Kind: "foo",
					Name: "bar",
				}
				return template
			}(),
		},
		"good-parameters-apigroup": {
			template: func() *resource.ResourceClaimTemplate {
				template := testClaimTemplate(goodName, goodNS, goodClaimSpec)
				template.Spec.Spec.ParametersRef = &resource.ResourceClaimParametersReference{
					APIGroup: goodAPIGroup,
					Kind:     "foo",
					Name:     "bar",
				}
				return template
			}(),

			}(),
		},
		"good-parameters-apigroup": {
			class: func() *resource.ResourceClass {
				class := testClass(goodName, goodName)
				class.ParametersRef = goodParameters.DeepCopy()
				class.ParametersRef.APIGroup = goodAPIGroup
				return class
			}(),
		},
		"bad-parameters-apigroup": {

	if ref == nil {
		return allErrs
	}

	// group is required but the Core group is the empty value, so it can not be enforced.
	if ref.APIGroup != "" {
		for _, msg := range utilvalidation.IsDNS1123Subdomain(ref.APIGroup) {
			allErrs = append(allErrs, field.Invalid(fldPath.Child("apiGroup"), ref.APIGroup, msg))
		}
	}

	if ref.Kind == "" {
		allErrs = append(allErrs, field.Required(fldPath.Child("kind"), ""))
	} else {

  - create
  - delete
  - patch
- apiGroups: ["apps.openshift.io"]
  resources:
  - deploymentconfigs
  verbs:
  - get
  - list
  - watch
  - patch
- apiGroups: ["project.openshift.io"]
  resources:
  - projects
  verbs:
  - get
- apiGroups: ["route.openshift.io"]
  resources:
  - routes
  verbs:
  - get
- apiGroups: ["authentication.k8s.io"]
  resources:

			}(),
		},
		"good-parameters-apigroup": {
			claim: func() *resource.ResourceClaim {
				claim := testClaim(goodName, goodNS, goodClaimSpec)
				claim.Spec.ParametersRef = &resource.ResourceClaimParametersReference{
					APIGroup: goodAPIGroup,
					Kind:     "foo",
					Name:     "bar",
				}
				return claim
			}(),
		},
		"bad-parameters-apigroup": {

	}
}

func fakeRequestInfo(resource, apiGroup string) *genericapirequest.RequestInfo {
	return &genericapirequest.RequestInfo{
		IsResourceRequest: true,
		Path:              "/api/v1/test",
		Verb:              "test",
		APIPrefix:         "api",
		APIGroup:          apiGroup,
		APIVersion:        "v1",
		Namespace:         "",
		Resource:          resource,

    app.kubernetes.io/part-of: prometheus
  name: prometheus
rules:
  - apiGroups:
      - ""
    resources:
      - nodes
      - nodes/proxy
      - nodes/metrics
      - services
      - endpoints
      - pods
      - ingresses
      - configmaps
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "extensions"
      - "networking.k8s.io"
    resources:

		crbExists          bool
		clusterRoleBinding = &rbac.ClusterRoleBinding{
			ObjectMeta: metav1.ObjectMeta{
				Name: kubeadmconstants.ClusterAdminsGroupAndClusterRoleBinding,
			},
			RoleRef: rbac.RoleRef{
				APIGroup: rbac.GroupName,
				Kind:     "ClusterRole",
				Name:     "cluster-admin",
			},
			Subjects: []rbac.Subject{
				{
					Kind: rbac.GroupKind,

		Object: runtime.RawExtension{Object: obj},
	}
	parameters := "<none>"
	if obj.Spec.Parameters != nil {
		parameters = obj.Spec.Parameters.Kind
		if obj.Spec.Parameters.APIGroup != nil {
			parameters = parameters + "." + *obj.Spec.Parameters.APIGroup
		}
		parameters = parameters + "/" + obj.Spec.Parameters.Name
	}
	createTime := translateTimestampSince(obj.CreationTimestamp)

				Type:        []string{"object"},
				Properties: map[string]spec.Schema{
					"apiGroup": {
						SchemaProps: spec.SchemaProps{
							Description: "APIGroup is the group for the resource being referenced. If APIGroup is not specified, the specified Kind must be in the core API group. For any other third-party types, APIGroup is required.",
							Type:        []string{"string"},
							Format:      "",
						},