##################################################################################################
# Redis service and deployment
# Ratelimit service and deployment

# Note: a configmap is needed to make the rate limit deployment work properly, for example:
#
#  apiVersion: v1
#  kind: ConfigMap
#  metadata:
#    name: ratelimit-config
#  data:
#    config.yaml: |
#      domain: echo-ratelimit
#      descriptors:

    case $MAX_FD in #(
      max*)
        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
        # shellcheck disable=SC2039,SC3045
        MAX_FD=$( ulimit -H -n ) ||
            warn "Could not query maximum file descriptor limit"
    esac
    case $MAX_FD in  #(
      '' | soft) :;; #(
      *)
        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.

	if proxyConfig.Concurrency == nil {
		// We want to detect based on CPU limit configured. If we are running on a 100 core machine, but with
		// only 2 CPUs allocated, we want to have 2 threads, not 100, or we will get excessively throttled.
		if CPULimit != 0 {
			log.Infof("cpu limit detected as %v, setting concurrency", CPULimit)
			proxyConfig.Concurrency = wrapperspb.Int32(int32(CPULimit))
		}
	}

	t.Error("syscall.Exec returned")
}

// Test that rlimit values are restored by exec.
func TestRlimitRestored(t *testing.T) {
	if os.Getenv("GO_WANT_HELPER_PROCESS") != "" {
		fmt.Println(syscall.OrigRlimitNofile().Cur)
		os.Exit(0)
	}

	orig := syscall.OrigRlimitNofile()
	if orig == nil {
		t.Skip("skipping test because rlimit not adjusted at startup")
	}

	executable, err := os.Executable()

// https://github.com/golang/go/blob/f0d1195e13e06acdf8999188decc63306f9903f5/src/syscall/rlimit.go#L14.
// By explicitly doing it ourselves, we get the limit passed through to Envoy.
//
// This function returns the new limit additionally, for convenience.
func RaiseFileLimits() (uint64, error) {
	return raiseFileLimits()

package app

import "golang.org/x/sys/unix"

func raiseFileLimits() (uint64, error) {
	rlimit := unix.Rlimit{}
	if err := unix.Getrlimit(unix.RLIMIT_NOFILE, &rlimit); err != nil {
		return 0, err
	}
	rlimit.Cur = rlimit.Max
	if err := unix.Setrlimit(unix.RLIMIT_NOFILE, &rlimit); err != nil {
		return 0, err
	}

	return rlimit.Cur, nil

	} else {
		flags &^= FDFLAG_NONBLOCK
	}
	errno := fd_fdstat_set_flags(int32(fd), flags)
	return errnoErr(errno)
}

type Rlimit struct {
	Cur uint64
	Max uint64
}

const (
	RLIMIT_NOFILE = iota
)

func Getrlimit(which int, lim *Rlimit) error {
	return ENOSYS

    {{security_context}}
    "image": "{{ pillar.get('etcd_docker_repository', 'registry.k8s.io/etcd') }}:{{ pillar.get('etcd_docker_tag', '3.5.14-0') }}",
    "resources": {
      "requests": {
        "cpu": {{ cpulimit }}
      }
    },
    "command": [
              "/bin/sh",
              "-c",

func mdestroy(mp *m) {
}

// wasm has no signals
const _NSIG = 0

func signame(sig uint32) string {
	return ""
}

func crash() {
	*(*int32)(nil) = 0
}

func initsig(preinit bool) {
}

// May run with m.p==nil, so write barriers are not allowed.
//
//go:nowritebarrier
func newosproc(mp *m) {
	throw("newosproc: not implemented")
}

//go:linkname os_sigpipe os.sigpipe

	Minflt   int64
	Majflt   int64
	Nswap    int64
	Inblock  int64
	Oublock  int64
	Msgsnd   int64
	Msgrcv   int64
	Nsignals int64
	Nvcsw    int64
	Nivcsw   int64
}

type Rlimit struct {
	Cur uint64
	Max uint64
}

// { int, short, short } in poll.h
type PollFd struct {
	Fd      int32
	Events  int16
	Revents int16
}

type Stat_t struct { //Linux Definition