return nil, fmt.Errorf("the sysctls %q are not known to be namespaced", sysctlOrPrefix)
		}
		if prefixed {
			w.prefixes[sysctlOrPrefix] = ns
		} else {
			w.sysctls[sysctlOrPrefix] = ns
		}
	}
	return w, nil
}

// validateSysctl checks that a sysctl is allowlisted because it is known
// to be namespaced by the Linux kernel. Note that being allowlisted is required, but not

		input  APIResource
		result string
	}{
		{APIResource{}, `{"name":"","singularName":"","namespaced":false,"kind":"","verbs":null}`},
		{APIResource{Verbs: Verbs([]string{})}, `{"name":"","singularName":"","namespaced":false,"kind":"","verbs":[]}`},
		{APIResource{Verbs: Verbs([]string{"delete"})}, `{"name":"","singularName":"","namespaced":false,"kind":"","verbs":["delete"]}`},
	}

	for i, c := range cases {

{
  "apiVersion": "v1",
  "groupVersion": "authentication.k8s.io/v1alpha1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "SelfSubjectReview",
      "name": "selfsubjectreviews",
      "namespaced": false,
      "singularName": "selfsubjectreview",
      "verbs": [
        "create"
      ]
    }
  ]

{
  "apiVersion": "v1",
  "groupVersion": "discovery.k8s.io/v1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "EndpointSlice",
      "name": "endpointslices",
      "namespaced": true,
      "singularName": "endpointslice",
      "storageVersionHash": "qgS0xkrxYAI=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",
        "patch",

{
  "apiVersion": "v1",
  "groupVersion": "node.k8s.io/v1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "RuntimeClass",
      "name": "runtimeclasses",
      "namespaced": false,
      "singularName": "runtimeclass",
      "storageVersionHash": "WQTu1GL3T2Q=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",
        "patch",
        "update",

{
  "apiVersion": "v1",
  "groupVersion": "certificates.k8s.io/v1alpha1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "ClusterTrustBundle",
      "name": "clustertrustbundles",
      "namespaced": false,
      "singularName": "clustertrustbundle",
      "storageVersionHash": "XGGGW2kGm+w=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",

{
  "apiVersion": "v1",
  "groupVersion": "events.k8s.io/v1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "Event",
      "name": "events",
      "namespaced": true,
      "shortNames": [
        "ev"
      ],
      "singularName": "event",
      "storageVersionHash": "r2yiGXH7wu8=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",

{
  "apiVersion": "v1",
  "groupVersion": "storage.k8s.io/v1alpha1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "VolumeAttributesClass",
      "name": "volumeattributesclasses",
      "namespaced": false,
      "shortNames": [
        "vac"
      ],
      "singularName": "volumeattributesclass",
      "storageVersionHash": "HPC8kMG1ukQ=",
      "verbs": [
        "create",
        "delete",

		if producedObject == nil {
			producedObject = defaultVersionedObject
		}
		reqScope.Namer = action.Namer

		requestScope := "cluster"
		var namespaced string
		var operationSuffix string
		if apiResource.Namespaced {
			requestScope = "namespace"
			namespaced = "Namespaced"
		}
		if strings.HasSuffix(action.Path, "/{path:*}") {
			requestScope = "resource"
			operationSuffix = operationSuffix + "WithPath"
		}

# critical pods are configured as a limited resource by admission_controller_config.yaml,
# which means they are disallowed unless explicitly allowed by a namespaced quota object.
# This quota effectively removes the restriction on the number of critical pods allowed in the kube-system namespace.
apiVersion: v1
kind: ResourceQuota
metadata:
  name: gcp-critical-pods
  namespace: kube-system
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
spec: