"os"

	"github.com/pkg/errors"
)

// CreateDataDirectory creates the etcd data directory (commonly /var/lib/etcd) with the right permissions.
func CreateDataDirectory(dir string) error {
	if err := os.MkdirAll(dir, 0700); err != nil {
		return errors.Wrapf(err, "failed to create the etcd data directory: %q", dir)
	}
	return nil

        return 64 * user.toUnixNumeric() + 8 * group.toUnixNumeric() + other.toUnixNumeric();
    }

    @SuppressWarnings("OctalInteger")
    protected static int getUserPartOf(int unixNumeric) {
        return (unixNumeric & 0_700) >> 6;
    }

    protected static String getUserPartOf(String unixSymbolic) {
        return unixSymbolic.substring(0, 3);
    }

    @SuppressWarnings("OctalInteger")

	}

	dir := t.TempDir()
	fn := filepath.Join(dir, "perm.go")

	// Create a file that needs formatting without write permission.
	if err := os.WriteFile(filepath.Join(fn), []byte("  package main"), 0o400); err != nil {
		t.Fatal(err)
	}

	// Set mtime of the file in the past.
	past := time.Now().Add(-time.Hour)
	if err := os.Chtimes(fn, past, past); err != nil {
		t.Fatal(err)
	}

	info, err := os.Stat(fn)

		return fmt.Errorf("could not encode settings: %w", err)
	}

	// create the settings directory if it does not exist
	// XDG specifies permissions 0700 when creating settings dirs:
	// https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
	if err := os.MkdirAll(filepath.Dir(fname), 0700); err != nil {
		return fmt.Errorf("failed to create settings directory: %w", err)
	}

	if err := os.WriteFile(fname, data, 0644); err != nil {

		return nil, fmt.Errorf("failed to remove unix://%s: %v", path, err)
	}

	// Attempt to create the folder in case it doesn't exist
	if err := os.MkdirAll(filepath.Dir(path), 0o750); err != nil {
		// If we cannot create it, just warn here - we will fail later if there is a real error
		log.Warnf("Failed to create directory for %v: %v", path, err)
	}

	var err error

		return nil, fmt.Errorf("failed to remove unix://%s: %v", path, err)
	}

	// Attempt to create the folder in case it doesn't exist
	if err := os.MkdirAll(filepath.Dir(path), 0o750); err != nil {
		// If we cannot create it, just warn here - we will fail later if there is a real error
		log.Warnf("Failed to create directory for %v: %v", path, err)
	}

	var err error

	RepairLabelSelectors     = "repair-label-selectors"
	RepairFieldSelectors     = "repair-field-selectors"
)

// Internal constants
const (
	DefaultKubeconfigMode = 0o600
	CNIAgentLogScope      = "cni-agent"
	CNIPluginLogScope     = "cni-plugin"
	CNIAddEventPath       = "/cmdadd"
	UDSLogPath            = "/log"

	// K8s liveness and readiness endpoints
	LivenessEndpoint   = "/healthz"

			return nil
		}, cfg); err != nil {
		t.Fatal(err)
	}
	verifyPodSecurityContext(t, &pod, runAsUser, runAsGroup, nil)
	verifyContainerSecurityContext(t, pod.Spec.Containers[0], nil, []v1.Capability{"ALL"}, ptr.To(false))
	wantUpdateFiles := map[string]ownerAndPermissions{
		cfg.Etcd.Local.DataDir: {uid: runAsUser, gid: runAsGroup, permissions: 0700},

func saveCreds(csrPem []byte, privPem []byte) {
	err := os.WriteFile(*outCsr, csrPem, 0o644)
	if err != nil {
		log.Fatalf("Could not write output certificate request: %s.", err)
	}

	err = os.WriteFile(*outPriv, privPem, 0o600)
	if err != nil {
		log.Fatalf("Could not write output private key: %s.", err)
	}
}

func main() {
	flag.Parse()

	csrPem, privPem, err := util.GenCSR(util.CertOptions{
		Host:       *host,

// If directory string is empty, return nil.
func OutputKeyCertToDir(dir string, privateKey, certChain, rootCert []byte) error {
	var err error
	if len(dir) == 0 {
		return nil
	}

	certFileMode := os.FileMode(0o600)
	if k8sInCluster.Get() != "" {
		// If this is running on k8s, give more permission to the file certs.
		// This is typically used to share the certs with non-proxy containers in the pod which does not run as root or 1337.