* types that contain an embedded IPv4 address.
   *
   * <p>NOTE: ISATAP addresses are explicitly excluded from this method due to their trivial
   * spoofability. With other transition addresses spoofing involves (at least) infection of one's
   * BGP routing table.
   *
   * @param ip {@link Inet6Address} to be examined for embedded IPv4 client address
   * @return {@code true} if there is an embedded IPv4 client address
   * @since 7.0
   */

   * types that contain an embedded IPv4 address.
   *
   * <p>NOTE: ISATAP addresses are explicitly excluded from this method due to their trivial
   * spoofability. With other transition addresses spoofing involves (at least) infection of one's
   * BGP routing table.
   *
   * @param ip {@link Inet6Address} to be examined for embedded IPv4 client address
   * @return {@code true} if there is an embedded IPv4 client address
   * @since 7.0
   */

 * but given that any public suffix may become a host without warning, it is better to err on the
 * side of permissiveness and thus avoid spurious rejection of valid sites. Of course, to actually
 * determine addressability of any host, clients of this class will need to perform their own DNS
 * lookups.
 *
 * <p>During construction, names are normalized in two ways:
 *

    return (ImmutableSet<E>) RegularImmutableSet.EMPTY;
  }

  /**
   * Returns an immutable set containing the given element. Preferred over {@link
   * Collections#singleton} for code consistency, {@code null} rejection, and because the return
   * type conveys the immutability guarantee.
   */
  public static <E> ImmutableSet<E> of(E e1) {
    return new SingletonImmutableSet<>(e1);
  }

  /*

%v", err) } if strings.Contains(t.Name(), "/Path/") { // For path coverage tests, check that we hit all rejection paths. reached := map[string]bool{"z": false, "r0": false, "ct0": false, "h": false} // The ct0 rejection is only reachable for ML-DSA-44. if priv.PublicKey().Parameters() != "ML-DSA-44" { delete(reached, "ct0") } testingOnlyRejection = func(reason string) { t.Log(reason, "rejection") reached[reason] = true } t.Cleanup(func() { testingOnlyRejection = nil }) defer func() { for reason, hit...

### Bug or Regression

- Add a new counter metrics `apiserver_admission_webhook_rejection_count` with details about the causing for a webhook rejection. ([#81399](https://github.com/kubernetes/kubernetes/pull/81399), [@roycaihw](https://github.com/roycaihw))

- Added `kubelet` stress test for pod cleanup when rejection due to `VolumeAttachmentLimitExceeded`. ([#133357](https://github.com/kubernetes/kubernetes/pull/133357), [@torredil](https://github.com/torredil)) [SIG Node and Storage]

- A pod that the Kubelet rejects was still considered as being accepted for a brief period of time after rejection, which might cause some pods to be rejected briefly that could fit on the node.  A pod that is still terminating (but has status indicating it has failed) may also still be consuming resources and so should also be considered. ([#104817](https:/...

fipsPCT(c, priv) return priv, nil } // randomPoint returns a random scalar and the corresponding point using a // procedure equivalent to FIPS 186-5, Appendix A.2.2 (ECDSA Key Pair Generation // by Rejection Sampling) and to Appendix A.3.2 (Per-Message Secret Number // Generation of Private Keys by Rejection Sampling) or Appendix A.3.3 // (Per-Message Secret Number Generation for Deterministic ECDSA) followed by // Step 5 of Section 6.4.1. func randomPoint[P Point[P]](c *Curve[P], generate func([]byte)...