err:        "not bound to a pod",
		},
		{
			name:       "forbid create of token bound to nonexistant pod",
			podsGetter: noExistingPods,
			attributes: admission.NewAttributesRecord(makeTokenRequest("nopod", "someuid"), nil, tokenrequestKind, "ns", "mysa", svcacctResource, "token", admission.Create, &metav1.CreateOptions{}, false, mynode),
			err:        "not found",
		},
		{

				},
			},
		},
	}

	node := func(cg *core.ConfigGenTest) *model.Proxy {
		return cg.SetupProxy(&model.Proxy{
			Type:        model.SidecarProxy,
			IPAddresses: []string{"1.1.1.1"},
			ID:          "someID",
			DNSDomain:   "foo.com",
			IstioVersion: &model.IstioVersion{
				Major: 1,
				Minor: 20,
			},
		})
	}

	nodeWithExtended := func(cg *core.ConfigGenTest) *model.Proxy {
		out := node(cg)