// and if a containing delegated property accessor is inline,
    // it might need this accessor's bytecode.
    //
    // If an accessor function is defined in a different module,
    // IDE tries to acquire its bytecode via the index, however,
    // the index doesn't cover classfiles from compiler output,
    // so the lowering fails.
    //
    // To solve the problem, we need to find all delegated properties with inline accessors

  // leaseDurationSeconds is a duration that candidates for a lease need
  // to wait to force acquire it. This is measure against time of last
  // observed renewTime.
  // +optional
  optional int32 leaseDurationSeconds = 2;

  // acquireTime is a time when the current lease was acquired.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.MicroTime acquireTime = 3;

   * was acquired, or null if no connection was acquired. The acquired connection will also be
   * given to [connectionUser] who may (for example) assign it to a [RealCall.connection].
   *
   * This confirms the returned connection is healthy before returning it. If this encounters any
   * unhealthy connections in its search, this will clean them up.
   *

  // leaseDurationSeconds is a duration that candidates for a lease need
  // to wait to force acquire it. This is measure against time of last
  // observed renewTime.
  // +optional
  optional int32 leaseDurationSeconds = 2;

  // acquireTime is a time when the current lease was acquired.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.MicroTime acquireTime = 3;

		// 3) lk3 or lk4 (whichever didn't execute in step 1) then executes and creates
		//    a new entry in lockMap and acquires a lock for the same resource.

		<-lk2ch
		lk3ok := <-lk3ch
		lk4ok := <-lk4ch

		if lk3ok && lk4ok {
			t.Fatalf("multiple locks acquired; iteration=%d, lk3=%t, lk4=%t", i, lk3ok, lk4ok)
		}
	}

    protected synchronized SmbFileHandleImpl ensureOpen () throws CIFSException {
        if ( !isOpen() ) {
            // one extra acquire to keep this open till the stream is released
            this.handle = this.file.openUnshared(this.openFlags, this.access, this.sharing, SmbConstants.ATTR_NORMAL, 0).acquire();
            if ( this.append ) {
                this.fp = this.handle.getInitialSize();
                if ( log.isDebugEnabled() ) {

	go func() {
		r := rand.New(rand.NewSource(time.Now().UnixNano()))
		// Leader node (that successfully acquires the lock inside licenceUpdaterLoop)
		// will keep performing the license update. If the leader goes down for some
		// reason, the lock will be released and another node will acquire it and
		// take over because of this loop.
		for {
			licenceUpdaterLoop(ctx, objAPI)

// it is similar to LockedOpenFile with with syscall.LOCK_EX
// mode but along with syscall.LOCK_NB such that the function
// doesn't wait forever but instead returns if it cannot
// acquire a write lock.
func TryLockedOpenFile(path string, flag int, perm os.FileMode) (*LockedFile, error) {
	return lockedOpenFile(path, flag, perm, syscall.LOCK_NB)
}

// LockedOpenFile - initializes a new lock and protects

* For HTTPS, **the server** needs to **have "certificates"** generated by a **third party**.
    * Those certificates are actually **acquired** from the third party, not "generated".
* Certificates have a **lifetime**.
    * They **expire**.
    * And then they need to be **renewed**, **acquired again** from the third party.
* The encryption of the connection happens at the **TCP level**.
    * That's one layer **below HTTP**.

## 1. Prerequisites

- Familiarity with [MinIO deployment process on Kubernetes](https://min.io/docs/minio/kubernetes/upstream/operations/installation.html).

- Kubernetes cluster with `kubectl` configured.

- Acquire TLS certificates, either from a CA or [create self-signed certificates](https://min.io/docs/minio/kubernetes/upstream/operations/network-encryption.html).