templates := set.Spec.VolumeClaimTemplates
	claims := make(map[string]v1.PersistentVolumeClaim, len(templates))
	for i := range templates {
		claim := templates[i].DeepCopy()
		claim.Name = getPersistentVolumeClaimName(set, claim, ordinal)
		claim.Namespace = set.Namespace
		if claim.Labels != nil {
			for key, value := range set.Spec.Selector.MatchLabels {
				claim.Labels[key] = value
			}
		} else {

	if forTCP {
		return nil, fmt.Errorf("%q is HTTP only", key)
	}

	claims, err := extractNameInNestedBrackets(strings.TrimPrefix(key, attrRequestClaims))
	if err != nil {
		return nil, err
	}
	// Generate a metadata list matcher for the given path keys and value.
	// On proxy side, the value should be of list type.
	m := MetadataMatcherForJWTClaims(claims, matcher.StringMatcher(value), false)
	return principalMetadata(m), nil
}

      where such license applies only to those patent claims licensable
      by such Contributor that are necessarily infringed by their
      Contribution(s) alone or by combination of their Contribution(s)
      with the Work to which such Contribution(s) was submitted. If You
      institute patent litigation against any entity (including a
      cross-claim or counterclaim in a lawsuit) alleging that the Work

      where such license applies only to those patent claims licensable
      by such Contributor that are necessarily infringed by their
      Contribution(s) alone or by combination of their Contribution(s)
      with the Work to which such Contribution(s) was submitted. If You
      institute patent litigation against any entity (including a
      cross-claim or counterclaim in a lawsuit) alleging that the Work

  // volumeClaimTemplates is a list of claims that pods are allowed to reference.
  // The StatefulSet controller is responsible for mapping network identities to
  // claims in a way that maintains the identity of a pod. Every claim in
  // this list must have at least one matching (by name) volumeMount in one
  // container in the template. A claim in this list takes precedence over

        port: portValue
      terminationGracePeriodSeconds: 7
      timeoutSeconds: 3
    resizePolicy:
    - resourceName: resourceNameValue
      restartPolicy: restartPolicyValue
    resources:
      claims:
      - name: nameValue
      limits:
        limitsKey: "0"
      requests:
        requestsKey: "0"
    restartPolicy: restartPolicyValue
    securityContext:
      allowPrivilegeEscalation: true

          }
        ],
        "resources": {
          "limits": {
            "limitsKey": "0"
          },
          "requests": {
            "requestsKey": "0"
          },
          "claims": [
            {
              "name": "nameValue"
            }
          ]
        },
        "resizePolicy": [
          {
            "resourceName": "resourceNameValue",

// The currently only supported header is @request.auth.claims for JWT claims matching. Claims of type string or list of string
// are supported and nested claims are also supported using `.` or `[]` as a separator for claim names, `[]` is recommended.
//
// Examples using `.` as a separator:
// - `@request.auth.claims.admin` matches the claim "admin".
// - `@request.auth.claims.group.id` matches the nested claims "group" and "id".
//

)

// Manager manages all the DRA resource plugins running on a node.
type Manager interface {
	// Start starts the reconcile loop of the manager.
	// This will ensure that all claims are unprepared even if pods get deleted unexpectedly.
	Start(activePods ActivePodsFunc, sourcesReady config.SourcesReady) error

	// PrepareResources prepares resources for a pod.

	// popping its corresponding mspan) by the time we get here. Because
	// we're the last popper, we also don't have to worry about concurrent
	// pushers (there can't be any). Note that we may not be the popper
	// which claimed the last slot in the block, we're just the last one
	// to finish popping.
	if block.popped.Add(1) == spanSetBlockEntries {
		// Clear the block's pointer.
		blockp.StoreNoWB(nil)