},
					Spec: v1.PodSpec{
						ServiceAccountName: p.account,
						NodeName:           p.node,
					},
				})
			}
			c := kube.NewFakeClient(pods...)
			na := NewClusterNodeAuthorizer(c, tt.trustedAccounts)
			c.RunAndWait(test.NewStop(t))
			kube.WaitForCacheSync("test", test.NewStop(t), na.pods.HasSynced)

			err := na.authenticateImpersonation(tt.caller, tt.requestedIdentityString)