return true
		}
	}
	return false
}

func matchesResourcePolicyRule(ri *request.RequestInfo, policyRule flowcontrol.ResourcePolicyRule) bool {
	if !matchPolicyRuleVerb(policyRule.Verbs, ri.Verb) {
		return false
	}
	if !matchPolicyRuleResource(policyRule.Resources, ri.Resource, ri.Subresource) {
		return false
	}
	if !matchPolicyRuleAPIGroup(policyRule.APIGroups, ri.APIGroup) {
		return false

		IsResourceRequest: true,
		Verb:              "create",
		APIGroup:          "rbac.authorization.k8s.io",
		APIVersion:        "v1",
		Namespace:         "myns",
		Resource:          "roles",
		Name:              "",
	})
	updateContext := request.WithRequestInfo(request.WithNamespace(context.TODO(), "myns"), &request.RequestInfo{
		IsResourceRequest: true,
		Verb:              "update",

func GetOperationIDAndTags(r *restful.Route) (string, []string, error) {
	op := r.Operation
	path := r.Path
	var tags []string
	prefix, exists := verbs.GetPrefix(op)
	if !exists {
		return op, tags, fmt.Errorf("operation names should start with a verb. Cannot determine operation verb from %v", op)
	}
	op = op[len(prefix):]
	parts := strings.Split(strings.Trim(path, "/"), "/")

	for i := range semanticRoles.edit.Rules {
		rule := semanticRoles.edit.Rules[i]
		remainingVerbs := []string{}
		for _, verb := range rule.Verbs {
			if readVerbs.Has(verb) {
				remainingVerbs = append(remainingVerbs, verb)
			}
		}
		rule.Verbs = remainingVerbs
		semanticRoles.edit.Rules[i] = rule
	}

	// confirm that the view role doesn't already have extra powers

  // verbs is a list of supported API operation types (this includes
  // but is not limited to get, list, watch, create, update, patch,
  // delete, deletecollection, and proxy). Subresources may define
  // custom verbs outside the standard Kubernetes verb set. Clients
  // should expect the behavior of standard verbs to align with
  // Kubernetes interaction conventions.

	SingularResource string `json:"singularResource" protobuf:"bytes,4,opt,name=singularResource"`
	// verbs is a list of supported API operation types (this includes
	// but is not limited to get, list, watch, create, update, patch,
	// delete, deletecollection, and proxy).
	// +listType=set
	Verbs []string `json:"verbs" protobuf:"bytes,5,opt,name=verbs"`
	// shortNames is a list of suggested short names of the resource.
	// +listType=set

	SingularResource string `json:"singularResource" protobuf:"bytes,4,opt,name=singularResource"`
	// verbs is a list of supported API operation types (this includes
	// but is not limited to get, list, watch, create, update, patch,
	// delete, deletecollection, and proxy).
	// +listType=set
	Verbs []string `json:"verbs" protobuf:"bytes,5,opt,name=verbs"`
	// shortNames is a list of suggested short names of the resource.
	// +listType=set

  // verbs is a list of supported API operation types (this includes
  // but is not limited to get, list, watch, create, update, patch,
  // delete, deletecollection, and proxy). Subresources may define
  // custom verbs outside the standard Kubernetes verb set. Clients
  // should expect the behavior of standard verbs to align with
  // Kubernetes interaction conventions.

  // verbs is a list of supported API operation types (this includes
  // but is not limited to get, list, watch, create, update, patch,
  // delete, deletecollection, and proxy). Subresources may define
  // custom verbs outside the standard Kubernetes verb set. Clients
  // should expect the behavior of standard verbs to align with
  // Kubernetes interaction conventions.

	// +listMapKey=kind
	AcceptedTypes []v1.GroupVersionKind
	// verbs is a list of supported API operation types (this includes
	// but is not limited to get, list, watch, create, update, patch,
	// delete, deletecollection, and proxy). Subresources may define
	// custom verbs outside the standard Kubernetes verb set. Clients
	// should expect the behavior of standard verbs to align with
	// Kubernetes interaction conventions.
	// +listType=set