} catch (ClassCastException acceptable) {
      // allowed by the spec
    }
  }

  public void testContainsEntryWithIncomparableValue() {
    try {
      assertFalse(getMap().entrySet().contains(mapEntry(k0(), IncomparableType.INSTANCE)));
    } catch (ClassCastException acceptable) {
      // allowed by the spec
    }
  }

  @MapFeature.Require(ALLOWS_NULL_KEY_QUERIES)

```

See <https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html> for AWS S3 spec on object locking and permissions required for object retention and governance bypass overrides.

### Set legal hold on an object

PutObject API allows setting legal hold using `x-amz-object-lock-legal-hold` header.

```sh

    } catch (ClassCastException acceptable) {
      // allowed by the spec
    }
  }

  public void testContainsEntryWithIncomparableValue() {
    try {
      assertFalse(getMap().entrySet().contains(mapEntry(k0(), IncomparableType.INSTANCE)));
    } catch (ClassCastException acceptable) {
      // allowed by the spec
    }
  }

  @MapFeature.Require(ALLOWS_NULL_KEY_QUERIES)

			PodIPs: []corev1.PodIP{{IP: "2.2.2.2"}, {IP: "3.3.3.3"}},
		}
	}

	return &corev1.Pod{
		ObjectMeta: metav1.ObjectMeta{
			Name:      "foo",
			Namespace: "bar",
			UID:       "123",
		},
		Spec: corev1.PodSpec{
			Containers: containers,
		},
		Status: podStatus,
	}
}

func TestServerAddPod(t *testing.T) {
	ctx, cancel := context.WithCancel(context.Background())
	defer cancel()

var (
	defaultYAML = `apiVersion: networking.istio.io/v1
kind: WorkloadGroup
metadata:
  name: foo
  namespace: bar
spec:
  metadata: {}
  template:
    serviceAccount: default
`

	customYAML = `apiVersion: networking.istio.io/v1
kind: WorkloadGroup
metadata:
  name: foo
  namespace: bar
spec:
  metadata:
    annotations:
      annotation: foobar
    labels:
      app: foo
      bar: baz
  template:

			}
		})
	}
}

func attachPod(ns string) *corev1.Pod {
	return &corev1.Pod{
		ObjectMeta: metav1.ObjectMeta{Name: "foo-abc", Namespace: ns, ResourceVersion: "10"},
		Spec: corev1.PodSpec{
			RestartPolicy: corev1.RestartPolicyAlways,
			DNSPolicy:     corev1.DNSClusterFirst,
			Containers: []corev1.Container{
				{
					Name: "bar",
				},
			},

    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
  {{- if .Values.consoleService.annotations }}
  annotations: {{- toYaml .Values.consoleService.annotations | nindent 4 }}
  {{- end }}
spec:
  type: {{ .Values.consoleService.type }}
  {{- if and (eq .Values.consoleService.type "ClusterIP") .Values.consoleService.clusterIP }}
  clusterIP: {{ .Values.consoleService.clusterIP }}
  {{- end }}

  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // spec contains the certificate request, and is immutable after creation.
  // Only the request, signerName, expirationSeconds, and usages fields can be set on creation.
  // Other fields are derived by Kubernetes and cannot be modified by users.
  optional CertificateSigningRequestSpec spec = 2;

  // Derived information about the request.
  // +optional

    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
    monitoring: "true"
  {{- if .Values.service.annotations }}
  annotations: {{- toYaml .Values.service.annotations | nindent 4 }}
  {{- end }}
spec:
  type: {{ .Values.service.type }}
  {{- if and (eq .Values.service.type "ClusterIP") .Values.service.clusterIP }}
  clusterIP: {{ .Values.service.clusterIP }}
  {{- end }}

*.egg-info/
.installed.cfg
*.egg
MANIFEST

# PyInstaller
#  Usually these files are written by a python script from a template
#  before PyInstaller builds the exe, so as to inject date/other infos into it.
*.manifest
*.spec

# Installer logs
pip-log.txt
pip-delete-this-directory.txt

# Unit test / coverage reports
htmlcov/
.tox/
.coverage
.coverage.*
.cache
nosetests.xml
coverage.xml
*.cover
.hypothesis/