getModule(_) >> { module(it[0], false) }
        getExternalModule(_) >> { module(it[0], true) }
    }

    def runtimeClasses = Spy(TestClassDetector)
    def classDetectorFactory = Mock(ForkedTestClasspathFactory.ClassDetectorFactory) {
        create(_, _) >> { runtimeClasses }
    }
    ForkedTestClasspathFactory underTest = new ForkedTestClasspathFactory(moduleRegistry, classDetectorFactory)

  // This requires the ProcMountType feature flag to be enabled.
  // +optional
  repeated string allowedProcMountTypes = 21;

  // runtimeClass is the strategy that will dictate the allowable RuntimeClasses for a pod.
  // If this field is omitted, the pod's runtimeClassName field is unrestricted.
  // Enforcement of this field depends on the RuntimeClass feature gate being enabled.
  // +optional

		assert.EqualValues(t, test.expectedProfile, actualProfile, "TestCase[%d]: %s", i, test.description)
	}
}

// TestCreatePodSandbox_RuntimeClass tests creating sandbox with RuntimeClasses enabled.
func TestCreatePodSandbox_RuntimeClass(t *testing.T) {
	ctx := context.Background()
	rcm := runtimeclass.NewManager(rctest.NewPopulatedClient())
	defer rctest.StartManagerSync(rcm)()

    resources:
    - csinodes
    verbs:
    - create
    - delete
    - get
    - patch
    - update
  - apiGroups:
    - node.k8s.io
    resources:
    - runtimeclasses
    verbs:
    - get
    - list
    - watch
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    annotations:

		discoveryv1beta1.SchemeGroupVersion.WithResource("endpointslices"):                true,
		eventsv1beta1.SchemeGroupVersion.WithResource("events"):                           true,
		nodev1beta1.SchemeGroupVersion.WithResource("runtimeclasses"):                     true,
		policyapiv1beta1.SchemeGroupVersion.WithResource("poddisruptionbudgets"):          true,
		policyapiv1beta1.SchemeGroupVersion.WithResource("podsecuritypolicies"):           true,

	nodePolicyRules = append(nodePolicyRules, csiNodeInfoRule)

	// RuntimeClass
	nodePolicyRules = append(nodePolicyRules, rbacv1helpers.NewRule("get", "list", "watch").Groups("node.k8s.io").Resources("runtimeclasses").RuleOrDie())

	// DRA Resource Claims
	if utilfeature.DefaultFeatureGate.Enabled(features.DynamicResourceAllocation) {