)

func TestAllowBootstrapTokensToPostCSRs(t *testing.T) {
	tests := []struct {
		name   string
		client clientset.Interface
	}{
		{
			name:   "ClusterRoleBindings is empty",
			client: clientsetfake.NewSimpleClientset(),
		},
		{
			name: "ClusterRoleBindings already exists",
			client: newMockClusterRoleBinddingClientForTest(t, &rbac.ClusterRoleBinding{
				ObjectMeta: metav1.ObjectMeta{

		clusterRoles        []*rbacv1.ClusterRole
		clusterRoleBindings []*rbacv1.ClusterRoleBinding

		superUser string

		actionsToSubjects []actionToSubjects
	}{
		{
			name: "no super user, star matches star",
			clusterRoles: []*rbacv1.ClusterRole{
				newClusterRole("admin", newRule("*", "*", "*", "*")),
			},
			clusterRoleBindings: []*rbacv1.ClusterRoleBinding{

	subjectLocator := &SubjectAccessEvaluator{
		superUser:                superUser,
		roleBindingLister:        roleBindings,
		clusterRoleBindingLister: clusterRoleBindings,
		roleToRuleMapper: rbacregistryvalidation.NewDefaultRuleResolver(

	for n := 0; n < b.N; n++ {
		var policy = &PolicyData{
			ClusterRoles:               append(bootstrappolicy.ClusterRoles(), bootstrappolicy.ControllerRoles()...),
			ClusterRoleBindings:        append(bootstrappolicy.ClusterRoleBindings(), bootstrappolicy.ControllerRoleBindings()...),
			Roles:                      bootstrappolicy.NamespaceRoles(),
			RoleBindings:               bootstrappolicy.NamespaceRoleBindings(),

// Strategy should implement rest.RESTUpdateStrategy
var _ rest.RESTUpdateStrategy = Strategy

// NamespaceScoped is false for ClusterRoleBindings.
func (strategy) NamespaceScoped() bool {
	return false
}

// AllowCreateOnUpdate is true for ClusterRoleBindings.
func (strategy) AllowCreateOnUpdate() bool {
	return true
}

// PrepareForCreate clears fields that are not allowed to be set by end users

    users: ["tim"]
    userGroups: ["testers", "developers"]
    verbs: ["patch", "delete", "create"]
    resources:
      - group: ""
      - group: "rbac.authorization.k8s.io"
        resources: ["clusterroles", "clusterrolebindings"]
    namespaces: ["default", "kube-system"]
  - level: Metadata
`

const policyWithNoVersionOrKind = `
rules:
  - level: None
    nonResourceURLs:
      - /healthz*
      - /version

[dryrun] Resource name: "kubernetes"
`),
		},
		{
			name:   "action GET on clusterrolebindings",
			action: core.NewRootGetAction(schema.GroupVersionResource{Group: rbac.GroupName, Version: rbac.SchemeGroupVersion.Version, Resource: "clusterrolebindings"}, "system:node"),
			expectedBytes: []byte(`[dryrun] Would perform action GET on resource "clusterrolebindings" in API group "rbac.authorization.k8s.io/v1"
[dryrun] Resource name: "system:node"
`),

  --no-enable-legacy-authorization

# This is a hack to handle the case where clusterrolebinding creation returns:
#
# Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "client" cannot
# create clusterrolebindings.rbac.authorization.k8s.io at the cluster scope
gcloud config set container/use_client_certificate False

# Download the credentials for the cluster.

{
  "apiVersion": "v1",
  "groupVersion": "rbac.authorization.k8s.io/v1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "ClusterRoleBinding",
      "name": "clusterrolebindings",
      "namespaced": false,
      "singularName": "clusterrolebinding",
      "storageVersionHash": "48tpQ8gZHFc=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",

                "*"
            ]
        },
        {
            "apiGroups": [
                "rbac.authorization.k8s.io"
            ],
            "resources": [
                "clusterrolebindings",
                "clusterroles",
                "roles",
                "rolebindings"
            ],
            "verbs": [
                "*"
            ]
        },
        {