}{
		{
			name:   "allowed configmap",
			attrs:  authorizer.AttributesRecord{User: node0, ResourceRequest: true, Verb: "get", Resource: "configmaps", Name: "configmap0-pod0-node0", Namespace: "ns0"},
			expect: authorizer.DecisionAllow,
		},
		{
			name:   "allowed secret via pod",
			attrs:  authorizer.AttributesRecord{User: node0, ResourceRequest: true, Verb: "get", Resource: "secrets", Name: "secret0-pod0-node0", Namespace: "ns0"},

				resourceRequest("verb1").Group("group1").Resource("resource2").New(): true,
				resourceRequest("verb1").Group("group2").Resource("resource2").New(): true,
				resourceRequest("verb2").Group("group1").Resource("resource1").New(): true,
				resourceRequest("verb2").Group("group2").Resource("resource1").New(): true,
				resourceRequest("verb2").Group("group1").Resource("resource2").New(): true,

				Namespace:       "foo",
				ResourceRequest: true,
			},
			matches: true,
			name:    "v0 namespace mis-match",
		},

		// v0 matches
		{
			policy: &v0.Policy{},
			attr: authorizer.AttributesRecord{
				User: &user.DefaultInfo{
					Name:   "foo",
					Groups: []string{user.AllAuthenticated},
				},
				ResourceRequest: true,
			},
			matches: true,

					{
						DriverName: goodName,
						Requests: []resource.ResourceRequest{
							{
								ResourceRequestModel: resource.ResourceRequestModel{
									NamedResources: &resource.NamedResourcesRequest{Selector: "true"},
								},
							},
						},
					},
					{
						DriverName: badName,
						Requests: []resource.ResourceRequest{
							{
								ResourceRequestModel: resource.ResourceRequestModel{

			Name:            "busybox",
			ResourceRequest: true,
			Path:            "/api/v1/namespaces/default/pods/busybox",
		},
		"cluster": &authorizer.AttributesRecord{
			User:            tim,
			Verb:            "get",
			APIGroup:        "rbac.authorization.k8s.io", // Core
			APIVersion:      "v1beta1",
			Resource:        "clusterroles",
			Name:            "edit",
			ResourceRequest: true,

			APIVersion:      attributes.GetResource().Version,
			Resource:        attributes.GetResource().Resource,
			Subresource:     attributes.GetSubresource(),
			Name:            attributes.GetName(),
			ResourceRequest: true,
			Path:            "",
		}
		decision, reason, err := a.authorizer.Authorize(ctx, deleteAttributes)
		if decision != authorizer.DecisionAllow {

	aliceAttr := authorizer.AttributesRecord{User: &user.DefaultInfo{Name: "alice"}, ResourceRequest: true, Namespace: "kittensandponies"}
	bobAttr := authorizer.AttributesRecord{User: &user.DefaultInfo{Name: "bob"}, ResourceRequest: true, Namespace: "kittensandponies"}
	aliceRidiculousAttr := authorizer.AttributesRecord{
		User:            &user.DefaultInfo{Name: "alice"},
		ResourceRequest: true,
		Verb:            strings.Repeat("v", 2000),

func (in *ResourceRequest) DeepCopyInto(out *ResourceRequest) {
	*out = *in
	in.VendorParameters.DeepCopyInto(&out.VendorParameters)
	in.ResourceRequestModel.DeepCopyInto(&out.ResourceRequestModel)
	return
}

// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceRequest.
func (in *ResourceRequest) DeepCopy() *ResourceRequest {
	if in == nil {
		return nil
	}

func (in *ResourceRequest) DeepCopyInto(out *ResourceRequest) {
	*out = *in
	if in.VendorParameters != nil {
		out.VendorParameters = in.VendorParameters.DeepCopyObject()
	}
	in.ResourceRequestModel.DeepCopyInto(&out.ResourceRequestModel)
	return
}

// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceRequest.

					Verb:            verb,
					Namespace:       res.Namespace,
					APIGroup:        res.Group,
					APIVersion:      "v1",
					Resource:        res.Resource,
					Subresource:     res.Subresource,
					ResourceRequest: true,
				}
				t.expectLevel(level, attrs)
			}
		}
	}
}

func (t *auditTester) testNonResources(level audit.Level, users []user.Info, paths ...string) {
	for _, usr := range users {