file` because of filtering in `generateClassFilter`, while only select declarations from other files are generated if needed
        // by the backend.
        val inlineAnalyzer = InlineFunctionAnalyzer(analysisContext, analyzeOnlyReifiedInlineFunctions = disableInline)