}{
		{
			name:   "allowed configmap",
			attrs:  authorizer.AttributesRecord{User: node0, ResourceRequest: true, Verb: "get", Resource: "configmaps", Name: "configmap0-pod0-node0", Namespace: "ns0"},
			expect: authorizer.DecisionAllow,
		},
		{
			name:   "allowed secret via pod",
			attrs:  authorizer.AttributesRecord{User: node0, ResourceRequest: true, Verb: "get", Resource: "secrets", Name: "secret0-pod0-node0", Namespace: "ns0"},

					{
						DriverName: goodName,
						Requests: []resource.ResourceRequest{
							{
								ResourceRequestModel: resource.ResourceRequestModel{
									NamedResources: &resource.NamedResourcesRequest{Selector: "true"},
								},
							},
						},
					},
					{
						DriverName: badName,
						Requests: []resource.ResourceRequest{
							{
								ResourceRequestModel: resource.ResourceRequestModel{

	}
	if err := s.AddGeneratedConversionFunc((*v1alpha2.ResourceRequest)(nil), (*resource.ResourceRequest)(nil), func(a, b interface{}, scope conversion.Scope) error {
		return Convert_v1alpha2_ResourceRequest_To_resource_ResourceRequest(a.(*v1alpha2.ResourceRequest), b.(*resource.ResourceRequest), scope)
	}); err != nil {
		return err
	}

	aliceAttr := authorizer.AttributesRecord{User: &user.DefaultInfo{Name: "alice"}, ResourceRequest: true, Namespace: "kittensandponies"}
	bobAttr := authorizer.AttributesRecord{User: &user.DefaultInfo{Name: "bob"}, ResourceRequest: true, Namespace: "kittensandponies"}
	aliceRidiculousAttr := authorizer.AttributesRecord{
		User:            &user.DefaultInfo{Name: "alice"},
		ResourceRequest: true,
		Verb:            strings.Repeat("v", 2000),

func (in *ResourceRequest) DeepCopyInto(out *ResourceRequest) {
	*out = *in
	in.VendorParameters.DeepCopyInto(&out.VendorParameters)
	in.ResourceRequestModel.DeepCopyInto(&out.ResourceRequestModel)
	return
}

// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceRequest.
func (in *ResourceRequest) DeepCopy() *ResourceRequest {
	if in == nil {
		return nil
	}

func (in *ResourceRequest) DeepCopyInto(out *ResourceRequest) {
	*out = *in
	if in.VendorParameters != nil {
		out.VendorParameters = in.VendorParameters.DeepCopyObject()
	}
	in.ResourceRequestModel.DeepCopyInto(&out.ResourceRequestModel)
	return
}

// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceRequest.

			results: []EvaluationResult{
				{
					EvalResult: celtypes.True,
				},
				{
					EvalResult: celtypes.False,
				},
			},
			authorizer: newAuthzAllowMatch(authorizer.AttributesRecord{
				ResourceRequest: true,
				Resource:        "endpoints",
				Verb:            "create",
				APIVersion:      "*",
			}),
		},
		{
			name: "test authorizer allow resource check with all fields",

		APIGroup:        "",
		APIVersion:      "v1",
		Verb:            a.ExpectedVerb,
		Resource:        "nodes",
		Name:            authzTestNodeName,
		Subresource:     a.ExpectedSubresource,
		ResourceRequest: true,
		Path:            a.Path,
	}

	assert.Equal(t, expectedAttributes, attrs)
}

func AuthzTestUser() user.Info {
	return &user.DefaultInfo{Name: authzTestUserName}
}

		Verb:            apiVerb,
		Namespace:       "",
		APIGroup:        "",
		APIVersion:      "v1",
		Resource:        "nodes",
		Subresource:     "proxy",
		Name:            string(n.nodeName),
		ResourceRequest: true,
		Path:            requestPath,
	}

	// Override subresource for specific paths
	// This allows subdividing access to the kubelet API
	switch {
	case isSubpath(requestPath, statsPath):

	paramRef := binding.Spec.ParamRef
	verb := "get"

	if len(paramRef.Name) == 0 {
		verb = "list"
	}

	attrs = authorizer.AttributesRecord{
		User:            user,
		Verb:            verb,
		ResourceRequest: true,
		Name:            paramRef.Name,
		Namespace:       paramRef.Namespace, // if empty, no namespace indicates get across all namespaces
		APIGroup:        apiGroup,
		APIVersion:      apiVersion,