@CheckForNull
  abstract C greatestValueBelow(DiscreteDomain<C> domain);

  /*
   * The canonical form is a BelowValue cut whenever possible, otherwise ABOVE_ALL, or
   * (only in the case of types that are unbounded below) BELOW_ALL.
   */
  Cut<C> canonical(DiscreteDomain<C> domain) {
    return this;
  }

  // note: overridden by {BELOW,ABOVE}_ALL
  @Override
  public int compareTo(Cut<C> that) {

   * canonical forms:
   *
   * <ul>
   *   <li>[start..end)
   *   <li>[start..+∞)
   *   <li>(-∞..end) (only if type {@code C} is unbounded below)
   *   <li>(-∞..+∞) (only if type {@code C} is unbounded below)
   * </ul>
   */
  public Range<C> canonical(DiscreteDomain<C> domain) {
    checkNotNull(domain);
    Cut<C> lower = lowerBound.canonical(domain);

  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - egressgateway.bookinfo.com
    tls:
      # We can reuse the standard Istio certs mounted in the gateway
      mode: SIMPLE #enables HTTPS on this port
      serverCertificate: /etc/certs/cert-chain.pem
      privateKey: /etc/certs/key.pem
      caCertificates: /etc/certs/root-cert.pem

   * canonical forms:
   *
   * <ul>
   *   <li>[start..end)
   *   <li>[start..+∞)
   *   <li>(-∞..end) (only if type {@code C} is unbounded below)
   *   <li>(-∞..+∞) (only if type {@code C} is unbounded below)
   * </ul>
   */
  public Range<C> canonical(DiscreteDomain<C> domain) {
    checkNotNull(domain);
    Cut<C> lower = lowerBound.canonical(domain);

	// During kubelet startup, all volumes present on disk are added as uncertain to ASW.
	// Allow unmount only when DSW is fully populated to prevent unmounting volumes that
	// did not reach DSW yet.
	if !rc.populatorHasAddedPods() {
		return false
	}

	// Allow unmount only when ASW device paths were corrected from node.status to prevent
	// calling unmount with a wrong devicePath.
	if len(rc.volumesNeedUpdateFromNodeStatus) != 0 {
		return false

	k8sCAPath = "./var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
	// Location of K8s CA root mounted by istio. This is to avoid issues when service account automount is disabled.
	k8sCAIstioMountedPath = "./var/run/secrets/istio/kubernetes/ca.crt"

	// CitadelCACertPath is the directory for Citadel CA certificate.
	// This is mounted from config map 'istio-ca-root-cert'. Part of startup,

// along with this program.  If not, see <http://www.gnu.org/licenses/>.

package disk

import "runtime"

// IsRootDisk returns if diskPath belongs to root-disk, i.e the disk mounted at "/"
func IsRootDisk(diskPath string, rootDisk string) (bool, error) {
	if runtime.GOOS == "windows" {
		// On windows this function is not implemented.
		return false, nil
	}
	return SameDisk(diskPath, rootDisk)

	MREPL   = 0x0000 // mount replaces object
	MBEFORE = 0x0001 // mount goes before others in union directory
	MAFTER  = 0x0002 // mount goes after others in union directory
	MCREATE = 0x0004 // permit creation in mounted directory
	MCACHE  = 0x0010 // cache some data
	MMASK   = 0x0017 // all bits on
)

// Rfork flags
const (
	RFNAMEG  = 1 << 0
	RFENVG   = 1 << 1
	RFFDG    = 1 << 2
	RFNOTEG  = 1 << 3
	RFPROC   = 1 << 4

	return nil, fmt.Errorf("PersistentVolumeController.NewWrapperMounter is not implemented")
}

func (ctrl *PersistentVolumeController) NewWrapperUnmounter(volName string, spec vol.Spec, podUID types.UID) (vol.Unmounter, error) {
	return nil, fmt.Errorf("PersistentVolumeController.NewWrapperMounter is not implemented")
}

func (ctrl *PersistentVolumeController) GetMounter(pluginName string) mount.Interface {
	return nil
}

				if _, ok := actualMounted[expectedMounted]; !ok || (len(actualMounted) != 1) {
					t.Errorf("Expected %v to be mounted to pod but got %v", expectedMounted, actualMounted)
				}
			} else {
				if _, ok := actualMounted[expectedMounted]; ok || (len(actualMounted) != 0) {
					t.Errorf("Expected %v not to be mounted to pod but got %v", expectedMounted, actualMounted)
				}
			}

			expectedInUse := []v1.UniqueVolumeName{}