// with the common name "foo" will be associated with the policy "foo".
	// Other mapping functions - e.g. public-key hash based mapping - are
	// possible but not implemented.
	//
	// Group mapping is not possible with standard X.509 certificates.
	if certificate.Subject.CommonName == "" {
		writeSTSErrorResponse(ctx, w, ErrSTSMissingParameter, errors.New("certificate subject CN cannot be empty"))
		return
	}

## Replication - Number of Processes { #replication-number-of-processes }

chart-example.local ## Node labels for pod assignment ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ ## nodeSelector: {} tolerations: [] affinity: {} ## Add stateful containers to have security context, if enabled MinIO will run as this ## user and group NOTE: securityContext is only enabled if persistence.enabled=true securityContext: enabled: true runAsUser: 1000 runAsGroup: 1000 fsGroup: 1000 # Additational pod annotations podAnnotations: {} # Additional pod labels podLabels: {} ## Configure resource...

A security issue was discovered in Kubernetes where users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group they are not authorized to read.

**Affected Versions**:
  - kube-apiserver v1.25.0 - v1.25.3
  - kube-apiserver v1.24.0 - v1.24.7
  - kube-apiserver v1.23.0 - v1.23.13
  - kube-apiserver v1.22.0 - v1.22.15

				bestIdx = otherIdx
				continue
			}
			if path.Clean(best.name) == path.Clean(other.name) {
				// We may be in a situation where we have a directory and an object with the same name.
				// In that case we will drop the directory entry.
				// This should however not be confused with an object with a trailing slash.
				dirMatches := best.isDir() == other.isDir()

- OpenAPI V2 will no longer publish aggregated API server OpenAPI for group versions that do not match the APIService specified group version. ([#123570](https://github.com/kubernetes/kubernetes/pull/123570), [@Jefftree](https://github.com/Jefftree))

	// drive timeout by default is 2 minutes, we do not need to wait longer.
	return save(name, time.Minute)
}

// dataUsageCacheVer indicates the cache version.
// Bumping the cache version will drop data from previous versions
// and write new data with the new version.
const (
	dataUsageCacheVerCurrent = 8
	dataUsageCacheVerV7      = 7
	dataUsageCacheVerV6      = 6
	dataUsageCacheVerV5      = 5

    // shutDown or runOneIteration) run concurrently with one another.
    // TODO(lukes): why don't we use ListenableFuture to sequence things? Then we could drop the
    // lock.
    private final ReentrantLock lock = new ReentrantLock();

    @WeakOuter
    final class Task implements Runnable {
      @Override
      public void run() {
        lock.lock();

    String SEARCH_GUEST_ROLE_LIST = "searchGuestPermissionList";

    String SUGGEST_SEARCH_LOG_PERMISSIONS = "suggestSearchLogPermissions";

    String GROUP_VALUE_PREFIX = "group:";

    String ROLE_VALUE_PREFIX = "role:";

    String APP_VALUES = "appValues";

    String DEFAULT_SORT_VALUES = "defaultSortValues";

    String DEFAULT_LABEL_VALUES = "defaultLabelValues";

chart-example.local ## Node labels for pod assignment ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ ## nodeSelector: {} tolerations: [] affinity: {} ## Add stateful containers to have security context, if enabled MinIO will run as this ## user and group NOTE: securityContext is only enabled if persistence.enabled=true securityContext: enabled: true runAsUser: 1000 runAsGroup: 1000 fsGroup: 1000 # Additational pod annotations podAnnotations: {} # Additional pod labels podLabels: {} ## Configure resource...