* Authorization sets `authorization.k8s.io/decision` and `authorization.k8s.io/reason` annotations with the authorization decision ("allow" or "forbid") and a human-readable description of why the decision was made (for example, RBAC includes the name of the role/binding/subject which allowed a request).

  // +optional
  optional WindowsSecurityContextOptions windowsOptions = 10;

  // The UID to run the entrypoint of the container process.
  // Defaults to user specified in image metadata if unspecified.
  // May also be set in PodSecurityContext.  If set in both SecurityContext and
  // PodSecurityContext, the value specified in SecurityContext takes precedence.

	defer cancel()

	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(buf))
	if err != nil {
		return err
	}

	if token != "" {
		req.Header.Set("Authorization", token)
	}
	req.Header.Set("Content-Type", "application/json")

	clnt := http.Client{Transport: getRemoteInstanceTransport()}
	resp, err := clnt.Do(req)
	if err != nil {
		return err
	}

    // TODO(fry): batch by segment
    for (Object key : keys) {
      remove(key);
    }
  }

  @LazyInit @RetainedWith @CheckForNull Set<K> keySet;

  @Override
  public Set<K> keySet() {
    // does not impact recency ordering
    Set<K> ks = keySet;
    return (ks != null) ? ks : (keySet = new KeySet());
  }

  @LazyInit @RetainedWith @CheckForNull Collection<V> values;

    Iterator<@Nullable String> set = Arrays.<@Nullable String>asList("a", null, "b").iterator();
    assertTrue(Iterators.contains(set, "b"));
  }

  public void test_contains_nonnull_no() {
    Iterator<String> set = asList("a", "b").iterator();
    assertFalse(Iterators.contains(set, "c"));
  }

  public void test_contains_null_yes() {

    Iterator<@Nullable String> set = Arrays.<@Nullable String>asList("a", null, "b").iterator();
    assertTrue(Iterators.contains(set, "b"));
  }

  public void test_contains_nonnull_no() {
    Iterator<String> set = asList("a", "b").iterator();
    assertFalse(Iterators.contains(set, "c"));
  }

  public void test_contains_null_yes() {

        @Nullable Object[] localAlternatingKeysAndValues, int size) {
      Set<Object> seenKeys = new HashSet<>();
      BitSet dups = new BitSet(); // slots that are overridden by a later duplicate key
      for (int i = size - 1; i >= 0; i--) {
        Object key = requireNonNull(localAlternatingKeysAndValues[2 * i]);
        if (!seenKeys.add(key)) {
          dups.set(i);
        }
      }
      if (dups.isEmpty()) {

  - `--service-account-issuer`, should be set to a URL identifying the API server that will be stable over the cluster lifetime.
  - `--service-account-key-file`, set to one or more files containing one or more public keys used to verify tokens.

  }

  @VisibleForTesting
  static <E extends @Nullable Object> Set<E> set(Set<E> set, @CheckForNull Object mutex) {
    return new SynchronizedSet<>(set, mutex);
  }

  static class SynchronizedSet<E extends @Nullable Object> extends SynchronizedCollection<E>
      implements Set<E> {

    SynchronizedSet(Set<E> delegate, @CheckForNull Object mutex) {
      super(delegate, mutex);
    }

  }

  @VisibleForTesting
  static <E extends @Nullable Object> Set<E> set(Set<E> set, @CheckForNull Object mutex) {
    return new SynchronizedSet<>(set, mutex);
  }

  static class SynchronizedSet<E extends @Nullable Object> extends SynchronizedCollection<E>
      implements Set<E> {

    SynchronizedSet(Set<E> delegate, @CheckForNull Object mutex) {
      super(delegate, mutex);
    }