obj.DefaultMode = &perm
	}
}
func SetDefaults_ServiceAccountTokenProjection(obj *v1.ServiceAccountTokenProjection) {
	hour := int64(time.Hour.Seconds())
	if obj.ExpirationSeconds == nil {
		obj.ExpirationSeconds = &hour
	}
}
func SetDefaults_PersistentVolume(obj *v1.PersistentVolume) {
	if obj.Status.Phase == "" {
		obj.Status.Phase = v1.VolumePending
	}

	if err != nil {
		return Cert{}, fmt.Errorf("creating citadel client: %v", err)
	}
	req := &pb.IstioCertificateRequest{
		Csr:              string(csrPEM),
		ValidityDuration: int64((time.Hour * 24 * 7).Seconds()),
	}
	rctx := metadata.NewOutgoingContext(context.Background(), metadata.Pairs("Authorization", "Bearer "+token, "ClusterID", constants.DefaultClusterName))
	resp, err := client.CreateCertificate(rctx, req)

		expectedExp time.Time
		expectedErr error
	}{
		"jwt with expiration time": {
			jwt:         thirdPartyJwt,
			expectedExp: time.Date(2020, time.April, 5, 10, 13, 54, 0, time.FixedZone("PDT", -int((7*time.Hour).Seconds()))),
			expectedErr: nil,
		},
		"jwt with no expiration time": {
			jwt:         firstPartyJwt,
			expectedExp: time.Time{},
			expectedErr: nil,
		},
		"invalid jwt": {

			withClientCert:         true,
			command:                "user",
			additionalFlags:        []string{"--validity-period=12h"},
			expectedValidityPeriod: 12 * time.Hour,
		},
	}

	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			buf := new(bytes.Buffer)

			// Get subcommands working in the temporary directory
			cmd := newCmdUserKubeConfig(buf)

			obj.RegistryBurst = 10
			obj.RegistryPullQPS = 5
			obj.ResolverConfig = kubetypes.ResolvConfDefault
			obj.SerializeImagePulls = true
			obj.StreamingConnectionIdleTimeout = metav1.Duration{Duration: 4 * time.Hour}
			obj.SyncFrequency = metav1.Duration{Duration: 1 * time.Minute}
			obj.ContentType = "application/vnd.kubernetes.protobuf"
			obj.KubeAPIQPS = 50
			obj.KubeAPIBurst = 100
			obj.HairpinMode = v1beta1.PromiscuousBridge

	defer t.mu.RUnlock()

	if t.staleUploadsCleanupInterval == 0 {
		return 6 * time.Hour // default 6 hours
	}

	return t.staleUploadsCleanupInterval
}

func (t *apiConfig) getStaleUploadsExpiry() time.Duration {
	t.mu.RLock()
	defer t.mu.RUnlock()

	if t.staleUploadsExpiry == 0 {
		return 24 * time.Hour // default 24 hours
	}

	return t.staleUploadsExpiry
}

	}

	{
		t.Log("test sending log with specified time")

		// Clean up all the mssages, and log again. Check that buffer is cleaned up properly.
		srv.messages = make([]string, 0)
		yesterday := time.Now().Add(-time.Hour * 24).Truncate(time.Microsecond)
		defaultScope.LogWithTime(InfoLevel, "test3", yesterday)
		Sync()
		// There should only be one message in the buffer
		if got, want := len(srv.messages), 1; got != want {

		{"ms", []string{"ms", "millisecond"}, float64(time.Millisecond)},
		{"s", []string{"s", "sec", "second"}, float64(time.Second)},
		{"hrs", []string{"hour", "hr"}, float64(time.Hour)},
	},
	DefaultUnit: Unit{"s", []string{}, float64(time.Second)},
}, {
	Units: []Unit{
		{"n*GCU", []string{"nanogcu"}, 1e-9},
		{"u*GCU", []string{"microgcu"}, 1e-6},

By default, the temporary security credentials created by AssumeRoleWithClientGrants last for one hour. However, use the optional DurationSeconds parameter to specify the duration of the credentials. This value varies from 900 seconds (15 minutes) up to the maximum session duration of 365 days.

## API Request Parameters

### Token

	"istio.io/istio/istioctl/pkg/clioptions"
	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pkg/adsc"
	"istio.io/istio/pkg/kube"
)

const (
	// defaultExpirationSeconds is how long-lived a token to request (an hour)
	defaultExpirationSeconds = 60 * 60
)

// Audience to create tokens for
var tokenAudiences = []string{"istio-ca"}

// GetXdsResponse opens a gRPC connection to opts.xds and waits for a single response