case "noverbs":
				if r.Verbs == nil {
					t.Errorf("[%d] unexpected nil verbs slice. Expected: []string{}", i)
				}
				if got, expected := sets.NewString([]string(r.Verbs)...), sets.NewString(); !got.Equal(expected) {
					t.Errorf("[%d] unexpected verbs for resource %s/%s: got=%v expected=%v", i, resources.GroupVersion, r.Name, got, expected)
				}
			}
		}
	}
}

func TestPrepareRun(t *testing.T) {

			continue
		}
		if covers, missing := validation.Covers(compacted, rules); !covers {
			t.Errorf("%s: compacted rules did not cover original rules. missing: %#v", k, missing)
			continue
		}
		if covers, missing := validation.Covers(rules, compacted); !covers {
			t.Errorf("%s: original rules did not cover compacted rules. missing: %#v", k, missing)
			continue

		if resource, isSimple := isSimpleResourceRule(&rule); isSimple {
			if existingRule, ok := simpleRules[resource]; ok {
				// Add the new verbs to the existing simple resource rule
				if existingRule.Verbs == nil {
					existingRule.Verbs = []string{}
				}
				existingRule.Verbs = append(existingRule.Verbs, rule.Verbs...)
			} else {
				// Copy the rule to accumulate matching simple resource rules into
				simpleRules[resource] = rule.DeepCopy()

		remainingVerbs := []string{}
		for _, verb := range rule.Verbs {
			if readVerbs.Has(verb) {
				remainingVerbs = append(remainingVerbs, verb)
			}
		}
		rule.Verbs = remainingVerbs
		semanticRoles.edit.Rules[i] = rule
	}

	// confirm that the view role doesn't already have extra powers
	for _, rule := range viewEscalatingNamespaceResources {
		if covers, _ := validation.Covers(semanticRoles.view.Rules, []rbacv1.PolicyRule{rule}); covers {

	_, t := local()
	return t
}

func local() (goVers, toolVers string) {
	toolVers = runtime.Version()
	if TestVersion != "" {
		toolVers = TestVersion
	}
	goVers = FromToolchain(toolVers)
	if goVers == "" {
		// Development branch. Use "Dev" version with just 1.N, no rc1 or .0 suffix.
		goVers = "1." + strconv.Itoa(goversion.Version)
		toolVers = "go" + goVers
	}
	return goVers, toolVers

// version of the form "v1.2.3". Go versions may also include spaces and
// special characters.
func ProgramInfo(info *debug.BuildInfo) (goVers, progPath, progVers string) {
	goVers = info.GoVersion
	if strings.Contains(goVers, "devel") || strings.Contains(goVers, "-") {
		goVers = "devel"
	}

	progPath = info.Path
	if progPath == "" {
		progPath = strings.TrimSuffix(filepath.Base(os.Args[0]), ".exe")
	}

    - serviceaccounts
    verbs:
    - create
  - apiGroups:
    - ""
    resources:
    - secrets
    verbs:
    - delete
  - apiGroups:
    - ""
    resources:
    - configmaps
    - namespaces
    - secrets
    - serviceaccounts
    verbs:
    - get
  - apiGroups:
    - ""
    resources:
    - secrets
    - serviceaccounts
    verbs:
    - update
  - apiGroups:

  - apiGroups: [""]
    verbs: ["update"]
    resources: ["pods/finalizers"]
{{- end }}
  - apiGroups: ["networking.istio.io"]
    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
    resources: [ "workloadentries" ]
  - apiGroups: ["networking.istio.io"]
    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]

                    "version": ""
                  },
                  "subresource": "status",
                  "verbs": [
                    "get",
                    "patch",
                    "update"
                  ]
                }
              ],
              "verbs": [
                "create",
                "delete",
                "deletecollection",
                "get",

  - apiGroups: [""]
    verbs: ["update"]
    resources: ["pods/finalizers"]
{{- end }}
  - apiGroups: ["networking.istio.io"]
    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
    resources: [ "workloadentries" ]
  - apiGroups: ["networking.istio.io"]
    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]