wantErrorMessage     string
}

func Test_CreateVolumeSpec(t *testing.T) {
	for _, test := range []vaTest{
		{
			desc:           "inline volume type that does not support csi migration",
			createNodeName: nodeName,
			pod: &v1.Pod{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "kube-apiserver",
					Namespace: "default",
				},
				Spec: v1.PodSpec{
					Volumes: []v1.Volume{
						{

distinguishes between docker images with the same lastest etcd version but
changes (bug fixes and backward compatible improvements) to the migration
utility bundled with the image.

In addition to the latest etcd version, each `registry.k8s.io/etcd` image contains
etcd and etcdctl binaries for older versions of etcd. These are used by the
migration operator utility when performing downgrades and multi-step upgrades,
but can also be used as the etcd target version.

}

// Migrator manages etcd data migrations.
type Migrator struct {
	cfg           *EtcdMigrateCfg // TODO: don't wire this directly in
	dataDirectory *DataDirectory
	client        EtcdMigrateClient
}

// MigrateIfNeeded upgrades or downgrades the etcd data directory to the given target version.
func (m *Migrator) MigrateIfNeeded(target *EtcdVersionPair) error {
	klog.Infof("Starting migration to %s", target)

	data, err := json.Marshal(typeMeta)
	if err != nil {
		return err
	}

	// ToDo: implement a mechanism to resume migration from the last migrated resource in case of a failure
	// process storage migration
	for _, gvrKey := range resourceMonitor.Store.ListKeys() {
		namespace, name, err := cache.SplitMetaNamespaceKey(gvrKey)
		if err != nil {
			return err
		}

	_, err := csimigration.CheckMigrationFeatureFlags(featureGate, pluginInfo.pluginMigrationFeature, pluginInfo.pluginUnregisterFeature)
	if err != nil {
		klog.InfoS("Unexpected CSI Migration Feature Flags combination detected, CSI Migration may not take effect", "err", err)
		// TODO: fail and return here once alpha only tests can set the feature flags for a plugin correctly
	}

	_, err := csimigration.CheckMigrationFeatureFlags(featureGate, pluginInfo.pluginMigrationFeature, pluginInfo.pluginUnregisterFeature)
	if err != nil {
		logger.Error(err, "Unexpected CSI Migration Feature Flags combination detected. CSI Migration may not take effect")
		klog.FlushAndExit(klog.ExitFlushTimeout, 1)
		// TODO: fail and return here once alpha only tests can set the feature flags for a plugin correctly
	}

)

// ResourceVersionController adds the resource version obtained from a randomly nonexistent namespace
// to the SVM status before the migration is initiated. This resource version is utilized for checking
// freshness of GC cache before the migration is initiated.
type ResourceVersionController struct {
	discoveryClient *discovery.DiscoveryClient
	metadataClient  metadata.Interface

	// leaderMigrator will be non-nil if and only if Leader Migration is enabled.
	var leaderMigrator *leadermigration.LeaderMigrator = nil

	// If leader migration is enabled, create the LeaderMigrator and prepare for migration
	if leadermigration.Enabled(&c.ComponentConfig.Generic) {
		logger.Info("starting leader migration")

[[sec:task_configuration_avoidance_general]]
=== Migration guidelines
1. [[task_configuration_avoidance_guideline_use_help_task]] **Use `help` task as a benchmark during the migration.** +
The `help` task is the perfect candidate to benchmark your migration process.

apiVersion: release-notes/v2
kind: feature
area: security
releaseNotes:
- |
  **Added** support for migration and concurrent use of regular K8S tokens as well as new K8S tokens with audience. This feature is enabled by
  default, can be disabled by REQUIRE_3P_TOKEN environment variable in Istiod, which will require new tokens with audience. The