// (see https://docs.google.com/document/d/1F__vEKeI41P7PPUCMM9PVPYY34pyrvQI5rbTJVnS5c4)
func clusterUID(client kubernetes.Interface) (types.UID, error) {
	kubeSystem, err := client.CoreV1().Namespaces().Get(context.TODO(), "kube-system", metav1.GetOptions{})
	if err != nil {
		return "", err
	}
	return kubeSystem.UID, nil

		want *Header
		ok   bool
	}{{
		in: map[string]string{
			"path":  "a/b/c",
			"uid":   "1000",
			"mtime": "1350244992.023960108",
		},
		want: &Header{
			Name:    "a/b/c",
			Uid:     1000,
			ModTime: time.Unix(1350244992, 23960108),
			PAXRecords: map[string]string{
				"path":  "a/b/c",
				"uid":   "1000",
				"mtime": "1350244992.023960108",
			},
		},
		ok: true,
	}, {

		resource := fmt.Sprintf("bucket/get-object-%d", i)
		lri := lockRequesterInfo{
			Name:   resource,
			UID:    mustGetUUID(),
			Owner:  owners[i%len(owners)],
			Quorum: 2,
		}
		lris = append(lris, lri)
		locksHeld[resource] = append(locksHeld[resource], lri)
		// concurrent read lock, same resource different uid
		lri.UID = mustGetUUID()
		lris = append(lris, lri)
		locksHeld[resource] = append(locksHeld[resource], lri)
	}

        this.pid = pid;
    }


    /**
     * @return the uid
     */
    public final int getUid () {
        return this.uid;
    }


    /**
     * @param uid
     *            the uid to set
     */
    @Override
    public final void setUid ( int uid ) {
        this.uid = uid;
    }


    /**
     * @return the signSeq
     */

MOUNT_SOURCE="${MOUNT_SOURCE:-${PWD}}"
MOUNT_DEST="${MOUNT_DEST:-/work}"

read -ra DOCKER_RUN_OPTIONS <<< "${DOCKER_RUN_OPTIONS:-}"

[[ -t 0 ]] && DOCKER_RUN_OPTIONS+=("-it")
[[ ${UID} -ne 0 ]] && DOCKER_RUN_OPTIONS+=(-u "${UID}:${DOCKER_GID}")

# $CONTAINER_OPTIONS becomes an empty arg when quoted, so SC2086 is disabled for the
# following command only
# shellcheck disable=SC2086
"${CONTAINER_CLI}" run \
    --rm \

# This shows an example local config for ztunnel that adds a workload for localhost.
# This allows local testing by sending requests through the local ztunnel to other servers running on localhost.
workloads:
- uid: cluster1//v1/Pod/default/local
  name: local
  namespace: default
  serviceAccount: default
  workloadIps: ["127.0.0.1"]
  protocol: HBONE
  node: local
  network: ""
  services:
    "default/example.com":
      80: 8080

				Size:     5,
				Mode:     0640,
				Uid:      73025,
				Gid:      5000,
				Uname:    "dsymonds",
				Gname:    "eng",
				ModTime:  time.Unix(1246508266, 0),
			}, nil},
			testWrite{"Kilts", 5, nil},

			testHeader{Header{
				Typeflag: TypeReg,
				Name:     "small2.txt",
				Size:     11,
				Mode:     0640,
				Uid:      73025,
				Uname:    "dsymonds",
				Gname:    "eng",

-A OUTPUT -p tcp -j ISTIO_OUTPUT
-A ISTIO_OUTPUT -p tcp --dport 15020 -j RETURN
-A ISTIO_OUTPUT -o lo -s 127.0.0.6/32 -j RETURN
-A ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --uid-owner 1337 -j ISTIO_IN_REDIRECT
-A ISTIO_OUTPUT -m owner --uid-owner 1337 -j RETURN
-A ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 1337 -j ISTIO_IN_REDIRECT
-A ISTIO_OUTPUT -m owner --gid-owner 1337 -j RETURN

		},
		{
			name:        "custom-uid",
			annotations: map[string]string{annotation.SidecarStatus.Name: "true"},
			customUID:   &customUID,
			customGID:   &customGID,
			golden:      filepath.Join(env.IstioSrc, "cni/pkg/plugin/testdata/custom-uid.txt.golden"),
		},
		{
			name:        "custom-uid-zero",
			annotations: map[string]string{annotation.SidecarStatus.Name: "true"},

		lookup_bind_password=admin \
		user_dn_search_base_dn=dc=min,dc=io \
		user_dn_search_filter="(uid=%s)" \
		group_search_base_dn=ou=swengg,dc=min,dc=io \
		group_search_filter="(&(objectclass=groupOfNames)(member=%d))"
	mc admin service restart old-minio

	mc idp ldap policy attach old-minio readwrite --user=UID=dillon,ou=people,ou=swengg,dc=min,dc=io