"-j", "CONNMARK",
		"--set-xmark", inpodTproxyMark)

	// Handle healthcheck probes from the host node. In the host netns, before the packet enters the pod, we SNAT
	// the healthcheck packet to a fixed IP if the packet is coming from a node-local process with a socket.
	//
	// We do this so we can exempt this traffic from ztunnel capture/proxy - otherwise both kube-proxy (legit)

		}
		msg.Msg = strings.TrimSpace(msg.Msg)
		messages = append(messages, msg)
	}
	// Lock log message printing to prevent log messages from different CNI
	// processes interleave.
	l.mu.Lock()
	defer l.mu.Unlock()
	for _, m := range messages {
		// There is no fatal log from CNI plugin
		switch m.Level {
		case "debug":
			pluginLog.LogWithTime(log.DebugLevel, m.Msg, m.Time)
		case "info":

		cache.iamGroupPolicyMap.Store(name, mp)
	}
	cache.updatedAt = time.Now()
	return mp.UpdatedAt, nil
}

// PolicyNotificationHandler - loads given policy from storage. If not present,
// deletes from cache. This notification only reads from storage, and updates
// cache. When the notification is for a policy deletion, it updates the
// user-policy and group-policy maps as well.

// The listPathOptions given will be checked and modified internally.
// Required important fields are Bucket, Prefix, Separator.
// Other important fields are Limit, Marker.
// List ID always derived from the Marker.
func (z *erasureServerPools) listPath(ctx context.Context, o *listPathOptions) (entries metaCacheEntriesSorted, err error) {
	if err := checkListObjsArgs(ctx, o.Bucket, o.Prefix, o.Marker); err != nil {

		// Get last part of path string.
		ps = ps[idx+1:]
	}
	return ps, true
}

// HasKeypath returns if the from clause has a key path -
// e.g. S3object[*].id
func (from *TableExpression) HasKeypath() bool {
	return len(from.Table.PathExpr) > 1

}

// SetTransitionState sets ILM transition related information from given info.
func (os *objSweeper) SetTransitionState(info TransitionedObject) {
	os.TransitionTier = info.Tier
	os.TransitionStatus = info.Status
	os.RemoteObject = info.Name
	os.TransitionVersionID = info.VersionID
}

// shouldRemoveRemoteObject determines if a transitioned object should be
// removed from remote tier. If remote object is to be deleted, returns the

func Requested(h http.Header) bool {
	return S3.IsRequested(h) || S3KMS.IsRequested(h) || SSEC.IsRequested(h)
}

// UnsealObjectKey extracts and decrypts the sealed object key
// from the metadata using the SSE-Copy client key of the HTTP headers
// and returns the decrypted object key.
func (sse ssecCopy) UnsealObjectKey(h http.Header, metadata map[string]string, bucket, object string) (key ObjectKey, err error) {

				exp.As = exp.As[1 : len(exp.As)-1]
			}
		}
	}
	return
}

func validateTableName(from *TableExpression) error {
	if !strings.EqualFold(from.Table.BaseKey.String(), baseTableName) {
		return errBadTableName(errors.New("table name must be `s3object`"))
	}

	if len(from.Table.PathExpr) > 0 {
		if !from.Table.PathExpr[0].ArrayWildcard {

			"SELECT * FROM `users` WHERE name = ? AND `users`.`deleted_at` IS NULL ORDER BY `users`.`id` LIMIT ?",
			"INSERT INTO `users` (`created_at`,`updated_at`,`deleted_at`,`name`,`age`,`birthday`,`company_id`,`manager_id`,`active`) VALUES (?,?,?,?,?,?,?,?,?)",
			"SELECT * FROM `users` WHERE name = ? AND `users`.`deleted_at` IS NULL ORDER BY `users`.`id` LIMIT ?",

	var result5 NamedUser
	if err := DB.Raw("SELECT * FROM named_users WHERE (name1 = @name AND name3 = @name) AND name2 = @name2", map[string]interface{}{"name": "jinzhu-new", "name2": "jinzhu-new2"}).Find(&result5).Error; err != nil {
		t.Errorf("failed to update with named arg")
	}

	AssertEqual(t, result5, namedUser)

	var result6 NamedUser
	if err := DB.Raw(`SELECT * FROM named_users WHERE (name1 = @name