}
},
"spec":{
"securityContext": {
  {{runAsUser}}
  {{runAsGroup}}
  {{supplementalGroups}}
  "seccompProfile": {
      "type": "RuntimeDefault"
  }
},
"priorityClassName": "system-node-critical",
"priority": 2000001000,
"hostNetwork": true,
"containers":[
    {
    "name": "kube-controller-manager",
    "securityContext": {
      "allowPrivilegeEscalation": false,
      "capabilities": {

    type: RollingUpdate
  template:
    metadata:
      labels:
        k8s-app: metadata-proxy
        kubernetes.io/cluster-service: "true"
        version: v0.1
    spec:
      priorityClassName: system-node-critical
      serviceAccountName: metadata-proxy
      hostNetwork: true
      dnsPolicy: Default
      tolerations:
      - operator: "Exists"
        effect: "NoExecute"
      - operator: "Exists"

	zapcore.DebugLevel:  "Debug",
	zapcore.InfoLevel:   "Info",
	zapcore.WarnLevel:   "Warning",
	zapcore.ErrorLevel:  "Error",
	zapcore.DPanicLevel: "Critical",
	zapcore.FatalLevel:  "Critical",
	zapcore.PanicLevel:  "Critical",
}

func encodeStackdriverLevel(l zapcore.Level, enc zapcore.PrimitiveArrayEncoder) {
	enc.AppendString(stackdriverSeverityMapping[l])
}

// so the code produced for F2 uses { b.m(); a.m() } as the method set
// order. So again, it ends up calling the wrong method.
//
// Also, this function is marked noinline because it's critical to the
// test that the interface method call happen in this compilation
// unit, and the itab construction happens in c.go.
//
//go:noinline
func F2(i interface {
	m()
	a.I // embeds m() from package a
}) {

	if err != nil {
		return nil, fmt.Errorf("failed to marshal the raw values for SAN field (err: %s)", err)
	}

	// SAN is Critical because the subject is empty. This is compliant with X.509 and SPIFFE standards.
	return &pkix.Extension{Id: oidSubjectAlternativeName, Critical: true, Value: bs}, nil
}

// ExtractIDsFromSAN takes a SAN extension and extracts the identities.
// The logic is mostly borrowed from

          name: istiod-ca-cert
        - mountPath: /var/run/secrets/tokens
          name: istio-token
      nodeSelector:
        kubernetes.io/os: linux
      priorityClassName: system-node-critical
      serviceAccountName: ztunnel
      terminationGracePeriodSeconds: 30
      tolerations:
      - effect: NoSchedule
        operator: Exists
      - key: CriticalAddonsOnly
        operator: Exists

    Optional<Throwable> getDisabledReason(String repositoryId);

    /**
     * Attempts to disable the repository with the given id, recording the exception causing it to be disabled, if
     * that exception is deemed critical.
     *
     * @param repositoryId the id of the repository to disable
     * @param throwable the reason why the repository is being disabled

  }
},
"spec":{
"securityContext": {
    {{runAsUser}}
    {{runAsGroup}}
    {{supplementalGroups}}
    "seccompProfile": {
        "type": "RuntimeDefault"
    }
},
"priorityClassName": "system-node-critical",
"priority": 2000001000,
"hostNetwork": true,
"containers":[
    {
    "name": "kube-apiserver",
    {{containerSecurityContext}}

    # If empty, default scope and level will be used as configured in code
    logging:
      level: "default:info"

    # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
    # system-node-critical, it is better to configure this in order to make sure your Istio pods
    # will not be killed because of low priority class.

	}

	if !reflect.DeepEqual(actualIDs, ids) {
		t.Errorf("Unmatched identities: before encoding: %v, after decoding %v", ids, actualIDs)
	}

	if !san.Critical {
		t.Errorf("SAN field is not critical.")
	}
}

func TestBuildSANExtensionWithError(t *testing.T) {
	id := Identity{Type: 10}
	if _, err := BuildSANExtension([]Identity{id}); err == nil {