-A ISTIO_OUTPUT ! -o lo -p udp -m mark ! --mark 0x539/0xfff -m udp --dport 53 -j REDIRECT --to-port 15053
-A ISTIO_OUTPUT ! -d ::1/128 -p tcp --dport 53 -m mark ! --mark 0x539/0xfff -j REDIRECT --to-ports 15053
-A ISTIO_OUTPUT -p tcp -m mark --mark 0x111/0xfff -j ACCEPT
-A ISTIO_OUTPUT ! -d ::1/128 -o lo -j ACCEPT
-A ISTIO_OUTPUT ! -d ::1/128 -p tcp -m mark ! --mark 0x539/0xfff -j REDIRECT --to-ports 15001
COMMIT
* raw
-N ISTIO_OUTPUT
-N ISTIO_PRERT

-A ISTIO_OUTPUT -d e9ac:1e77:90ca:399f:4d6d:ece2:2f9b:3164 -p tcp -m tcp -j ACCEPT
-A ISTIO_PRERT ! -d ::1/128 -p tcp ! --dport 15008 -m mark ! --mark 0x539/0xfff -j REDIRECT --to-ports 15006
-A ISTIO_OUTPUT ! -o lo -p udp -m mark ! --mark 0x539/0xfff -m udp --dport 53 -j REDIRECT --to-port 15053
-A ISTIO_OUTPUT ! -d ::1/128 -p tcp --dport 53 -m mark ! --mark 0x539/0xfff -j REDIRECT --to-ports 15053

## Urgent Upgrade Notes

### (No, really, you MUST do this before you upgrade)

Before upgrading to Kubernetes 1.13, you must keep the following in mind:

- kube-apiserver

## Changelog since v1.23.15

## Changes by Kind

### API Change

- Kubernetes 1.23 is now built with go1.19.4. To match behavior of previous Kubernetes 1.23 patch releases:
  - `kube-apiserver` defaults the GOGC setting to 63, to approximate go1.17 garbage collection memory performance in heavily loaded API servers

		{"\xbf\xff\xff", (1 << 22) - 1, true},
		{"\xff", -1, true},
		{"\xff\xff", -1, true},
		{"\xff\xff\xff", -1, true},
		{"\xc0", -1 * (1 << 6), true},
		{"\xc0\x00", -1 * (1 << 14), true},
		{"\xc0\x00\x00", -1 * (1 << 22), true},
		{"\x87\x76\xa2\x22\xeb\x8a\x72\x61", 537795476381659745, true},
		{"\x80\x00\x00\x00\x07\x76\xa2\x22\xeb\x8a\x72\x61", 537795476381659745, true},
		{"\xf7\x76\xa2\x22\xeb\x8a\x72\x61", -615126028225187231, true},

    - [Node Binaries](#node-binaries-6)
  - [Changelog since v1.11.3](#changelog-since-v1113)
    - [Other notable changes](#other-notable-changes-6)
- [v1.11.3](#v1113)
  - [Downloads for v1.11.3](#downloads-for-v1113)
    - [Client Binaries](#client-binaries-7)
    - [Server Binaries](#server-binaries-7)
    - [Node Binaries](#node-binaries-7)
  - [Changelog since v1.11.2](#changelog-since-v1112)
    - [Action Required](#action-required)

  // externalName is the external reference that discovery mechanisms will
  // return as an alias for this service (e.g. a DNS CNAME record). No
  // proxying will be involved.  Must be a lowercase RFC-1123 hostname
  // (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName".
  // +optional
  optional string externalName = 10;

    assertInvalid("HTTP/1.1_200 OK")
  }

  @Test
  fun nonThreeDigitCode() {
    assertInvalid("HTTP/1.1  OK")
    assertInvalid("HTTP/1.1 2 OK")
    assertInvalid("HTTP/1.1 20 OK")
    assertInvalid("HTTP/1.1 2000 OK")
    assertInvalid("HTTP/1.1 two OK")
    assertInvalid("HTTP/1.1 2")
    assertInvalid("HTTP/1.1 2000")
    assertInvalid("HTTP/1.1 two")
  }

  @Test
  fun truncated() {
    assertInvalid("")

# For release jobs, we will pin these on the release branch
keras-nightly ~= 3.0.0.dev
tb-nightly ~= 2.18.0.a
# Test dependencies
grpcio >= 1.24.3, < 2.0
portpicker == 1.6.0
scipy == 1.11.3
requests >= 2.31.0
packaging==23.2
setuptools==70.0.0
jax==0.4.7
# The dependencies below are needed for TF wheel testing.
tensorflow-io-gcs-filesystem==0.37.1
libclang >= 13.0.0
google_pasta ~= 0.2

        map sigbuild-r2.13-python3.8 2.13-python3.8
        map sigbuild-r2.13-python3.9 2.13-python3.9
        map sigbuild-r2.13-python3.10 2.13-python3.10
        map sigbuild-r2.13-python3.11 2.13-python3.11
        # TF 2.13 + Clang (containers are the same, but env vars in configs.bzl are different)
        map sigbuild-r2.13-clang 2.13-python3.9
        map sigbuild-r2.13-clang-python3.8 2.13-python3.8