Subjects: []rbacapi.Subject{
					{Kind: "User", APIGroup: v1alpha1.GroupName, Name: "myuser"},
					{Kind: "Group", APIGroup: v1alpha1.GroupName, Name: "mygroup"},
					{Kind: "ServiceAccount", APIGroup: "", Name: "mysa", Namespace: "myns"},
					{Kind: "User", APIGroup: v1alpha1.GroupName, Name: "myuser"},
					{Kind: "Group", APIGroup: v1alpha1.GroupName, Name: "mygroup"},

						{Kind: rbacv1.GroupKind, APIGroup: rbacv1.GroupName, Name: user.SystemPrivilegedGroup},
						{Kind: rbacv1.UserKind, APIGroup: rbacv1.GroupName, Name: "super-admin"},
						{Kind: rbacv1.GroupKind, APIGroup: rbacv1.GroupName, Name: "super-admins"},
						{Kind: rbacv1.UserKind, APIGroup: rbacv1.GroupName, Name: "admin"},
						{Kind: rbacv1.GroupKind, APIGroup: rbacv1.GroupName, Name: "admins"},
					},
				},
				{

			RoleRef:    rbac.RoleRef{APIGroup: rbac.GroupName, Kind: "ClusterRole", Name: "valid"},
			Subjects: []rbac.Subject{
				{Name: "validsaname", APIGroup: "", Namespace: "foo", Kind: rbac.ServiceAccountKind},
				{Name: "valid@username", APIGroup: rbac.GroupName, Kind: rbac.UserKind},
				{Name: "valid@groupname", APIGroup: rbac.GroupName, Kind: rbac.GroupKind},
			},
		},
	)
	if len(errs) != 0 {

	{Group: authentication.GroupName, Resource: "tokenreviews"}:             {},
	{Group: authentication.GroupName, Resource: "selfsubjectreviews"}:       {},
	{Group: authorization.GroupName, Resource: "subjectaccessreviews"}:      {},
	{Group: authorization.GroupName, Resource: "selfsubjectaccessreviews"}:  {},
	{Group: authorization.GroupName, Resource: "localsubjectaccessreviews"}: {},

			case result.Operation == reconciliation.ReconcileUpdate:
				klog.V(2).Infof("updated clusterrole.%s/%s with additional permissions: %v", rbac.GroupName, clusterRole.Name, result.MissingRules)
			case result.Operation == reconciliation.ReconcileCreate:
				klog.V(2).Infof("created clusterrole.%s/%s", rbac.GroupName, clusterRole.Name)
			}
			return nil

	if !alreadyExists {
		s.apiGroupNames = append(s.apiGroupNames, apiGroup.Name)
	}
}

func (s *rootAPIsHandler) RemoveGroup(groupName string) {
	s.lock.Lock()
	defer s.lock.Unlock()

	delete(s.apiGroups, groupName)
	for i := range s.apiGroupNames {
		if s.apiGroupNames[i] == groupName {
			s.apiGroupNames = append(s.apiGroupNames[:i], s.apiGroupNames[i+1:]...)
			break
		}
	}
}

}

func SetDefaults_ClusterRoleBinding(obj *rbacv1.ClusterRoleBinding) {
	if len(obj.RoleRef.APIGroup) == 0 {
		obj.RoleRef.APIGroup = GroupName
	}
}
func SetDefaults_RoleBinding(obj *rbacv1.RoleBinding) {
	if len(obj.RoleRef.APIGroup) == 0 {
		obj.RoleRef.APIGroup = GroupName
	}
}
func SetDefaults_Subject(obj *rbacv1.Subject) {
	if len(obj.APIGroup) == 0 {
		switch obj.Kind {
		case rbacv1.ServiceAccountKind:

		if err != nil {
			return nil, err
		}
		storage[resource] = s
		storage[resource+"/status"] = status
	}

	return storage, nil
}

// GroupName is the group name for the storage provider
func (p StorageProvider) GroupName() string {
	return apiserverinternal.GroupName

			client: newMockClusterRoleBinddingClientForTest(t, &rbac.ClusterRoleBinding{
				ObjectMeta: metav1.ObjectMeta{
					Name: constants.NodeKubeletBootstrap,
				},
				RoleRef: rbac.RoleRef{
					APIGroup: rbac.GroupName,
					Kind:     "ClusterRole",
					Name:     constants.NodeBootstrapperClusterRoleName,
				},
				Subjects: []rbac.Subject{
					{
						Kind: rbac.GroupKind,
						Name: constants.NodeBootstrapTokenAuthGroup,

package v1beta1

import (
	nodev1beta1 "k8s.io/api/node/v1beta1"
	"k8s.io/apimachinery/pkg/runtime/schema"
)

// GroupName for node API
const GroupName = "node.k8s.io"

// SchemeGroupVersion is group version used to register these objects
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1beta1"}

// Resource takes an unqualified resource and returns a Group qualified GroupResource