if len(resourceHandles) == 0 {
		resourceHandles = make([]resourcev1alpha2.ResourceHandle, 1)
	}
	claimInfoState := state.ClaimInfoState{
		DriverName:      claim.Status.DriverName,
		ClassName:       claim.Spec.ResourceClassName,
		ClaimUID:        claim.UID,
		ClaimName:       claim.Name,
		Namespace:       claim.Namespace,
		PodUIDs:         sets.New[string](),

}

// ClaimsMapper provides a CEL expression mapper configured with the claims CEL variable.
type ClaimsMapper interface {
	// EvalClaimMapping evaluates the given claim mapping expression and returns a EvaluationResult.
	// This is used for username, groups and uid claim mapping that contains a single expression.
	EvalClaimMapping(ctx context.Context, claims *unstructured.Unstructured) (EvaluationResult, error)

}

// ClaimInfoState is used to store claim info state in a checkpoint
// +k8s:deepcopy-gen=true
type ClaimInfoState struct {
	// Name of the DRA driver
	DriverName string

	// ClassName is a resource class of the claim
	ClassName string

	// ClaimUID is an UID of the resource claim
	ClaimUID types.UID

	// ClaimName is a name of the resource claim
	ClaimName string

	// Namespace is a claim namespace

			if err != nil {
				return nil, err
			}
			return []string{ret}, nil
		}
		claims = append(claims, s[begin+1:end])
		begin = end + 1
	}
	return claims, nil
}

func MetadataStringMatcherForJWTClaim(claim string, m *matcherpb.StringMatcher) *matcherpb.MetadataMatcher {
	return MetadataValueMatcherForJWTClaim(claim, &matcherpb.ValueMatcher{
		MatchPattern: &matcherpb.ValueMatcher_StringMatch{
			StringMatch: m,
		},

	}
	namespace := private.Namespace
	if len(namespace) == 0 {
		return nil, errors.New("namespace claim is missing")
	}
	secretName := private.SecretName
	if len(secretName) == 0 {
		return nil, errors.New("secretName claim is missing")
	}
	serviceAccountName := private.ServiceAccountName
	if len(serviceAccountName) == 0 {
		return nil, errors.New("serviceAccountName claim is missing")
	}

	objs := claimAssumeCache.List(nil)
	for _, obj := range objs {
		claim, ok := obj.(*resourcev1alpha2.ResourceClaim)
		if !ok {
			return nil, fmt.Errorf("got unexpected object of type %T from claim assume cache", obj)
		}
		if obj, ok := inFlightAllocations.Load(claim.UID); ok {
			// If the allocation is in-flight, then we have to use the allocation
			// from that claim.
			claim = obj.(*resourcev1alpha2.ResourceClaim)
		}

	// If claim user info is enabled, get claims from userInfo
	// and overwrite them with the claims from JWT.
	if ok && pCfg.ClaimUserinfo {
		if accessToken == "" {
			return errors.New("access_token is mandatory if user_info claim is enabled")
		}
		uclaims, err := pCfg.UserInfo(ctx, accessToken, r.transport)
		if err != nil {
			return err
		}
		for k, v := range uclaims {

	claim := obj.(*resource.ResourceClaim)
	// Status must not be set by user on create.
	claim.Status = resource.ResourceClaimStatus{}
}

func (resourceclaimStrategy) Validate(ctx context.Context, obj runtime.Object) field.ErrorList {
	claim := obj.(*resource.ResourceClaim)
	return validation.ValidateClaim(claim)
}

	IsAmbient() bool
	IsInjected() bool
}

// Claim an existing namespace in all clusters, or create a new one if doesn't exist.
func Claim(ctx resource.Context, cfg Config) (i Instance, err error) {
	cfg.overwriteRevisionIfEmpty(ctx.Settings().Revisions.Default())
	return claimKube(ctx, cfg)
}

// ClaimOrFail calls Claim and fails test if it returns error

			expectedAnnotations: []container.Annotation{{Name: "cdi.k8s.io/test-driver-name_test-claim-uid", Value: "vendor.com/class=device1"}},
		},
	}

	as := assert.New(t)
	for _, tc := range testCases {
		t.Run(tc.description, func(t *testing.T) {
			annotations, err := GenerateAnnotations("test-claim-uid", "test-driver-name", tc.deviceIDs)
			as.ErrorIs(err, tc.expecteError)