}
		})
	}
}

func makeOverlayHeader(path, value string) string {
	const (
		patchCommon = `overlays:
- kind: Deployment
  name: istio-citadel
  patches:
  - path: `
		valueStr = `    value: `
	)

	ret := patchCommon
	ret += fmt.Sprintf("%s\n", path)
	if value != "" {
		ret += fmt.Sprintf("%s%s\n", valueStr, value)
	}
	return ret
}

```yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    pilot:
      k8s:
        overlays:
        - kind: Deployment
          name: istio-pilot
          patches:
          - path: spec.template.spec.containers.[name:discovery].args.[30m]
            value: "60m" # OVERRIDDEN
          - path: spec.template.spec.containers.[name:discovery].ports.[containerPort:8080].containerPort

			return nil, err
		}
	}

	out := make(map[string]any)
	err = yaml.Unmarshal([]byte(by), &out)
	if err != nil {
		return nil, err
	}
	return out, nil
}

// OverlayYAML patches the overlay tree over the base tree and returns the result. All trees are expressed as YAML
// strings.
func OverlayYAML(base, overlay string) (string, error) {
	if strings.TrimSpace(base) == "" {
		return overlay, nil

            //
            // We assume that a test-only dependency is not a module, which corresponds to how Eclipse does test running for modules:
            // It patches the main module with the tests and expects test dependencies to be part of the unnamed module (classpath).
            return javaModuleDetector.isModule(inferModulePath && !testOnly, artifact);
        }

		},
		{
			name:  "valid-negative-index-patch",
			patch: `[{"op": "test", "value": "foo", "path": "/metadata/finalizers/-1"}]`,
		},
	} {
		p := &patcher{
			patchType:  types.JSONPatchType,
			patchBytes: []byte(test.patch),
		}
		jp := jsonPatcher{patcher: p}
		codec := codecs.LegacyCodec(examplev1.SchemeGroupVersion)
		pod := &examplev1.Pod{}
		pod.Name = "podA"
		pod.ObjectMeta.Finalizers = []string{"foo"}

  echo
  echo "  Set the DRY_RUN environment var to skip git push and creating PR."
  echo "  This is useful for creating patches to a release branch without making a PR."
  echo "  When DRY_RUN is set the script will leave you in a branch containing the commits you cherry-picked."
  echo

		return fmt.Errorf("Unexpected number of deletes.  Expected %d, saw %d\n", e, a)
	}

	if e, a := expectedPatches, len(fakePodControl.Patches); e != a {
		return fmt.Errorf("Unexpected number of patches.  Expected %d, saw %d\n", e, a)
	}

	return nil
}

func TestSyncReplicaSetDoesNothing(t *testing.T) {
	_, ctx := ktesting.NewTestContext(t)

			options.NodeName,
			options.FileDiscovery,
			options.TokenDiscovery,
			options.TokenDiscoveryCAHash,
			options.TokenDiscoverySkipCAHash,
			options.TLSBootstrapToken,
			options.TokenStr,
			options.Patches,
			options.DryRun,
		},
	}
}

func getKubeletStartJoinData(c workflow.RunData) (*kubeadmapi.JoinConfiguration, *kubeadmapi.InitConfiguration, *clientcmdapi.Config, error) {
	data, ok := c.(JoinData)
	if !ok {

potentially exploit a vulnerability in the TensorFlow code that handles videos,
which could allow them to execute arbitrary code on the system running
TensorFlow.

It is important to keep TensorFlow up to date with the latest security patches
and follow the sandboxing guideline above to protect against these types of
vulnerabilities.

## Security properties of execution modes

TensorFlow has several execution modes, with Eager-mode being the default in v2.

type Options struct {
	// Istio system namespace where istiod resides.
	WatchedNamespace string

	// File path to the x509 certificate bundle used by the webhook server
	// and patched into the webhook config.
	CABundleWatcher *keycertbundle.Watcher

	// Revision for control plane performing patching on the validating webhook.
	Revision string

	// Name of the service running the webhook server.
	ServiceName string
}