feature gates enabled) that their pods could get stuck in the pending phase when deleted.
  
  Users who maintain controllers which relied on the fact that pods with RestartPolicy=Always
  never enter the Succeeded phase may need to adapt their controllers. This is because as a consequence of 
  the change pods which use RestartPolicy=Always may end up in the Succeeded phase in two scenarios: pod 

  * Stop 'kubectl drain' deleting pods with local storage.
  * Add `kubectl rollout status`
* Security/Auth
  * L7 LB controller and disk attach controllers run on master, so nodes do not need those privileges.
  * Setting TLS1.2 minimum
  * `kubectl create secret tls` command
  * Webhook Token Authenticator
  * **beta** PodSecurityPolicy objects limits use of security-sensitive features by pods.
* Kubectl

     * ImmutableSortedSet#orderedBy}.
     */
    /*
     * TODO(cpovirk): use Object[] instead of E[] in the mainline? (The backport is different and
     * doesn't need this suppression, but we keep it to minimize diffs.) Generally be more clear
     * about when we have an Object[] vs. a Comparable[] or other array type in internalArray? If we

          exception = e;
        } else {
          exception.addSuppressed(e);
        }
      }
    }
    if (exception != null) {
      // Normally this is a RuntimeException that doesn't need sneakyThrow.
      // But theoretically we could see sneaky checked exception
      sneakyThrow(exception);
    }
  }

  /** Throws an undeclared checked exception. */

    }
  }

  private static Iterator<Integer> iterateOver(int... values) {
    // Note: Ints.asList's iterator does not support remove which we need for testing.
    return new ArrayList<>(Ints.asList(values)).iterator();
  }

  public void testElementsEqual() {
    Iterable<?> a;
    Iterable<?> b;

    // Base case.
    a = Lists.newArrayList();

- kube-controller-manager currently needs a writable `--cert-dir` (default is `/var/run/kubernetes`) for generating self-signed certificates, when no `--tls-cert-file` or `--tls-private-key-file` are provided.

### kubectl rolling-update: < v1.4.0 client vs >=v1.4.0 cluster

Old version kubectl's rolling-update command is compatible with Kubernetes 1.4 and higher only if you specify a new replication controller name. You will need to update to kubectl 1.4 or higher to use the rolling update command against a 1.4 cluster if you want to keep the original name, or you'll have to do two rolling updates.

                }
                else if ( last == null ) {
                    // don't have enough credits/space for the first request, block until available
                    // for space there is nothing we can do, callers need to make sure that a single message fits

                    try {
                        long timeout = getResponseTimeout(chain);
                        if ( params.contains(RequestParam.NO_TIMEOUT) ) {

			if err != tc.expectedParsingErr {
				t.Fatalf("%d: Expected %v during parsing but got %v", i+1, tc.expectedParsingErr, err)
			}
			if tc.expectedParsingErr != nil {
				// We already expect a parsing error,
				// no need to continue this test.
				return
			}
			err = lc.Validate(tc.lr)
			if err != tc.expectedValidationErr {
				t.Fatalf("%d: Expected %v during validation but got %v", i+1, tc.expectedValidationErr, err)
			}

		}
		targetGroups = requestorGroups

		// In case of LDAP/OIDC we need to set `opts.claims` to ensure
		// it is associated with the LDAP/OIDC user properly.
		for k, v := range cred.Claims {
			if k == expClaim {
				continue
			}
			opts.claims[k] = v
		}
	} else if globalIAMSys.LDAPConfig.Enabled() {
		// In case of LDAP we need to resolve the targetUser to a DN and
		// query their groups: