kube::util::wait-for-jobs || { kube::log::error "previous tarball phase failed"; return 1; }
}

# Package the source code we built, for compliance/licensing/audit/yadda.
function kube::release::package_src_tarball() {
  local -r src_tarball="${RELEASE_TARS}/kubernetes-src.tar.gz"
  kube::log::status "Building tarball: src"
  if [[ "${KUBE_GIT_TREE_STATE-}" = 'clean' ]]; then

	})
}

const (
	maxAuditAnnotations = 20
	// use a 5kb limit the CEL expression, note that this is less than the length limit
	// for the audit annotation value limit (10kb) since an expressions that concatenates
	// strings will often produce a longer value than the expression
	maxAuditAnnotationValueExpressionLength = 5 * 1024
)

      allowTTL: 30
      denyTTL: 30
      retryBackoff: 500
      defaultAllow: true
EOF
    fi
  fi
}

# Write the config for the audit policy.
function create-master-audit-policy {
  local -r path="${1}"
  local -r policy="${2:-}"

  if [[ -n "${policy}" ]]; then
    echo "${policy}" > "${path}"
    return
  fi

  # Known api groups

				},
				VariableLabels: map[string]string{"target_id": st.ID.ID, "target_name": st.ID.Name},
				Value:          float64(st.FailedRequests),
			})
		}

		// Audit and system:
		audit := logger.CurrentStats()
		for id, st := range audit {
			metrics = append(metrics, MetricV2{
				Description: MetricDescription{
					Namespace: minioNamespace,
					Subsystem: auditSubsystem,

https://HOSTNAME:PORT/minio/v2/metrics/cluster
```

Replace ``HOSTNAME:PORT`` with the hostname of your MinIO deployment.
For deployments behind a load balancer, use the load balancer hostname instead of a single node hostname.

## Audit Metrics

| Name                              | Description                                               |
|:----------------------------------|:----------------------------------------------------------|

fi

readonly master_ssh_supported_providers="gce aws"
readonly node_ssh_supported_providers="gce gke aws"
readonly gcloud_supported_providers="gce gke"

readonly master_logfiles="kube-apiserver.log kube-apiserver-audit.log kube-scheduler.log kube-controller-manager.log cloud-controller-manager.log etcd.log etcd-events.log glbc.log cluster-autoscaler.log kube-addon-manager.log konnectivity-server.log fluentd.log kubelet.cov"

# Cryptographer
app.cipher.algorism=aes
app.cipher.key=___change__me___
app.digest.algorism=sha256
app.encrypt.property.pattern=.*password|.*key|.*token|.*secret

app.extension.names=

app.audit.log.format=

# JVM options
jvm.crawler.options=\
-Djava.awt.headless=true\n\
-Dfile.encoding=UTF-8\n\
-Djna.nosys=true\n\
-Djdk.io.permissionsUseCanonicalPath=true\n\
-Dhttp.maxConnections=20\n\

	// kep: http://kep.k8s.io/4193
	// alpha: v1.29
	// beta: v1.30
	//
	// Controls whether JTIs (UUIDs) are embedded into generated service account tokens, and whether these JTIs are
	// recorded into the audit log for future requests made by these tokens.
	ServiceAccountTokenJTI featuregate.Feature = "ServiceAccountTokenJTI"

	// owner: @munnerz
	// kep: http://kep.k8s.io/4193
	// alpha: v1.29
	// beta: v1.31
	//

	var dctx context.Context
	dctx, z.decommissionCancelers[idx] = context.WithCancel(GlobalContext)
	z.poolMetaMutex.Unlock()

	// Generate an empty request info so it can be directly modified later by audit
	dctx = logger.SetReqInfo(dctx, &logger.ReqInfo{})

	if err := z.decommissionInBackground(dctx, idx); err != nil {
		decomLogIf(GlobalContext, err)
		decomLogIf(GlobalContext, z.DecommissionFailed(dctx, idx))

			},
			Spec: admissionregistration.ValidatingAdmissionPolicySpec{
				AuditAnnotations: []admissionregistration.AuditAnnotation{{
					Key:             "this-is-a-long-name-for-an-audit-annotation-key-xxxxxxxxxxxxxxxxxxxxxxxxxx",
					ValueExpression: "'value'",
				}},
			},
		},
		expectedError: `spec.auditAnnotations[0].key: Invalid value`,
	}, {