runAsUser: {{ .Values.securityContext.runAsUser }}
        runAsGroup: {{ .Values.securityContext.runAsGroup }}
        fsGroup: {{ .Values.securityContext.fsGroup }}
        {{- if and (ge .Capabilities.KubeVersion.Major "1") (ge .Capabilities.KubeVersion.Minor "20") }}
        fsGroupChangePolicy: {{ .Values.securityContext.fsGroupChangePolicy }}
        {{- end }}
      {{- end }}
      {{- if .Values.serviceAccount.create }}

        return this.selectedPreauthHash;
    }


    /**
     * @return the server returned capabilities
     */
    public final int getCapabilities () {
        return this.capabilities;
    }


    /**
     * @return the common/negotiated capabilieis
     */
    public final int getCommonCapabilities () {
        return this.commonCapabilities;
    }


    /**

        super(context.getConfig(), SMB2_SESSION_SETUP);
        this.securityMode = securityMode;
        this.capabilities = capabilities;
        this.previousSessionId = previousSessionid;
        this.token = token;
    }


    @Override
    protected Smb2SessionSetupResponse createResponse ( CIFSContext tc, ServerMessageBlock2Request<Smb2SessionSetupResponse> req ) {

            # But we don't need _everything_ in `privileged`, so drop+readd capabilities based on feature.
            # privileged is redundant with CAP_SYS_ADMIN
            # since it's redundant, hardcode it to `true`, then manually drop ALL + readd granular
            # capabilities we actually require
            capabilities:
              drop:
              - ALL
              add:

            selectHighestVersion()
        }
    }
}

fun readCapabilitiesFromJson() {
    val capabilitiesFile = repoRoot().file("gradle/dependency-management/capabilities.json").asFile
    val capabilities: List<CapabilitySpec> = readCapabilities(capabilitiesFile)
    capabilities.forEach {
        it.configure(dependencies.components, configurations)
    }
}

fun readCapabilities(source: File): List<CapabilitySpec> {

        snd_buf_size = Math.min( snd_buf_size, server.maxBufferSize );
        capabilities &= server.capabilities;
        if ((server.capabilities & CAP_EXTENDED_SECURITY) == CAP_EXTENDED_SECURITY)
            capabilities |= CAP_EXTENDED_SECURITY; // & doesn't copy high bit

        if ((capabilities & ServerMessageBlock.CAP_UNICODE) == 0) {
            // server doesn't want unicode

            ",maxRawSize="          + server.maxRawSize +
            ",sessionKey=0x"        + Hexdump.toHexString( server.sessionKey, 8 ) +
            ",capabilities=0x"      + Hexdump.toHexString( server.capabilities, 8 ) +
            ",serverTime="          + new Date( server.serverTime ) +
            ",serverTimeZone="      + server.serverTimeZone +

        imagePullPolicy: {{ . }}
{{- end }}
        securityContext:
          allowPrivilegeEscalation: false
          privileged: false
          capabilities:
            drop:
            - ALL
            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
            - NET_ADMIN # Required for TPROXY and setsockopt
            - SYS_ADMIN # Required for `setns` - doing things in other netns

      "policy": {
        "type": "k8s"
      },
      "kubernetes": {
        "kubeconfig": "/etc/cni/net.d/calico-kubeconfig"
      }
    },
    {
      "type": "portmap",
      "snat": true,
      "capabilities": {
        "portMappings": true
      }
    }
  ]

  // requiredDropCapabilities are the capabilities that will be dropped from the container.  These
  // are required to be dropped and cannot be added.
  // +optional
  repeated string requiredDropCapabilities = 3;

  // allowedCapabilities is a list of capabilities that can be requested to add to the container.
  // Capabilities in this field may be added at the pod author's discretion.