key: node-role.kubernetes.io/control-plane
        operator: Exists
      volumes:
      - name: memberlist
        secret:
          defaultMode: 420
          secretName: memberlist
      - configMap:
          defaultMode: 256
          name: metallb-excludel2
        name: metallb-excludel2
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration

// TokenVolumeSource returns the projected volume source for service account token.
func TokenVolumeSource() *api.ProjectedVolumeSource {
	return &api.ProjectedVolumeSource{
		// explicitly set default value, see #104464
		DefaultMode: pointer.Int32(corev1.ProjectedVolumeSourceDefaultMode),
		Sources: []api.VolumeProjection{
			{
				ServiceAccountToken: &api.ServiceAccountTokenProjection{
					Path:              "token",

	// This might be in conflict with other options that affect the file
	// mode, like fsGroup, and the result can be other mode bits set.
	// +optional
	DefaultMode *int32 `json:"defaultMode,omitempty" protobuf:"bytes,3,opt,name=defaultMode"`
	// optional field specify whether the Secret or its keys must be defined
	// +optional
	Optional *bool `json:"optional,omitempty" protobuf:"varint,4,opt,name=optional"`
}

		return err
	}
	out.Items = *(*[]core.KeyToPath)(unsafe.Pointer(&in.Items))
	out.DefaultMode = (*int32)(unsafe.Pointer(in.DefaultMode))
	out.Optional = (*bool)(unsafe.Pointer(in.Optional))
	return nil
}

// Convert_v1_ConfigMapVolumeSource_To_core_ConfigMapVolumeSource is an autogenerated conversion function.

		}, {
			name: "secret with invalid positive defaultMode",
			vol: core.Volume{
				Name: "secret",
				VolumeSource: core.VolumeSource{
					Secret: &core.SecretVolumeSource{
						SecretName:  "s",
						DefaultMode: utilpointer.Int32(01000),
					},
				},
			},
			errs: []verr{{
				etype: field.ErrorTypeInvalid,
				field: "secret.defaultMode",
			}},
		}, {

  // the volume setup will error unless it is marked optional. Paths must be
  // relative and may not contain the '..' path or start with '..'.
  // +optional
  repeated KeyToPath items = 2;

  // defaultMode is optional: mode bits used to set permissions on created files by default.
  // Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.

	"defaultMode": "defaultMode is optional: mode bits used to set permissions on created files by default. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode...

					{DownwardAPI: &api.DownwardAPIProjection{Items: []api.DownwardAPIVolumeFile{{Path: "namespace", FieldRef: &api.ObjectFieldSelector{APIVersion: "v1", FieldPath: "metadata.namespace"}}}}},
				},
				DefaultMode: utilpointer.Int32(0644),
			},
		},
	}}
	expectedVolumeMounts := []api.VolumeMount{{
		Name:      "cleared",
		ReadOnly:  true,
		MountPath: "/var/run/secrets/kubernetes.io/serviceaccount",
	}}

  // relative and may not contain the '..' path or start with '..'.
  // +optional
  // +listType=atomic
  repeated KeyToPath items = 2;

  // defaultMode is optional: mode bits used to set permissions on created files by default.
  // Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511.

import org.eclipse.aether.util.graph.transformer.ConflictResolver;

public class DefaultNode extends AbstractNode {

    protected final @Nonnull InternalSession session;
    protected final @Nonnull org.eclipse.aether.graph.DependencyNode node;
    protected final boolean verbose;

    public DefaultNode(
            @Nonnull InternalSession session, @Nonnull org.eclipse.aether.graph.DependencyNode node, boolean verbose) {