- [PRF](#prf): HMAC-SHA-256
- [AEAD](#aead): AES-256-GCM if the CPU supports AES-NI, ChaCha20-Poly1305 otherwise. More specifically AES-256-GCM is only selected for X86-64 CPUs with AES-NI extension.

Further any secret key (apart from the KMS-generated ones) is 256 bits long. The KMS-generated keys may be 256 bits but this depends on the KMS capabilities and configuration.

                .longOpt("non-recursive")
                .desc(
                        "Do not recurse into sub-projects. When used together with -pl, do not recurse into sub-projects of selected aggregators")
                .build());
        options.addOption(Option.builder(Character.toString(UPDATE_SNAPSHOTS))
                .longOpt("update-snapshots")

#### Discovery Filter

The Discovery Filter controller is used to implement the `discoverySelectors` field of `MeshConfig`. This controller reads `Namespace`s in the cluster to determine if they should be "selected". Many controllers consumer this filter to only process a subset of configurations.

#### Multicluster

Various controllers read from multiple clusters.

        final List<? extends RESULT> list = delegateSelectList(cb, entityType);
        if (list.isEmpty()) {
            return null;
        }
        if (list.size() >= 2) {
            String msg = "The size of selected list is over 1: " + list.size();
            throw new FetchingOverSafetySizeException(msg, 1); // immediately caught by caller and translated
        }
        return list.get(0);
    }

    @Override

  // zero and not specified. Defaults to 1.
  // +optional
  optional int32 replicas = 1;

  // selector is the label selector for pods. Existing ReplicaSets whose pods are
  // selected by this will be the ones affected by this deployment.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;

  // Template describes the pods that will be created.

  // zero and not specified. Defaults to 1.
  // +optional
  optional int32 replicas = 1;

  // Label selector for pods. Existing ReplicaSets whose pods are
  // selected by this will be the ones affected by this deployment.
  // It must match the pod template's labels.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;

  // Template describes the pods that will be created.

tion` and `DeleteReplication` fields in the replication configuration above. By default, this is set to `Disabled` unless the user specifies it while adding a replication rule.

When an object is deleted from the source bucket, the corresponding replica version will be marked deleted if delete marker replication is enabled in the replication configuration. Replication of deletes that specify a version id (a.k.a hard deletes) can be enabled by setting the `DeleteReplication` status to enabled...

The obvious solution to this is to put the list of selected workloads into the policy itself.
However, this means anytime a workload changes (often), we need to update the policy.

Instead, the opposite was chosen: each workload will list the policies that select it.
This works out to be more efficient in common cases where policies change much less often than workloads.

        final List<? extends RESULT> list = delegateSelectList(cb, entityType);
        if (list.isEmpty()) {
            return null;
        }
        if (list.size() >= 2) {
            String msg = "The size of selected list is over 1: " + list.size();
            throw new FetchingOverSafetySizeException(msg, 1); // immediately caught by caller and translated
        }
        return list.get(0);
    }

    @Override

        final List<? extends RESULT> list = delegateSelectList(cb, entityType);
        if (list.isEmpty()) {
            return null;
        }
        if (list.size() >= 2) {
            String msg = "The size of selected list is over 1: " + list.size();
            throw new FetchingOverSafetySizeException(msg, 1); // immediately caught by caller and translated
        }
        return list.get(0);
    }

    @Override