```


Note that the commands above attempt to validate if the given entity (user or group) exist in the LDAP directory and return an error if they are not found.

<details><summary> View **DEPRECATED** older policy association commands</summary>

Please **do not use** these as they may be removed or their behavior may change.

```sh

// Copyright 2016 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

#include "../../../../../runtime/textflag.h"

TEXT main·foo(SB),DUPOK|NOSPLIT,$16-0 // TEXT main.foo(SB), DUPOK|NOSPLIT, $16-0
	MOVD	R1, R2                // b9040021
	MOVW	R3, R4                // b9140043
	MOVH	R5, R6                // b9070065
	MOVB	R7, R8                // b9060087

* Fix race condition in setting node statusUpdateNeeded flag  ([#32807](https://github.com/kubernetes/kubernetes/pull/32807), [@jingxu97](https://github.com/jingxu97))
* kube-proxy: Add a lower-bound for conntrack (128k default) ([#33051](https://github.com/kubernetes/kubernetes/pull/33051), [@thockin](https://github.com/thockin))

* Update dnsmasq to the latest version. ([#53149](https://github.com/kubernetes/kubernetes/pull/53149), [@bowei](https://github.com/bowei))
* On GCP platforms, e2e testing now logs which OS images the cluster was found to have. ([#48310](https://github.com/kubernetes/kubernetes/pull/48310), [@abgworrall](https://github.com/abgworrall))

	petNames := make(map[string]bool)
	for _, pet := range updatedUser.Pets {
		petNames[pet.Name] = true
	}

	if !petNames["original-pet"] {
		t.Error("original pet not found")
	}

	if !petNames["new-pet"] {
		t.Error("new pet not found")
	}
}

// Test Set + Create with multiple associations using real database
func TestClauseAssociationSetCreateWithMultipleAssociations(t *testing.T) {

Another feature moving to GA in v1.22 is CSI Service Account Token support. This feature allows CSI drivers to use pods' [bound service account tokens](https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#bound-service-account-token-volume) instead of a more privileged identity. It also provides control over to re-publishing these volumes, so that short-lived tokens can be refreshed.

     * including record counts, timing, and pagination details.
     *
     * @param documentList the list of search result documents
     * @param allRecordCount the total number of records found
     * @param allRecordCountRelation the relationship of the record count (exact, approximate, etc.)
     * @param queryTime the time taken to execute the search query

   * #remove(Object, int) remove}{@code (element, 1)} instead.
   *
   * @param element the element to remove one occurrence of
   * @return {@code true} if an occurrence was found and removed
   */
  @CanIgnoreReturnValue
  @Override
  boolean remove(@Nullable Object element);

  /**
   * Adds or removes the necessary occurrences of an element such that the element attains the

	// Combined timeout for the lock attempt.
	ctx, cancel := context.WithTimeout(ctx, ds.Timeouts.Acquire)
	defer cancel()

	// Special context for NetLockers - do not use timeouts.
	// Also, pass the trace context info if found for debugging
	netLockCtx := context.Background()

	tc, ok := ctx.Value(mcontext.ContextTraceKey).(*mcontext.TraceCtxt)
	if ok {
		netLockCtx = context.WithValue(netLockCtx, mcontext.ContextTraceKey, tc)
	}

                    if (transformer == null) {
                        // no transformer
                        logger.warn("Transformer not found: name={}, url={}", accessResultData.getTransformerName(), accessResult.getUrl());
                        continue;
                    }
                    @SuppressWarnings("unchecked")