verbs: ["get", "list", "patch", "watch"]
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["spire.spiffe.io"]
    resources: ["clusterfederatedtrustdomains"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["spire.spiffe.io"]

// namespace as the ResourceClaim.
message ResourceClaimConsumerReference {
  // APIGroup is the group for the resource being referenced. It is
  // empty for the core API. This matches the group in the APIVersion
  // that is used when creating the resources.
  // +optional
  optional string apiGroup = 1;

  // Resource is the type of resource being referenced, for example "pods".
  optional string resource = 3;

			Verbs:      []string{"goodverb"},
			APIGroups:  []string{"goodapig"},
			Resources:  []string{"goodrscs"},
			Namespaces: []string{"goodns"}}}}, {
		Subjects: []flowcontrol.Subject{{Kind: flowcontrol.SubjectKindGroup,
			Group: &flowcontrol.GroupSubject{Name: "goodg1"}}},
		ResourceRules: []flowcontrol.ResourcePolicyRule{{
			Verbs:      []string{"goodverb"},
			APIGroups:  []string{"goodapig"},

			}(),
		},
		"good-parameters-apigroup": {
			claim: func() *resource.ResourceClaim {
				claim := testClaim(goodName, goodNS, goodClaimSpec)
				claim.Spec.ParametersRef = &resource.ResourceClaimParametersReference{
					APIGroup: goodAPIGroup,
					Kind:     "foo",
					Name:     "bar",
				}
				return claim
			}(),
		},
		"bad-parameters-apigroup": {

			request: &http.Request{
				Method: "GET",
				URL: &url.URL{
					RawPath: "/api/v1/pods",
				},
			},
			requestInfo: &request.RequestInfo{
				Verb:              "list",
				APIGroup:          "",
				APIVersion:        "v1",
				Resource:          "pods",
				IsResourceRequest: true,
			},
			isMutating: false,
			want: `

// to specify a cluster or namespace-scoped resource.
message IngressClassParametersReference {
  // apiGroup is the group for the resource being referenced. If APIGroup is
  // not specified, the specified Kind must be in the core API group. For any
  // other third-party types, APIGroup is required.
  // +optional
  optional string aPIGroup = 1;

  // kind is the type of resource being referenced.
  optional string kind = 2;

            spec:
              accessModes:
              - accessModesValue
              dataSource:
                apiGroup: apiGroupValue
                kind: kindValue
                name: nameValue
              dataSourceRef:
                apiGroup: apiGroupValue
                kind: kindValue
                name: nameValue
                namespace: namespaceValue

            spec:
              accessModes:
              - accessModesValue
              dataSource:
                apiGroup: apiGroupValue
                kind: kindValue
                name: nameValue
              dataSourceRef:
                apiGroup: apiGroupValue
                kind: kindValue
                name: nameValue
                namespace: namespaceValue

            spec:
              accessModes:
              - accessModesValue
              dataSource:
                apiGroup: apiGroupValue
                kind: kindValue
                name: nameValue
              dataSourceRef:
                apiGroup: apiGroupValue
                kind: kindValue
                name: nameValue
                namespace: namespaceValue

            spec:
              accessModes:
              - accessModesValue
              dataSource:
                apiGroup: apiGroupValue
                kind: kindValue
                name: nameValue
              dataSourceRef:
                apiGroup: apiGroupValue
                kind: kindValue
                name: nameValue
                namespace: namespaceValue