// For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
  // and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
  // a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook.
  //
  // Defaults to "Exact"
  // +optional
  optional string matchPolicy = 9;

  //
  // For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
  // `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
  // an API request to apps/v1beta1 deployments would be converted and sent to the webhook
  // with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),

  //
  // For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
  // `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
  // an API request to apps/v1beta1 deployments would be converted and sent to the webhook
  // with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),

  // For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
  // and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
  // a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook.
  //
  // Defaults to "Equivalent"
  // +optional
  optional string matchPolicy = 9;

Note that the go_darwin_$GOARCH_exec wrapper uninstalls any existing app identified by
the bundle id before installing a new app. If the uninstalled app is the last app by
the developer identity, the device might also remove the permission to run apps from
that developer, and the exec wrapper will fail to install the new app. To avoid that,
install another app with the same developer identity but with a different bundle id.

		},
		config.HelpKV{
			Key:         ClientID,
			Description: `unique public identifier for apps e.g. "292085223830.apps.googleusercontent.com"` + defaultHelpPostfix(ClientID),
			Type:        "string",
		},
		config.HelpKV{
			Key:         ClientSecret,
			Description: `secret for the unique public identifier for apps` + defaultHelpPostfix(ClientSecret),
			Sensitive:   true,
			Type:        "string",
			Secret:      true,

stable version in place and gradually migrate apps to the new version.

- More flexibility: the new installer allows multiple 'environments', allowing applications to select
a set of control plane settings and components. While the entire mesh respects the same APIs and config,
apps may target different 'environments' which contain different instances and variants of Istio.

"minio.deployment.apiVersion" -}} {{- if semverCompare "<1.9-0" .Capabilities.KubeVersion.Version -}} {{- print "apps/v1beta2" -}} {{- else -}} {{- print "apps/v1" -}} {{- end -}} {{- end -}} {{/* Return the appropriate apiVersion for statefulset. */}} {{- define "minio.statefulset.apiVersion" -}} {{- if semverCompare "<1.16-0" .Capabilities.KubeVersion.Version -}} {{- print "apps/v1beta2" -}} {{- else -}} {{- print "apps/v1" -}} {{- end -}} {{- end -}} {{/* Return the appropriate apiVersion for ingress. */}} {{- define...

identity_openid  enable OpenID SSO support

ARGS:
config_url*   (url)       openid discovery document e.g. "https://accounts.google.com/.well-known/openid-configuration"
client_id     (string)    unique public identifier for apps e.g. "292085223830.apps.googleusercontent.com"
claim_name    (string)    JWT canned policy claim name, defaults to "policy"
claim_prefix  (string)    JWT claim namespace prefix e.g. "customer1/"

### Other (Cleanup or Flake)

- APIs for kubelet annotations and labels from k8s.io/kubernetes/pkg/kubelet/apis are now available under k8s.io/kubelet/pkg/apis/ ([#98931](https://github.com/kubernetes/kubernetes/pull/98931), [@michaelbeaumont](https://github.com/michaelbeaumont)) [SIG Apps, Auth and Node]