} else {
		nameFldPath := fldPath.Child("name")
		for _, err := range validation.IsDNS1123Subdomain(nro.Name) {
			allErrs = append(allErrs, field.Invalid(nameFldPath, nro.Name, err))
		}
	}
	allErrs = append(allErrs, ValidateSocketPath(nro.CRISocket, fldPath.Child("criSocket"))...)

	if ref == nil {
		return allErrs
	}

	// group is required but the Core group is the empty value, so it can not be enforced.
	if ref.APIGroup != "" {
		for _, msg := range utilvalidation.IsDNS1123Subdomain(ref.APIGroup) {
			allErrs = append(allErrs, field.Invalid(fldPath.Child("apiGroup"), ref.APIGroup, msg))
		}
	}

	if ref.Kind == "" {
		allErrs = append(allErrs, field.Required(fldPath.Child("kind"), ""))

	for _, altname := range SANs {
		if ip := netutils.ParseIPSloppy(altname); ip != nil {
			altNames.IPs = append(altNames.IPs, ip)
		} else if len(validation.IsDNS1123Subdomain(altname)) == 0 {
			altNames.DNSNames = append(altNames.DNSNames, altname)
		} else if len(validation.IsWildcardDNS1123Subdomain(altname)) == 0 {
			altNames.DNSNames = append(altNames.DNSNames, altname)
		} else {

		} else if seenAuthorizerNames.Has(a.Name) {
			allErrs = append(allErrs, field.Duplicate(fldPath.Child("name"), a.Name))
		} else if errs := utilvalidation.IsDNS1123Subdomain(a.Name); len(errs) != 0 {
			allErrs = append(allErrs, field.Invalid(fldPath.Child("name"), a.Name, fmt.Sprintf("authorizer name is invalid: %s", strings.Join(errs, ", "))))
		}
		seenAuthorizerNames.Insert(a.Name)

	} else {
		// this matches the APIService group field validation
		if len(gv.Group) > 0 {
			if errs := utilvalidation.IsDNS1123Subdomain(gv.Group); len(errs) > 0 {
				allErrors = append(allErrors, field.Invalid(fldPath.Child("apiVersion"), gv.Group, strings.Join(errs, ",")))
			}
		}
		// this matches the APIService version field validation

// ValidateDNS1123Subdomain validates that a name is a proper DNS subdomain.
func ValidateDNS1123Subdomain(value string, fldPath *field.Path) field.ErrorList {
	allErrs := field.ErrorList{}
	for _, msg := range validation.IsDNS1123Subdomain(value) {
		allErrs = append(allErrs, field.Invalid(fldPath, value, msg))
	}
	return allErrs
}

	allErrs := field.ErrorList{}

	if len(spec.Group) == 0 {
		allErrs = append(allErrs, field.Required(fldPath.Child("group"), ""))
	} else if errs := utilvalidation.IsDNS1123Subdomain(spec.Group); len(errs) > 0 {
		allErrs = append(allErrs, field.Invalid(fldPath.Child("group"), spec.Group, strings.Join(errs, ",")))
	} else if len(strings.Split(spec.Group, ".")) < 2 {

	shortSecretName := "key-name"
	shortSecretRef := &core.SecretReference{
		Name:      shortSecretName,
		Namespace: "default",
	}

	// longSecretRef refers to the secretRefs which are validated with IsDNS1123Subdomain
	longSecretName := "key-name.example.com"
	longSecretRef := &core.SecretReference{
		Name:      longSecretName,
		Namespace: "default",
	}

	// invalidSecrets missing name, namespace and both