// (ref: https://github.com/torvalds/linux/commit/13b287e8d1cad951634389f85b8c9b816bd3bb1e)
const TCPKeepAliveTimeNamespacedKernelVersion = "4.5"

// TCPKeepAliveIntervalNamespacedKernelVersion is the kernel version in which net.ipv4.tcp_keepalive_intvl was namespaced(netns).

      "name": "validatingadmissionpolicies/status",
      "namespaced": false,
      "singularName": "",
      "verbs": [
        "get",
        "patch",
        "update"
      ]
    },
    {
      "categories": [
        "api-extensions"
      ],
      "kind": "ValidatingAdmissionPolicyBinding",
      "name": "validatingadmissionpolicybindings",
      "namespaced": false,

{
  "apiVersion": "v1",
  "groupVersion": "storagemigration.k8s.io/v1alpha1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "StorageVersionMigration",
      "name": "storageversionmigrations",
      "namespaced": false,
      "singularName": "storageversionmigration",
      "storageVersionHash": "N0mJdFqO17c=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",

			return nil, fmt.Errorf("the sysctls %q are not known to be namespaced", sysctlOrPrefix)
		}
		if prefixed {
			w.prefixes[sysctlOrPrefix] = ns
		} else {
			w.sysctls[sysctlOrPrefix] = ns
		}
	}
	return w, nil
}

// validateSysctl checks that a sysctl is allowlisted because it is known
// to be namespaced by the Linux kernel. Note that being allowlisted is required, but not

{
  "apiVersion": "v1",
  "groupVersion": "discovery.k8s.io/v1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "EndpointSlice",
      "name": "endpointslices",
      "namespaced": true,
      "singularName": "endpointslice",
      "storageVersionHash": "qgS0xkrxYAI=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",
        "patch",

{
  "apiVersion": "v1",
  "groupVersion": "storage.k8s.io/v1alpha1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "VolumeAttributesClass",
      "name": "volumeattributesclasses",
      "namespaced": false,
      "shortNames": [
        "vac"
      ],
      "singularName": "volumeattributesclass",
      "storageVersionHash": "HPC8kMG1ukQ=",
      "verbs": [
        "create",
        "delete",

	GetNamespace() string

	// GetPolicyName returns the name of the (Validating/Mutating)AdmissionPolicy,
	// which is cluster-scoped, so namespace is usually left blank.
	// But we leave the door open to add a namespaced vesion in the future
	GetPolicyName() types.NamespacedName
	GetParamRef() *v1.ParamRef

	GetMatchResources() *v1.MatchResources

	cache.SharedIndexInformer
	Lister[T]
}

// Lister[T] helps list Ts.
// All objects returned here must be treated as read-only.
type Lister[T any] interface {
	NamespacedLister[T]
	Namespaced(namespace string) NamespacedLister[T]

  // Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
  // Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"),  but not both.
  // +optional
  repeated string nonResourceURLs = 5;
}

		kernel: utilkernel.TCPKeepAliveProbesNamespacedKernelVersion,
	},
}

// SafeSysctlAllowlist returns the allowlist of safe sysctls and safe sysctl patterns (ending in *).
//
// A sysctl is called safe iff
// - it is namespaced in the container or the pod
// - it is isolated, i.e. has no influence on any other pod on the same node.
func SafeSysctlAllowlist() []string {
	if goruntime.GOOS != "linux" {
		return nil
	}