- Is small, focused, and easy to review—ideally one commit, unless multiple commits better narrate complex work.
- Adheres to MinIO’s coding standards (e.g., Go style, error handling, testing).

PRs must flow smoothly through review to reach production. Large PRs should be split into smaller, manageable ones.

## Submitting PRs

1. **Title and Summary**:

### Verify auto-encryption

> Note that auto-encryption only affects requests without S3 encryption headers. So, if a S3 client sends
> e.g. SSE-C headers, MinIO will encrypt the object with the key sent by the client and won't reach out to
> the configured KMS.

To verify auto-encryption, use the following `mc` command:

```
mc cp test.file myminio/bucket/

            String newValue = "changed";
            System.setProperty(Constants.FESS_CONFIG_PREFIX + testKey, newValue);

            // Get value again - in real FessConfigImpl it would be cached,
            // but our test implementation always checks system properties
            String value2 = fessConfig.get(testKey);
            // In our test implementation, it will pick up the new value

       */
      /*
       * A CopyOnWriteArraySet<WeakReference> is faster than a newSetFromMap of a MapMaker map with
       * weakKeys() and concurrencyLevel(1), even up to at least 12 cached exception types.
       */
      private static final Set<WeakReference<Class<? extends Exception>>> validClasses =
          new CopyOnWriteArraySet<>();

      @Override

        assertTrue(it.hasNext(), "Iterator should have second element");
        assertSame(fe2, it.next(), "Second element must match first page");

        // Next page fetched via fetchMore()
        assertTrue(it.hasNext(), "Iterator should have third element after fetchMore");
        assertSame(fe3, it.next(), "Third element from second page");

 * Can adjust Call timeouts using withConnectTimeout, withReadTimeout, withWriteTimeout.

**Network Interceptors**

 * Able to operate on intermediate responses like redirects and retries.
 * Not invoked for cached responses that short-circuit the network.
 * Observe the data just as it will be transmitted over the network.
 * Access to the `Connection` that carries the request.

### Rewriting Requests

       */
      /*
       * A CopyOnWriteArraySet<WeakReference> is faster than a newSetFromMap of a MapMaker map with
       * weakKeys() and concurrencyLevel(1), even up to at least 12 cached exception types.
       */
      private static final Set<WeakReference<Class<? extends Exception>>> validClasses =
          new CopyOnWriteArraySet<>();

      @Override

            currentWeight += channel.getScore();
            if (random < currentWeight) {
                return channel;
            }
        }

        // Should not reach here
        return channels.iterator().next();
    }

    private ChannelInfo selectWithAffinity(CommonServerMessageBlock message, Collection<ChannelInfo> channels) {
        // Use file handle or tree ID for affinity

import org.codelibs.core.exception.UnsupportedEncodingRuntimeException;
import org.codelibs.core.misc.Base64Util;

/**
 * A utility class for encrypting and decrypting data using a cached {@link Cipher} instance.
 */
public class CachedCipher {

    /**
     * Creates a new {@link CachedCipher} instance.
     */
    public CachedCipher() {
    }

  - The disk-cached discovery client is moved from k8s.io/client-go/discovery to k8s.io/client-go/discovery/cached/disk.
The memory-cached discovery client is moved from k8s.io/client-go/discovery/cached to k8s.io/client-go/discovery/cached/memory.
([#72214](https://github.com/kubernetes/kubernetes/pull/72214), [@caesarxuchao](https://github.com/caesarxuchao))