field.Forbidden(field.NewPath("spec").Child("rules").Index(0).Child("subjects").Index(0).Child("user"), "user is forbidden when subject kind is not 'User'"),

}

var xxx_messageInfo_RoleRef proto.InternalMessageInfo

func (m *Subject) Reset()      { *m = Subject{} }
func (*Subject) ProtoMessage() {}
func (*Subject) Descriptor() ([]byte, []int) {
	return fileDescriptor_c8ba2e7dd472de66, []int{11}
}
func (m *Subject) XXX_Unmarshal(b []byte) error {
	return m.Unmarshal(b)
}
func (m *Subject) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
	b = b[:cap(b)]

}

var xxx_messageInfo_RoleRef proto.InternalMessageInfo

func (m *Subject) Reset()      { *m = Subject{} }
func (*Subject) ProtoMessage() {}
func (*Subject) Descriptor() ([]byte, []int) {
	return fileDescriptor_c5bc2d145acd4e45, []int{11}
}
func (m *Subject) XXX_Unmarshal(b []byte) error {
	return m.Unmarshal(b)
}
func (m *Subject) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
	b = b[:cap(b)]

}

var xxx_messageInfo_RoleRef proto.InternalMessageInfo

func (m *Subject) Reset()      { *m = Subject{} }
func (*Subject) ProtoMessage() {}
func (*Subject) Descriptor() ([]byte, []int) {
	return fileDescriptor_758889dfd9a88fa6, []int{11}
}
func (m *Subject) XXX_Unmarshal(b []byte) error {
	return m.Unmarshal(b)
}
func (m *Subject) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
	b = b[:cap(b)]

	}
	if err := s.AddGeneratedConversionFunc((*v1beta3.Subject)(nil), (*flowcontrol.Subject)(nil), func(a, b interface{}, scope conversion.Scope) error {
		return Convert_v1beta3_Subject_To_flowcontrol_Subject(a.(*v1beta3.Subject), b.(*flowcontrol.Subject), scope)
	}); err != nil {
		return err
	}
	if err := s.AddGeneratedConversionFunc((*flowcontrol.Subject)(nil), (*v1beta3.Subject)(nil), func(a, b interface{}, scope conversion.Scope) error {

		return err
	}
	if err := s.AddGeneratedConversionFunc((*v1.Subject)(nil), (*flowcontrol.Subject)(nil), func(a, b interface{}, scope conversion.Scope) error {
		return Convert_v1_Subject_To_flowcontrol_Subject(a.(*v1.Subject), b.(*flowcontrol.Subject), scope)
	}); err != nil {
		return err
	}
	if err := s.AddGeneratedConversionFunc((*flowcontrol.Subject)(nil), (*v1.Subject)(nil), func(a, b interface{}, scope conversion.Scope) error {

	}
	if err := s.AddGeneratedConversionFunc((*v1beta1.Subject)(nil), (*flowcontrol.Subject)(nil), func(a, b interface{}, scope conversion.Scope) error {
		return Convert_v1beta1_Subject_To_flowcontrol_Subject(a.(*v1beta1.Subject), b.(*flowcontrol.Subject), scope)
	}); err != nil {
		return err
	}
	if err := s.AddGeneratedConversionFunc((*flowcontrol.Subject)(nil), (*v1beta1.Subject)(nil), func(a, b interface{}, scope conversion.Scope) error {

	}
	if err := s.AddGeneratedConversionFunc((*v1beta2.Subject)(nil), (*flowcontrol.Subject)(nil), func(a, b interface{}, scope conversion.Scope) error {
		return Convert_v1beta2_Subject_To_flowcontrol_Subject(a.(*v1beta2.Subject), b.(*flowcontrol.Subject), scope)
	}); err != nil {
		return err
	}
	if err := s.AddGeneratedConversionFunc((*flowcontrol.Subject)(nil), (*v1beta2.Subject)(nil), func(a, b interface{}, scope conversion.Scope) error {

  name: metallb-system:controller
subjects:
- kind: ServiceAccount
  name: controller
  namespace: metallb-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: metallb
  name: metallb-system:speaker
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: metallb-system:speaker
subjects:
- kind: ServiceAccount

        then:
        UnboundModelRulesException e = thrown()
        normaliseLineSeparators(e.message).contains '''
  by-path
    subject:
      - a.b Object [*]

  by-path-and-type
    subject:
      - missing String [*]

  by-type
    subject:
      - <no path> Long [*]
'''
    }

    def "reports unbound inputs"() {
        given: