to generate a new secret and push the updated certificate to Envoy. This ensures that we do not permanently watch certificates even after
Envoy has stopped requested them; if there are no subscriptions they update will be ignored. If Envoy later watches these certificates again,
a new one will be generated on demand.

## Configuration

  optional FieldsV1 fieldsV1 = 7;

  // Subresource is the name of the subresource used to update that object, or
  // empty string if the object was updated through the main resource. The
  // value of this field is used to distinguish between managers, even if they
  // share the same name. For example, a status update will be distinct from a
  // regular update using the same manager name.

### Other (Cleanup or Flake)

- Build: Update Debian base images
  - debian-base:v2.1.3
  - debian-iptables:v12.1.2
  - debian-hyperkube-base:v1.1.3 ([#93754](https://github.com/kubernetes/kubernetes/pull/93754), [@justaugustus](https://github.com/justaugustus)) [SIG API Machinery, Cluster Lifecycle, Release and Testing]
- Update Golang to v1.13.14
  - Update bazel to 2.2.0
  - Update repo-infra to 0.0.8 (to support go1.14.6 and go1.13.14)

* Kubernetes version command line parameter in kubeadm has been updated to drop an unnecessary redirection from ci/latest.txt to ci-cross/latest.txt. Users should know exactly where the builds are stored on Google Cloud storage buckets from now on. For example for 1.9 and 1.10, users can specify ci/latest-1.9 and ci/latest-1.10 as the CI build jobs what build images correctly updates those. The CI jobs for master update the ci-cross/latest location, so if you are looking for latest master builds,...

crosscompile: ## cross compile minio
	@(env bash $(PWD)/buildscripts/cross-compile.sh)

verifiers: lint check-gen

check-gen: ## check for updated autogenerated files
	@go generate ./... >/dev/null
	@go mod tidy -compat=1.21
	@(! git diff --name-only | grep '_gen.go$$') || (echo "Non-committed changes in auto-generated code is detected, please commit them to proceed." && false)

    entry.setValue("two"); // changes the iterator's current entry value
    assertEquals("two", map.get(1));
    assertEquals(Integer.valueOf(1), map.inverse().get("two"));
    iterator.remove(); // removes the updated entry
    assertTrue(map.isEmpty());
  }

  public void testInsertionOrder() {
    BiMap<String, Integer> map = HashBiMap.create();
    map.put("foo", 1);
    map.put("bar", 2);
    map.put("quux", 3);

  ASSERT_TRUE(tensorflow::GrpcServer::Create(
                  server_def_0, tensorflow::Env::Default(), &worker_server1)
                  .ok());
  ASSERT_TRUE(worker_server1->Start().ok());

  // 5a. Update `ctx_0` with updated `server_def_0`.
  {
    server_def_0.set_task_index(0);
    string serialized_update = server_def_0.SerializeAsString();
    TF_Status* status = TF_NewStatus();

	// 3. Check that svc account can restrict the policy, and that the
	// session policy can be updated.
	c.assertSvcAccSessionPolicyUpdate(ctx, s, s.adm, accessKey, bucket)

	// 4. Check that service account's secret key and account status can be
	// updated.
	c.assertSvcAccSecretKeyAndStatusUpdate(ctx, s, s.adm, accessKey, bucket)

	// 5. Check that service account can be deleted.

// - this is because during add specifically, if CNI plugins have not finished executing,
// K8S may get a pod Add event without any IPs in the object, and the pod will later be updated with IPs.
//
// We always need the IPs, but this is fine because this AddPodToMesh can be called from the CNI plugin as well,

		m = cache.iamUsersMap
	}
	err := store.loadUser(ctx, accessKey, userType, m)

	if err == errNoSuchUser {
		// User was deleted - we update the cache.
		delete(m, accessKey)

		// Since cache was updated, we update the timestamp.
		defer func() {
			cache.updatedAt = time.Now()
		}()

		// 1. Start with updating user-group memberships
		if store.getUsersSysType() == MinIOUsersSysType {