match: TAG\s*\?=

  - name: "registry.k8s.io/pause: dependents"
    version: 3.10
    refPaths:
    - path: cluster/gce/config-common.sh
      match: registry.k8s.io\/pause:\d+\.\d+
    - path: cluster/gce/gci/configure-helper.sh
      match: registry.k8s.io\/pause:\d+\.\d+
    - path: cluster/gce/windows/smoke-test.sh
      match: registry.k8s.io\/pause:\d+\.\d+
    - path: cmd/kubeadm/app/constants/constants.go

  metadata="${metadata},kubelet-config=${KUBE_TEMP}/master-kubelet-config.yaml"
  metadata="${metadata},user-data=${KUBE_ROOT}/cluster/gce/gci/master.yaml"
  metadata="${metadata},configure-sh=${KUBE_ROOT}/cluster/gce/gci/configure.sh"
  metadata="${metadata},cluster-location=${KUBE_TEMP}/cluster-location.txt"
  metadata="${metadata},cluster-name=${KUBE_TEMP}/cluster-name.txt"

# cluster/${KUBERNETES_PROVIDER}/util.sh where KUBERNETES_PROVIDER, if unset,
# will use its default value (gce).

KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..

source "${KUBE_ROOT}/cluster/skeleton/util.sh"

if [[ -n "${KUBERNETES_CONFORMANCE_TEST:-}" ]]; then
    KUBERNETES_PROVIDER=""
else
    KUBERNETES_PROVIDER="${KUBERNETES_PROVIDER:-gce}"
fi

# PROVIDER_VARS is a list of cloud provider specific variables. Note:

# limitations under the License.

# !!!EXPERIMENTAL!!! Upgrade a K8s cluster from routes to IP aliases for
# node connectivity on GCE. This is only for migration.

set -o errexit
set -o nounset
set -o pipefail

if [[ "${KUBERNETES_PROVIDER:-gce}" != "gce" ]]; then
  echo "ERR: KUBERNETES_PROVIDER must be gce" >&2
  exit 1
fi

KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/../..
source "${KUBE_ROOT}/hack/lib/util.sh"

# sync with gce/config-default.sh (except the filename, because I'm reusing
# gce/util.sh script which assumes config filename), but if some things that
# are enabled by default should not run in hollow clusters, they should be disabled here.

# shellcheck disable=SC2034 # Variables sourced in other scripts.

source "${KUBE_ROOT}/cluster/gce/config-common.sh"

    resources:   ["persistentvolumes"]
    scope:       "*"
  clientConfig:
    url: "https://127.0.0.1:9001/admit"
    caBundle: "__CLOUD_PVL_ADMISSION_CA_CERT__"
  matchConditions:
  - name: "only-gce"
    expression: "has(object.spec.gcePersistentDisk)"
  admissionReviewVersions: ["v1"]
  sideEffects: None
  timeoutSeconds: 5

apiVersion: v1
kind: Service
metadata:
  # This must match the --default-backend-service argument of the l7 lb
  # controller and is required because GCE mandates a default backend.
  name: default-http-backend
  namespace: kube-system
  labels:
    k8s-app: glbc
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
    kubernetes.io/name: "GLBCDefaultBackend"
spec:

"${program[@]}" "${e2e_test}" -- \
  "${auth_config[@]:+${auth_config[@]}}" \
  --host="${KUBE_MASTER_URL}" \
  --provider="${KUBERNETES_PROVIDER}" \
  --gce-project="${PROJECT:-}" \
  --gce-zone="${ZONE:-}" \
  --gce-region="${REGION:-}" \
  --gce-multizone="${MULTIZONE:-false}" \
  --gke-cluster="${CLUSTER_NAME:-}" \
  --kube-master="${KUBE_MASTER:-}" \
  --cluster-tag="${CLUSTER_ID:-}" \

  elif [[ $(which curl) ]]; then
    # if the url belongs to GCS API we should use oauth2_token in the headers
    curl_headers=""
    if { [[ "${KUBERNETES_PROVIDER:-gce}" == "gce" ]] || [[ "${KUBERNETES_PROVIDER}" == "gke" ]] ; } &&
       [[ "$kubernetes_tar_url" =~ ^https://storage.googleapis.com.* ]] ; then
      curl_headers="Authorization: Bearer $(gcloud auth print-access-token)"
    fi

	signal.Notify(done, os.Interrupt, syscall.SIGINT, syscall.SIGTERM)
	log.Println("GCE metadata server started")
	<-done
	if err := s1.Shutdown(context.Background()); err != nil {
		log.Fatalf("GCE Metadata Shutdown Failed: %+v", err)
	}
	if err := s2.Shutdown(context.Background()); err != nil {
		log.Fatalf("GCE Metadata Shutdown Failed: %+v", err)
	}
}