{{- if .Values.podDisruptionBudget.enabled }}
{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodDisruptionBudget" }}
apiVersion: policy/v1beta1
{{- else }}
apiVersion: policy/v1
{{- end }}
kind: PodDisruptionBudget
metadata:
  name: minio
  labels:
    app: {{ template "minio.name" . }}
spec:
  maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
  selector:
    matchLabels:
      app: {{ template "minio.name" . }}

        memory: 210Mi
      requests:
        cpu: 100m
        memory: 70Mi
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      runAsGroup: 1001
      capabilities:
        add:
        - NET_BIND_SERVICE
        drop:
        - ALL
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:

        then:
        failure.assertHasCause """Invalid publication 'ivy':
  - Variants 'api' and 'impl' have the same attributes and capabilities. Please make sure either attributes or capabilities are different."""
    }

    def "generates Gradle metadata if 2 variants have the same attributes but different capabilities"() {
        given:
        settingsFile.text = """
            rootProject.name = 'root'
        """

    }

    /**
     * This test illustrates that published modules can declare capabilities, which are then discovered
     * as we visit the graph. But using a module substitution rule, we can fix the problem.
     */

    @RequiredFeature(feature = GradleMetadataResolveRunner.GRADLE_METADATA, value = "true")
    def "can express preference for capabilities declared in published modules (#description)"() {
        given:
        repository {

        imagePullPolicy: {{ . }}
{{- end }}
        securityContext:
          allowPrivilegeEscalation: false
          privileged: false
          capabilities:
            drop:
            - ALL
            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
            - NET_ADMIN # Required for TPROXY and setsockopt
            - SYS_ADMIN # Required for `setns` - doing things in other netns

--------------------------------------------------
Variant testResultsElementsForTest (i)
--------------------------------------------------
Directory containing binary results of running tests for the test Test Suite's test target.

Capabilities
    - :Test:unspecified (default capability)
Attributes
    - org.gradle.category              = verification
    - org.gradle.testsuite.name        = test
    - org.gradle.testsuite.target.name = test

import org.gradle.api.artifacts.component.ModuleComponentIdentifier;
import org.gradle.api.artifacts.component.ModuleComponentSelector;
import org.gradle.api.attributes.AttributeContainer;
import org.gradle.api.capabilities.Capability;
import org.gradle.api.internal.artifacts.ImmutableVersionConstraint;
import org.gradle.api.internal.artifacts.dependencies.DefaultImmutableVersionConstraint;

kind: feature
area: security
releaseNotes:
- |
  **Improved** request JWT authentication to use the upstream Envoy JWT filter
  instead of the custom Istio Proxy filter. Because the new upstream JWT filter
  capabilities are needed, the feature is gated for the proxies that support
  them. Note that a custom Envoy or Wasm filter that used `istio_authn` dynamic
  metadata key  needs to be updated to use `envoy.filters.http.jwt_authn`

import "internal/cpu"

func archauxv(tag, val uintptr) {
	switch tag {
	case _AT_HWCAP:
		// ppc64x doesn't have a 'cpuid' instruction
		// equivalent and relies on HWCAP/HWCAP2 bits for
		// hardware capabilities.
		cpu.HWCap = uint(val)
	case _AT_HWCAP2:
		cpu.HWCap2 = uint(val)
	}
}

 */
package org.gradle.internal.component.external.model;

import com.google.common.base.Objects;
import org.gradle.api.artifacts.ModuleVersionIdentifier;
import org.gradle.api.capabilities.Capability;
import org.gradle.api.internal.capabilities.ImmutableCapability;

import javax.annotation.Nullable;

public class DefaultImmutableCapability implements ImmutableCapability {