return true
		})

		// update group policy map
		cache.iamGroupPolicyMap.Range(func(g string, mp MappedPolicy) bool {
			pset := mp.policySet()
			if !pset.Contains(policy) {
				return true
			}
			pset.Remove(policy)
			cache.iamGroupPolicyMap.Store(g, newMappedPolicy(strings.Join(pset.ToSlice(), ",")))
			return true
		})

// See the License for the specific language governing permissions and
// limitations under the License.

package iptables

import (
	"errors"
	"fmt"
	"net/netip"
	"strings"

	"istio.io/istio/cni/pkg/ipset"
	"istio.io/istio/cni/pkg/scopes"
	"istio.io/istio/tools/istio-iptables/pkg/builder"
	iptablesconfig "istio.io/istio/tools/istio-iptables/pkg/config"
	iptablesconstants "istio.io/istio/tools/istio-iptables/pkg/constants"

            # capabilities we actually require
            capabilities:
              drop:
              - ALL
              add:
              # CAP_NET_ADMIN is required to allow ipset and route table access
              - NET_ADMIN
              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
              - NET_RAW

}

// newPoset returns a new poset from the internal cache
func (f *Func) newPoset() *poset {
	if len(f.Cache.scrPoset) > 0 {
		po := f.Cache.scrPoset[len(f.Cache.scrPoset)-1]
		f.Cache.scrPoset = f.Cache.scrPoset[:len(f.Cache.scrPoset)-1]
		return po
	}
	return newPoset()
}

// retPoset returns a poset to the internal cache
func (f *Func) retPoset(po *poset) {

						hostIPCache[host] = hostIPSet
					}
				}
				if IPSet, ok := pathIPMap[endpoint.Path]; ok {
					if !IPSet.Intersection(hostIPSet).IsEmpty() {
						return nil, setupType,
							config.ErrInvalidErasureEndpoints(nil).Msg(fmt.Sprintf("same path '%s' can not be served by different port on same address", endpoint.Path))
					}
					pathIPMap[endpoint.Path] = IPSet.Union(hostIPSet)
				} else {

  LOG(INFO) << "odml_to_stablehlo is being deprecated, please use "
               "TFlite converter with flag: "
               "converter.target_spec.supported_ops = "
               "[tf.lite.OpsSet.EXPERIMENTAL_STABLEHLO_OPS] ";

  mlir::odml::initAllPasses();
  mlir::PassPipelineCLParser passPipeline("", "Add available compiler passes.");
  llvm::cl::ParseCommandLineOptions(argc, argv, "ODML StableHLO Bridge.\n");

    ],
    copts = ["-O3"],
    deprecation = "odml_to_stablehlo is being deprecated, please use TFlite converter with flag: " +
                  "converter.target_spec.supported_ops = " +
                  " [tf.lite.OpsSet.EXPERIMENTAL_STABLEHLO_OPS]",
    deps = [
        ":check_accepted_ops_pass",
        ":op_stat_pass",
        ":stablehlo_util",
        ":transforms",
        "//tensorflow/cc/saved_model:loader",

		}

		startTime := time.Now()
		txnResp, err := s.client.KV.Txn(ctx).If(
			clientv3.Compare(clientv3.ModRevision(key), "=", origState.rev),
		).Then(
			clientv3.OpDelete(key),
		).Else(
			clientv3.OpGet(key),
		).Commit()
		metrics.RecordEtcdRequest("delete", s.groupResourceString, err, startTime)
		if err != nil {
			return err
		}
		if !txnResp.Succeeded {

	"k8s.io/kubernetes/pkg/proxy"
	proxyconfigapi "k8s.io/kubernetes/pkg/proxy/apis/config"
	"k8s.io/kubernetes/pkg/proxy/iptables"
	"k8s.io/kubernetes/pkg/proxy/ipvs"
	utilipset "k8s.io/kubernetes/pkg/proxy/ipvs/ipset"
	utilipvs "k8s.io/kubernetes/pkg/proxy/ipvs/util"
	"k8s.io/kubernetes/pkg/proxy/nftables"
	proxyutil "k8s.io/kubernetes/pkg/proxy/util"
	utiliptables "k8s.io/kubernetes/pkg/util/iptables"
	"k8s.io/utils/exec"
)

          "ops and disabling `_experimental_lower_tensor_list_ops` flag in the "
          "TFLite converter object. For example, "
          "converter.target_spec.supported_ops = "
          "[tf.lite.OpsSet.TFLITE_BUILTINS, tf.lite.OpsSet.SELECT_TF_OPS]\\n "
          "converter._experimental_lower_tensor_list_ops = False");
      signalPassFailure();
    }
  } else {