allErrs = append(allErrs, field.Invalid(field.NewPath("metadata"), sar.ObjectMeta, `must be empty except for namespace`))
	}

	if sar.Spec.ResourceAttributes != nil && sar.Spec.ResourceAttributes.Namespace != sar.Namespace {
		allErrs = append(allErrs, field.Invalid(field.NewPath("spec.resourceAttributes.namespace"), sar.Spec.ResourceAttributes.Namespace, `must match metadata.namespace`))
	}
	if sar.Spec.NonResourceAttributes != nil {

		extra[k] = authorization.ExtraValue(v)
	}

	sar := &authorization.SubjectAccessReview{
		Spec: authorization.SubjectAccessReviewSpec{
			User:               csr.Spec.Username,
			UID:                csr.Spec.UID,
			Groups:             csr.Spec.Groups,
			Extra:              extra,
			ResourceAttributes: &rattrs,
		},
	}

Authors. All rights reserved.
L2:// Use of this source code is governed by a BSD-style
L3:// license that can be found in the LICENSE file.
L4:
L5:// Prefer SARX/SHLX/SHRX instruction because it has less register restriction on the shift input.
L6:(SAR(Q|L) x y) && buildcfg.GOAMD64 >= 3 => (SARX(Q|L) x y)
L7:(SHL(Q|L) x y) && buildcfg.GOAMD64 >= 3 => (SHLX(Q|L) x y)
L8:(SHR(Q|L) x y) && buildcfg.GOAMD64 >= 3 => (SHRX(Q|L) x y)
L9:
L10:// See comments in ARM64latelower.rules for why these are here.
...

	TLSSecretCaCert = "ca.crt"
	// The ID/name for the CRL in kubernetes tls secret.
	TLSSecretCrl = "ca.crl"
)

type CredentialsController struct {
	secrets kclient.Client[*v1.Secret]
	sar     authorizationv1client.SubjectAccessReviewInterface

	mu                 sync.RWMutex
	authorizationCache map[authorizationKey]authorizationResponse
}

type authorizationKey string

	s.AlwaysAllowPaths = append(s.AlwaysAllowPaths, paths...)
	return s
}

// WithClientTimeout sets the given timeout for SAR client used by this authorizer
func (s *DelegatingAuthorizationOptions) WithClientTimeout(timeout time.Duration) {
	s.ClientTimeout = timeout
}

			if err != nil {
				return err
			}
			sarClient, err := subjectAccessReviewInterfaceFromConfig(clientConfig, "v1beta1", testRetryBackoff)
			if err != nil {
				return fmt.Errorf("error building sar client: %v", err)
			}
			_, err = newWithBackoff(sarClient, 0, 0, testRetryBackoff, authorizer.DecisionNoOpinion, []authzconfig.WebhookMatchCondition{}, noopAuthorizerMetrics(), "")
			return err
		}()

	OUT:       true,
	POP:       true,
	POPA:      true,
	POPCNT:    true,
	PUSH:      true,
	PUSHA:     true,
	RCL:       true,
	RCR:       true,
	ROL:       true,
	ROR:       true,
	SAR:       true,
	SBB:       true,
	SHL:       true,
	SHLD:      true,
	SHR:       true,
	SHRD:      true,
	SUB:       true,
	TEST:      true,
	XADD:      true,
	XCHG:      true,
	XOR:       true,

	/*11133*/ uint16(xSetOp), uint16(SAR),
	/*11135*/ uint16(xArgRM16),
	/*11136*/ uint16(xArg1),
	/*11137*/ uint16(xMatch),
	/*11138*/ uint16(xSetOp), uint16(SAR),
	/*11140*/ uint16(xArgRM32),
	/*11141*/ uint16(xArg1),
	/*11142*/ uint16(xMatch),
	/*11143*/ uint16(xCondDataSize), 11133, 11138, 11147,
	/*11147*/ uint16(xSetOp), uint16(SAR),
	/*11149*/ uint16(xArgRM64),
	/*11150*/ uint16(xArg1),

	shr := x>>s | y<<ŝ
	// amd64:"SHLQ.*,.*,"
	shl := x<<s | y>>ŝ
	return shr, shl
}

func checkShiftToMask(u []uint64, s []int64) {
	// amd64:-"SHR",-"SHL","ANDQ"
	u[0] = u[0] >> 5 << 5
	// amd64:-"SAR",-"SHL","ANDQ"
	s[0] = s[0] >> 5 << 5
	// amd64:-"SHR",-"SHL","ANDQ"
	u[1] = u[1] << 5 >> 5

		r.Status = entry.(authorizationv1.SubjectAccessReviewStatus)
	} else {
		var result *authorizationv1.SubjectAccessReview
		var metricsResult string
		// WithExponentialBackoff will return SAR create error (sarErr) if any.
		if err := webhook.WithExponentialBackoff(ctx, w.retryBackoff, func() error {
			var sarErr error
			var statusCode int

			start := time.Now()