// `resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the
  // target resource.
  // At least one of `resourceRules` and `nonResourceRules` has to be non-empty.
  // +listType=atomic
  // +optional
  repeated ResourcePolicyRule resourceRules = 2;

  // `nonResourceRules` is a list of NonResourcePolicyRules that identify matching requests according to their verb

- Fixes issue where you can't attach more than 15 GCE Persistent Disks to c2, n2, m1, m2 machine types. ([#88602](https://github.com/kubernetes/kubernetes/pull/88602), [@yuga711](https://github.com/yuga711)) [SIG Storage]

- For resources built into an apiserver, the server now logs at `-v=3` whether it is using watch caching. ([#109175](https://github.com/kubernetes/kubernetes/pull/109175), [@MikeSpreitzer](https://github.com/MikeSpreitzer)) [SIG API Machinery]

  // +optional
  optional string path = 1;

  // pathType determines the interpretation of the path matching. PathType can
  // be one of the following values:
  // * Exact: Matches the URL path exactly.
  // * Prefix: Matches based on a URL path prefix split by '/'. Matching is
  //   done on a path element by element basis. A path element refers is the

  - [Urgent Upgrade Notes](#urgent-upgrade-notes)
    - [(No, really, you MUST do this before you upgrade)](#no-really-you-must-do-this-before-you-upgrade)
  - [Major Themes](#major-themes)
    - [SIG API Machinery](#sig-api-machinery)
    - [SIG Auth](#sig-auth)
    - [SIG CLI](#sig-cli)
    - [SIG Cluster Lifecycle](#sig-cluster-lifecycle)
    - [SIG Instrumentation](#sig-instrumentation)
    - [SIG Network](#sig-network)

- Kube-apiserver: fixes a 1.27+ regression watching a single namespace via the deprecated /api/v1/watch/namespaces/$name endpoint where watch events were not delivered after the watch was established ([#126150](https://github.com/kubernetes/kubernetes/pull/126150), [@xyz-li](https://github.com/xyz-li)) [SIG API Machinery and Testing]

import static com.google.common.base.Preconditions.checkNotNull;

import java.util.Map;
import javax.annotation.CheckForNull;

/**
 * A {@link MapIteratorCache} that adds additional caching. In addition to the caching provided by
 * {@link MapIteratorCache}, this structure caches values for the two most recently retrieved keys.
 *
 * @author James Sexton
 */
@ElementTypesAreNonnullByDefault

	expireYaml := `
expire: # Expire objects that match a condition
  apiVersion: v1
  bucket: mybucket # Bucket where this batch job will expire matching objects from
  prefix: myprefix # (Optional) Prefix under which this job will expire objects matching the rules below.
  rules:
    - type: object  # regular objects with zero or more older versions
      name: NAME # match object names that satisfy the wildcard expression.

			fmt.Fprintf(writer, "%sWARNING POD DOES NOT MATCH ANY SUBSETS.  (Non matching subsets %s)\n",
				printSpaces(initPrintNum+printLevel1), strings.Join(nonmatchingSubsets, ","))
		}
		fmt.Fprintf(writer, "%sMatching subsets: %s\n",
			printSpaces(initPrintNum+printLevel1), strings.Join(matchingSubsets, ","))
		if len(nonmatchingSubsets) > 0 {
			fmt.Fprintf(writer, "%s(Non-matching subsets %s)\n",

  // NamespaceSelector decides whether to run the webhook on an object based
  // on whether the namespace for that object matches the selector. If the
  // object itself is a namespace, the matching is performed on
  // object.metadata.labels. If the object is another cluster scoped resource,
  // it never skips the webhook.
  //
  // For example, to run the webhook on any objects whose namespace is not