storage[resource] = subjectaccessreview.NewREST(p.Authorizer)
	}

	// selfsubjectaccessreviews
	if resource := "selfsubjectaccessreviews"; apiResourceConfigSource.ResourceEnabled(authorizationv1.SchemeGroupVersion.WithResource(resource)) {
		storage[resource] = selfsubjectaccessreview.NewREST(p.Authorizer)
	}

	// localsubjectaccessreviews

      "singularName": "localsubjectaccessreview",
      "verbs": [
        "create"
      ]
    },
    {
      "kind": "SelfSubjectAccessReview",
      "name": "selfsubjectaccessreviews",
      "namespaced": false,
      "singularName": "selfsubjectaccessreview",
      "verbs": [
        "create"
      ]
    },
    {
      "kind": "SelfSubjectRulesReview",
      "name": "selfsubjectrulesreviews",

	{Group: authentication.GroupName, Resource: "selfsubjectreviews"}:       {},
	{Group: authorization.GroupName, Resource: "subjectaccessreviews"}:      {},
	{Group: authorization.GroupName, Resource: "selfsubjectaccessreviews"}:  {},
	{Group: authorization.GroupName, Resource: "localsubjectaccessreviews"}: {},
	{Group: authorization.GroupName, Resource: "selfsubjectrulesreviews"}:   {},

	// events haven't been quota-ed before

	{Group: "authentication.k8s.io", Resource: "tokenreviews"},
	{Group: "authorization.k8s.io", Resource: "localsubjectaccessreviews"},
	{Group: "authorization.k8s.io", Resource: "selfsubjectaccessreviews"},
	{Group: "authorization.k8s.io", Resource: "selfsubjectrulesreviews"},
	{Group: "authorization.k8s.io", Resource: "subjectaccessreviews"},
	// END interception of these non-persisted resources may break the cluster
}

	"v1/bindings",
	"v1/componentstatuses",
	"authentication.k8s.io/v1/selfsubjectreviews",
	"authentication.k8s.io/v1/tokenreviews",
	"authorization.k8s.io/v1/localsubjectaccessreviews",
	"authorization.k8s.io/v1/selfsubjectaccessreviews",
	"authorization.k8s.io/v1/selfsubjectrulesreviews",
	"authorization.k8s.io/v1/subjectaccessreviews",
)

// GVRToStorageVersionHash shouldn't change unless we intentionally change the

              ]
            },
            {
              "resource": "selfsubjectaccessreviews",
              "responseKind": {
                "group": "",
                "kind": "SelfSubjectAccessReview",
                "version": ""
              },
              "scope": "Cluster",
              "singularResource": "selfsubjectaccessreview",
              "verbs": [
                "create"
              ]

              ]
            },
            {
              "resource": "selfsubjectaccessreviews",
              "responseKind": {
                "group": "",
                "kind": "SelfSubjectAccessReview",
                "version": ""
              },
              "scope": "Cluster",
              "singularResource": "selfsubjectaccessreview",
              "verbs": [
                "create"
              ]

				Resource:  resource,
			},
		},
	}

	response, err := c.Kube().AuthorizationV1().SelfSubjectAccessReviews().Create(context.Background(), s, metav1.CreateOptions{})
	if err != nil {
		return err
	}

	if !response.Status.Allowed {
		if len(response.Status.Reason) > 0 {
			return errors.New(response.Status.Reason)
		}
		return errors.New("permission denied")
	}
	return nil
}

    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: system:basic-user
  rules:
  - apiGroups:
    - authorization.k8s.io
    resources:
    - selfsubjectaccessreviews
    - selfsubjectrulesreviews
    verbs:
    - create
  - apiGroups:
    - authentication.k8s.io
    resources:
    - selfsubjectreviews
    verbs:
    - create

					"/livez/*", "/readyz/*", "/healthz/*",
				).RuleOrDie(),
			},
		},
	}

	basicUserRules := []rbacv1.PolicyRule{
		rbacv1helpers.NewRule("create").Groups(authorizationGroup).Resources("selfsubjectaccessreviews", "selfsubjectrulesreviews").RuleOrDie(),
		rbacv1helpers.NewRule("create").Groups(authenticationGroup).Resources("selfsubjectreviews").RuleOrDie(),
	}

	roles = append(roles, []rbacv1.ClusterRole{
		{