addPolicy(action, anonymousName, "0")
				}
			}
		}
	}

	buf := strings.Builder{}
	buf.WriteString("ACTION\tAuthorizationPolicy\tRULES\n")
	for _, action := range []rbacpb.RBAC_Action{rbacpb.RBAC_DENY, rbacpb.RBAC_ALLOW, rbacpb.RBAC_LOG} {
		if names, ok := actionToPolicy[action]; ok {
			sortedNames := make([]string, 0, len(names))
			for name := range names {
				sortedNames = append(sortedNames, name)
			}

,GACT,OAAOA,EAAKgI,UAAYhI,EAAKgI,SAAS5E,gBAAkB4E,IAI3D7B,MAAS,SAAU6F,GAClB,IAAIkD,EAAUzK,EAAYuH,EAAY,KAEtC,OAAOkD,IACJA,EAAU,IAAIxJ,OAAQ,MAAQL,EAC/B,IAAM2G,EAAY,IAAM3G,EAAa,SAAaZ,EACjDuH,EAAW,SAAUhM,GACpB,OAAOkP,EAAQ9F,KACY,iBAAnBpJ,EAAKgM,WAA0BhM,EAAKgM,WACd,oBAAtBhM,EAAK7B,cACX6B,EAAK7B,aAAc,UACpB,OAKNkI,KAAQ,SAAUrF,EAAMmO,EAAUC,GACjC,OAAO,SAAUpP,GAChB,IAAIqP,EAAShM,GAAOwK,KAAM7N,EAAMgB,GAEhC,OAAe,MAAVqO,EACgB,OAAbF,GAEFA,IAINE,GAAU,GAIU,MAAbF,EAAmBE,IAAWD,EACvB,OAAbD,EAAoBE,IAAWD,EAClB,OAAbD,...

  verbs: ["use"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: ztunnel
  labels:
    app: ztunnel
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ztunnel

,GACT,OAAOA,EAAKgI,UAAYhI,EAAKgI,SAAS5E,gBAAkB4E,IAI3D7B,MAAS,SAAU6F,GAClB,IAAIkD,EAAUzK,EAAYuH,EAAY,KAEtC,OAAOkD,IACJA,EAAU,IAAIxJ,OAAQ,MAAQL,EAC/B,IAAM2G,EAAY,IAAM3G,EAAa,SAAaZ,EACjDuH,EAAW,SAAUhM,GACpB,OAAOkP,EAAQ9F,KACY,iBAAnBpJ,EAAKgM,WAA0BhM,EAAKgM,WACd,oBAAtBhM,EAAK7B,cACX6B,EAAK7B,aAAc,UACpB,OAKNkI,KAAQ,SAAUrF,EAAMmO,EAAUC,GACjC,OAAO,SAAUpP,GAChB,IAAIqP,EAAShM,GAAOwK,KAAM7N,EAAMgB,GAEhC,OAAe,MAAVqO,EACgB,OAAbF,GAEFA,IAINE,GAAU,GAIU,MAAbF,EAAmBE,IAAWD,EACvB,OAAbD,EAAoBE,IAAWD,EAClB,OAAbD,...

                                  "request": {}
                                },
                                "metadata_key": {
                                  "key": "envoy.filters.http.rbac",
                                  "path": [
                                    {
                                      "key": "istio_dry_run_allow_shadow_effective_policy_id"
                                    }

{{ $mcsAPIGroup := or .Values.pilot.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
  labels:
    app: istio-reader
    release: {{ .Release.Name }}
rules:
  - apiGroups:
      - "config.istio.io"
      - "security.istio.io"
      - "networking.istio.io"

                                  "request": {}
                                },
                                "metadata_key": {
                                  "key": "envoy.filters.http.rbac",
                                  "path": [
                                    {
                                      "key": "istio_dry_run_allow_shadow_effective_policy_id"
                                    }

    - [RBAC](https://docs.projectcalico.org/v3.2/getting-started/kubernetes/installation/rbac.yaml) - this creates the service account the CNI plugin is configured to use to access the kube-api-server...

# Casdoor Quickstart Guide [![Slack](https://slack.min.io/slack?type=svg)](https://slack.min.io)

Casdoor is a UI-first centralized authentication / Single-Sign-On (SSO) platform supporting OAuth 2.0, OIDC and SAML, integrated with Casbin RBAC and ABAC permission management. This document covers configuring Casdoor identity provider support with MinIO.

## Prerequisites

  // EvaluationError is an indication that some error occurred during the authorization check.
  // It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
  // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
  // +optional
  optional string evaluationError = 3;
}