the Istio CNI Node Agent requires privileged node permissions, and will require allow-listing in constrained environments that block privileged workloads by default. If using sidecar repair mode or ambient mode, the node agent additionally needs permissions to enter pod network namespaces and perform networking configuration in them. If either sidecar repair or ambient mode are enabled, on startup the container will drop all Linux capabilities via (`drop:ALL`), and re-add back the ones sidecar repair/ambient...

Then we can test that it is used.

## Reading a `.env` file

If you have many settings that possibly change a lot, maybe in different environments, it might be useful to put them on a file and then read them from it as if they were environment variables.

{{- if .Values.podDisruptionBudget.enabled }}
{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodDisruptionBudget" }}
apiVersion: policy/v1beta1
{{- else }}
apiVersion: policy/v1
{{- end }}
kind: PodDisruptionBudget
metadata:
  name: minio
  labels:
    app: {{ template "minio.name" . }}
spec:
  maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
  selector:
    matchLabels:
      app: {{ template "minio.name" . }}

        if (encoding == Encoding.FORBIDDEN) {
          testForbidden(codePoint, codePointString, component)
          continue
        }
        if (encoding == Encoding.PUNYCODE) {
          testPunycode(codePointString, component)
          continue
        }
        testEncodeAndDecode(codePoint, codePointString, component)
        if (encoding == Encoding.SKIP) continue

    features.add(CollectionFeature.SUBSET_VIEW);
    if (features.remove(CollectionFeature.ALLOWS_NULL_VALUES)) {
      // the null value might be out of bounds, so we can't always construct a subset with nulls
      features.add(CollectionFeature.ALLOWS_NULL_QUERIES);
      // but add null might still be supported if it happens to be within range of the subset

    if (derivedFeatures.contains(CollectionFeature.SUPPORTS_ADD)) {
      derivedFeatures.add(ListFeature.SUPPORTS_ADD_WITH_INDEX);
    }
    if (derivedFeatures.contains(CollectionFeature.SUPPORTS_REMOVE)) {
      derivedFeatures.add(ListFeature.SUPPORTS_REMOVE_WITH_INDEX);
    }
    if (derivedFeatures.contains(CollectionFeature.GENERAL_PURPOSE)) {

    features.add(CollectionFeature.SUBSET_VIEW);
    if (features.remove(CollectionFeature.ALLOWS_NULL_VALUES)) {
      // the null value might be out of bounds, so we can't always construct a subset with nulls
      features.add(CollectionFeature.ALLOWS_NULL_QUERIES);
      // but add null might still be supported if it happens to be within range of the subset

@app.get("/items/{item_id}")
def get_item(item_id: str, username: str = Depends(get_username)):
    if item_id not in data:
        raise HTTPException(status_code=404, detail="Item not found")
    item = data[item_id]
    if item["owner"] != username:
        raise OwnerError(username)

        raise


@app.get("/items/{item_id}")
def get_item(item_id: str, username: Annotated[str, Depends(get_username)]):
    if item_id == "portal-gun":
        raise InternalError(
            f"The portal gun is too dangerous to be owned by {username}"
        )
    if item_id != "plumbus":
        raise HTTPException(
            status_code=404, detail="Item not found, there's only a plumbus here"
        )

from typing_extensions import Annotated


async def verify_token(x_token: Annotated[str, Header()]):
    if x_token != "fake-super-secret-token":
        raise HTTPException(status_code=400, detail="X-Token header invalid")


async def verify_key(x_key: Annotated[str, Header()]):
    if x_key != "fake-super-secret-key":
        raise HTTPException(status_code=400, detail="X-Key header invalid")
    return x_key