}

type PolicyData struct {
	ClusterRoles        []rbacapiv1.ClusterRole
	ClusterRoleBindings []rbacapiv1.ClusterRoleBinding
	Roles               map[string][]rbacapiv1.Role
	RoleBindings        map[string][]rbacapiv1.RoleBinding
	// ClusterRolesToAggregate maps from previous clusterrole name to the new clusterrole name
	ClusterRolesToAggregate map[string]string

	bootstrapBindings = append(bootstrapBindings, bootstrappolicy.ControllerRoleBindings()...)

	clusterRoles := []*rbacv1.ClusterRole{}
	for i := range bootstrapRoles {
		clusterRoles = append(clusterRoles, &bootstrapRoles[i])
	}
	clusterRoleBindings := []*rbacv1.ClusterRoleBinding{}
	for i := range bootstrapBindings {
		clusterRoleBindings = append(clusterRoleBindings, &bootstrapBindings[i])
	}

}

// AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
type AggregationRule struct {
	// ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
	// If any of the selectors match, then the ClusterRole's permissions will be added
	// +optional
	// +listType=atomic

}

// AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
type AggregationRule struct {
	// ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
	// If any of the selectors match, then the ClusterRole's permissions will be added
	// +optional
	// +listType=atomic

		}
	}
	return nil, errors.New("role not found")
}

func (r *StaticRoles) GetClusterRole(name string) (*rbacv1.ClusterRole, error) {
	for _, clusterRole := range r.clusterRoles {
		if clusterRole.Name == name {
			return clusterRole, nil
		}
	}
	return nil, errors.New("clusterrole not found")
}

func (r *StaticRoles) ListRoleBindings(namespace string) ([]*rbacv1.RoleBinding, error) {

}

// AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
type AggregationRule struct {
	// ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
	// If any of the selectors match, then the ClusterRole's permissions will be added
	// +optional
	// +listType=atomic

		secrets         = resource("secrets", "default")
		tokenReviews    = resource("tokenreviews", "", "authentication.k8s.io")
		deployments     = resource("deployments", "default", "apps")
		clusterRoles    = resource("clusterroles", "", "rbac.authorization.k8s.io")
		events          = resource("events", "default")
		foobars         = resource("foos", "default", "example.com")

			Verb:            "get",
			APIGroup:        "rbac.authorization.k8s.io", // Core
			APIVersion:      "v1beta1",
			Resource:        "clusterroles",
			Name:            "edit",
			ResourceRequest: true,
			Path:            "/apis/rbac.authorization.k8s.io/v1beta1/clusterroles/edit",
		},
		"nonResource": &authorizer.AttributesRecord{
			User:            tim,
			Verb:            "get",
			ResourceRequest: false,

				client.PrependReactor("create", "clusterroles", func(clientgotesting.Action) (bool, runtime.Object, error) {
					return true, nil, errors.New("unknown error")
				})
			},
			expectedError: true,
		},
		{
			name: "clusterrole exists, update it",
			setupClient: func(client *clientsetfake.Clientset) {
				client.PrependReactor("create", "clusterroles", func(clientgotesting.Action) (bool, runtime.Object, error) {

			ctx := context.Background()
			if _, err := client.RbacV1().ClusterRoles().Create(ctx, clusterRole, metav1.CreateOptions{}); err != nil {
				if !apierrors.IsAlreadyExists(err) {
					lastError = errors.Wrap(err, "unable to create ClusterRole")
					return false, nil
				}
				if _, err := client.RbacV1().ClusterRoles().Update(ctx, clusterRole, metav1.UpdateOptions{}); err != nil {