return false
		}
		if subject.ServiceAccount.Name == flowcontrol.NameAll {
			return serviceAccountMatchesNamespace(subject.ServiceAccount.Namespace, user.GetName())
		}
		return serviceaccount.MatchesUsername(subject.ServiceAccount.Namespace, subject.ServiceAccount.Name, user.GetName())
	default:
		return false
	}
}

		"invalid chars in name": {
			Namespace:   "foo",
			Name:        "bar ",
			ExpectedErr: true,
		},
	}

	for k, tc := range testCases {
		username := MakeUsername(tc.Namespace, tc.Name)
		if !MatchesUsername(tc.Namespace, tc.Name, username) {
			t.Errorf("%s: Expected to match username", k)
		}
		namespace, name, err := SplitUsername(username)
		if (err != nil) != tc.ExpectedErr {

	return ServiceAccountUsernamePrefix + namespace + ServiceAccountUsernameSeparator + name
}

// MatchesUsername checks whether the provided username matches the namespace and name without
// allocating. Use this when checking a service account namespace and name against a known string.
func MatchesUsername(namespace, name string, username string) bool {
	if !strings.HasPrefix(username, ServiceAccountUsernamePrefix) {
		return false

		if len(subject.Namespace) > 0 {
			saNamespace = subject.Namespace
		}
		if len(saNamespace) == 0 {
			return false
		}
		// use a more efficient comparison for RBAC checking
		return serviceaccount.MatchesUsername(saNamespace, subject.Name, user.GetName())
	default:
		return false
	}
}

// NewTestRuleResolver returns a rule resolver from lists of role objects.