@(env bash $(PWD)/buildscripts/race.sh)

test-iam: install-race ## verify IAM (external IDP, etcd backends)
	@echo "Running tests for IAM (external IDP, etcd backends)"
	@MINIO_API_REQUESTS_MAX=10000 CGO_ENABLED=0 go test -tags kqueue,dev -v -run TestIAM* ./cmd
	@echo "Running tests for IAM (external IDP, etcd backends) with -race"

	// Watch cache doesn't support continuations, so serve them from etcd.
	hasContinuation := len(opts.Continue) > 0
	// Serve paginated requests about revision "0" from watch cache to avoid overwhelming etcd.
	hasLimit := opts.Limit > 0 && resourceVersion != "0"
	// Watch cache only supports ResourceVersionMatchNotOlderThan (default).

	logger.Event(ctx, "decom", msg, args...)
}

func etcdLogIf(ctx context.Context, err error, errKind ...interface{}) {
	logger.LogIf(ctx, "etcd", err, errKind...)
}

func etcdLogOnceIf(ctx context.Context, err error, id string, errKind ...interface{}) {
	logger.LogOnceIf(ctx, "etcd", err, id, errKind...)
}

func subnetLogIf(ctx context.Context, err error, errKind ...interface{}) {
	logger.LogIf(ctx, "subnet", err, errKind...)

	// CertificateRenewal flag instructs kubeadm to execute certificate renewal during upgrades
	CertificateRenewal = "certificate-renewal"

	// EtcdUpgrade flag instructs kubeadm to execute etcd upgrade during upgrades
	EtcdUpgrade = "etcd-upgrade"

	// Patches flag sets the folder where kubeadm component patches are stored
	Patches = "patches"

		ShutdownDelayDuration:          time.Duration(0),
		// 1.5MB is the default client request size in bytes
		// the etcd server should accept. See
		// https://github.com/etcd-io/etcd/blob/release-3.4/embed/config.go#L56.
		// A request body might be encoded in json, and is converted to
		// proto when persisted in etcd, so we allow 2x as the largest size
		// increase the "copy" operations in a json patch may cause.

		cfg := data.InitCfg()
		client := data.Client()
		dryRun := data.DryRun()
		etcdUpgrade := data.EtcdUpgrade()
		renewCerts := data.RenewCerts()
		patchesDir := data.PatchesDir()

		// Upgrade the control plane and etcd if installed on this node
		fmt.Printf("[upgrade] Upgrading your Static Pod-hosted control plane instance to version %q...\n", cfg.KubernetesVersion)
		if dryRun {
			return upgrade.DryRunStaticPodUpgrade(patchesDir, cfg)
		}

	// 1.28 server is not aware of the roundtrip annotation, and will
	// default any 0 value persisted (for the NominalConcurrencyShares
	// field of a priority level configuration object) back to 30 when
	// reading from etcd.
	// That means we should not allow 0 values to be introduced, either
	// via v1 or v1beta3(with the roundtrip annotation) until we know
	// all servers are at 1.29+ and will honor the zero value correctly.
	//

func TestCertListOrder(t *testing.T) {
	tests := []struct {
		certs Certificates
		name  string
	}{
		{
			name:  "Default Certificate List",
			certs: GetDefaultCertList(),
		},
		{
			name:  "Cert list less etcd",
			certs: GetCertsWithoutEtcd(),
		},
	}

	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			var lastCA *KubeadmCert
			for i, cert := range test.certs {
				if i > 0 && lastCA == nil {

	"k8s.io/kubernetes/cmd/kubeadm/app/util/apiclient"
	dryrunutil "k8s.io/kubernetes/cmd/kubeadm/app/util/dryrun"
)

// NewWaitControlPlanePhase is a hidden phase that runs after the control-plane and etcd phases
func NewWaitControlPlanePhase() workflow.Phase {
	phase := workflow.Phase{
		Name: "wait-control-plane",
		// TODO: remove this EXPERIMENTAL prefix once WaitForAllControlPlaneComponents goes GA:

	// This allows time for the following to occur:
	// * lifecycle admission plugins on HA apiservers to also observe a namespace
	//   deletion and prevent new objects from being created in the terminating namespace
	// * non-leader etcd servers to observe last-minute object creations in a namespace
	//   so this controller's cleanup can actually clean up all objects
	namespaceDeletionGracePeriod = 5 * time.Second
)