// deals with sparseDatas.
//
// However, the external API uses sparseHoles instead of sparseDatas because the
// zero value of sparseHoles logically represents a normal file (i.e., there are
// no holes in it). On the other hand, the zero value of sparseDatas implies
// that the file has no data in it, which is rather odd.
//
// As an example, if the underlying raw file contains the 10-byte data:
//

      <name>Kevin Bourrillion</name>
      <email>******@****.***</email>
      <organization>Google</organization>
      <organizationUrl>http://www.google.com</organizationUrl>
      <roles>
        <role>owner</role>
        <role>developer</role>
      </roles>
      <timezone>-8</timezone>
    </developer>
  </developers>
  <ciManagement>
    <system>GitHub Actions</system>
    <url>https://github.com/google/guava/actions</url>

// The bytes written matches the number of remaining bytes in the current file.
//
// If the current file is sparse and w is an io.WriteSeeker,
// then writeTo uses Seek to skip past holes defined in Header.SparseHoles,
// assuming that skipped regions are filled with NULs.
// This always writes the last byte to ensure w is the right size.
//
// TODO(dsnet): Re-export this when adding sparse file support.

func registerSTSRouter(router *mux.Router) {
	// Initialize STS.
	sts := &stsAPIHandlers{}

	// STS Router
	stsRouter := router.NewRoute().PathPrefix(SlashSeparator).Subrouter()

	// Assume roles with no JWT, handles AssumeRole.
	stsRouter.Methods(http.MethodPost).MatcherFunc(func(r *http.Request, rm *mux.RouteMatch) bool {
		ctypeOk := wildcard.MatchSimple("application/x-www-form-urlencoded*", r.Header.Get(xhttp.ContentType))

  // It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
  // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
  // +optional
  optional string evaluationError = 3;
}

// SubjectRulesReviewStatus contains the result of a rules check. This check can be incomplete depending on

  // It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
  // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
  // +optional
  optional string evaluationError = 3;
}

// SubjectRulesReviewStatus contains the result of a rules check. This check can be incomplete depending on

#                                                 Permission
#                                                     ------
authentication.admin.users=admin
authentication.admin.roles=admin

role.search.default.permissions=
role.search.default.display.permissions={role}guest
role.search.guest.permissions={role}guest

role.search.user.prefix=1
role.search.group.prefix=2

			version:  "v1",
			resource: "customresourcedefinitions",
		},
		{
			namespace: istioNamespace,
			group:     "rbac.authorization.k8s.io",
			version:   "v1",
			resource:  "roles",
		},
		{
			namespace: istioNamespace,
			version:   "v1",
			resource:  "serviceaccounts",
		},
		{
			namespace: istioNamespace,
			version:   "v1",
			resource:  "services",
		},

labels.geo=Geo
labels.groups=Groups
labels.hash=Hash
labels.kuromojiFile=Kuromoji File
labels.maxSize=Max Size
labels.order=Order
labels.purgeSuggestSearchLogDay=Purge Suggest Documents Before
labels.q=Query
labels.roles=Roles
labels.suggestSearchLog=Suggest Search Log
labels.suggestWord=Suggest Word
labels.targetLabel=Label
labels.term=Term
labels.fields=Fields
labels.ex_q=Extended Query
labels.ldapProviderUrl=LDAP URL

labels.geo=Geo
labels.groups=Groups
labels.hash=Hash
labels.kuromojiFile=Kuromoji File
labels.maxSize=Max Size
labels.order=Order
labels.purgeSuggestSearchLogDay=Purge Suggest Documents Before
labels.q=Query
labels.roles=Roles
labels.suggestSearchLog=Suggest Search Log
labels.suggestWord=Suggest Word
labels.targetLabel=Label
labels.term=Term
labels.fields=Fields
labels.ex_q=Extended Query
labels.ldapProviderUrl=LDAP URL