func SubjectsStrings(subjects []Subject) ([]string, []string, []string, []string) {
	users := []string{}
	groups := []string{}
	sas := []string{}
	others := []string{}

	for _, subject := range subjects {
		switch subject.Kind {
		case ServiceAccountKind:
			sas = append(sas, fmt.Sprintf("%s/%s", subject.Namespace, subject.Name))

		case UserKind:
			users = append(users, subject.Name)

		case GroupKind:

	// This includes the issuer URL, which is already present in the SA token JWT.  Similarly, SAs can
	// already gain this same info via introspection of their own token.  Since this discovery endpoint
	// points to what issued all service account tokens, it seems fitting for SAs to have this access.
	// Defer to the cluster admin with regard to binding directly to all authenticated and/or
	// unauthenticated users.

		return has(user.GetGroups(), subject.Name)

	case rbacv1.ServiceAccountKind:
		// default the namespace to namespace we're working in if its available.  This allows rolebindings that reference
		// SAs in th local namespace to avoid having to qualify them.
		saNamespace := namespace
		if len(subject.Namespace) > 0 {
			saNamespace = subject.Namespace
		}
		if len(saNamespace) == 0 {
			return false
		}

		}
	}

	*controllerRoles = append(*controllerRoles, role)
	addClusterRoleLabel(*controllerRoles)

	*controllerRoleBindings = append(*controllerRoleBindings,
		rbacv1helpers.NewClusterBinding(role.Name).SAs("kube-system", role.Name[len(saRolePrefix):]).BindingOrDie())
	addClusterRoleBindingLabel(*controllerRoleBindings)
}

func eventsRule() rbacv1.PolicyRule {

sano.tochigi.jp sanofi sanok.pl santabarbara.museum santacruz.museum santafe.museum santamaria.br santoandre.br sanuki.kagawa.jp saobernardo.br saogonca.br saotome.st sap sar.it sardegna.it sardinia.it sarl saroma.hokkaido.jp sarpsborg.no sarufutsu.hokkaido.jp sas sasaguri.fukuoka.jp sasayama.hyogo.jp sasebo.nagasaki.jp saskatchewan.museum sassari.it satosho.okayama.jp satsumasendai.kagoshima.jp satte.saitama.jp satx.museum sauda.no sauherad.no savannahga.museum save saves-the-whales.com savona.it saxo sayama.osaka.jp...