// TODO shouldn't need to double up on this work, only done for simplicity of handling
                            // recommended
                            // version but the restriction is identical
                            VersionRange newRange = previousRange.restrict(currentRange);
                            // TODO ick. this forces the OCE that should have come from the previous call. It is still

- kube-apiserver: the `NodeRestriction` admission plugin now prevents kubelets from modifying `Node` labels prefixed with `node-restriction.kubernetes.io/`. The `node-restriction.kubernetes.io/` label prefix is reserved for cluster administrators to use for labeling `Node` objects to target workloads to nodes in a way that kubelets cannot modify or spoof. ([#68267](https://github.com/kubernetes/kubernetes/pull/68267),...

- Allowed dynamic configuration of the service account name and audience that the kubelet could request a token for, as part of the node audience restriction feature. ([#130485](https://github.com/kubernetes/kubernetes/pull/130485), [@aramase](https://github.com/aramase)) [SIG Auth and Testing]

* Scheduler only activates unschedulable pods if node's scheduling related properties change. ([#71551](https://github.com/kubernetes/kubernetes/pull/71551), [@mlmhl](https://github.com/mlmhl))
* fix issue: vm sku restriction policy does not work in azure disk attach/detach ([#71941](https://github.com/kubernetes/kubernetes/pull/71941), [@andyzhangx](https://github.com/andyzhangx))

	if srcInfo.Legacy {
		srcInfo.metadataOnly = false
	}

	// Check if x-amz-metadata-directive or x-amz-tagging-directive was not set to REPLACE and source,
	// destination are same objects. Apply this restriction also when
	// metadataOnly is true indicating that we are not overwriting the object.
	// if encryption is enabled we do not need explicit "REPLACE" metadata to
	// be enabled as well - this is to allow for key-rotation.

### Detection

Kubernetes Audit logs may indicate if the user name was misspelled to bypass the restriction placed on which user is a pod allowed to run as.

If you find evidence that this vulnerability has been exploited, please contact ******@****.***

#### Additional Details

- ObjectACL (Use [bucket policies](https://docs.min.io/community/minio-object-store/administration/identity-access-management/policy-based-access-control.html) instead)

## Object name restrictions on MinIO

   * documentation for {@link Collection}:
   *
   * <blockquote>
   *
   * "Some collection implementations have restrictions on the elements that they may contain. For
   * example, some implementations prohibit null elements, and some have restrictions on the types
   * of their elements."
   *
   * </blockquote>
   */
  RESTRICTS_ELEMENTS,

  /**

    private DfFinalTimeZoneProvider getDBFluteSystemTimeZoneProvider() {
        try {
            // Try to access the field, handling potential security restrictions
            Field field = DBFluteSystem.class.getDeclaredField("finalTimeZoneProvider");
            field.setAccessible(true);
            return (DfFinalTimeZoneProvider) field.get(null);

     */
    public Set<String> getRunningSessionIdSet() {
        return runningProcessMap.keySet();
    }

    /**
     * Sets the timeout for process destruction.
     *
     * @param processDestroyTimeout timeout in seconds for process destruction
     */
    public void setProcessDestroyTimeout(final int processDestroyTimeout) {
        this.processDestroyTimeout = processDestroyTimeout;
    }

    /**