Subresource:       "exec",
			},
			expectedVerb: "CONNECT",
		},
		{
			desc:        "Pod portforward should be transformed to CONNECT",
			initialVerb: "POST",
			request: &http.Request{
				Method: "POST",
				URL: &url.URL{
					RawQuery: "/api/v1/namespaces/default/pods/test-pod/portforward",
				},
				Header: map[string][]string{
					"Connection": {"Upgrade"},
					"Upgrade":    {"SPDY/3.1"},

	{Group: "", Resource: "bindings"},
	{Group: "", Resource: "pods/attach"},
	{Group: "", Resource: "pods/binding"},
	{Group: "", Resource: "pods/eviction"},
	{Group: "", Resource: "pods/exec"},
	{Group: "", Resource: "pods/portforward"},

	// ref: https://github.com/kubernetes/kubernetes/issues/122205#issuecomment-1927390823
	{Group: "", Resource: "serviceaccounts/token"},
}

  - leases
  verbs:
  - get
  - create
  - update
- apiGroups:
  - ""
  resources:
  - configmaps
  - endpoints
  - events
  - namespaces
  - pods
  - pods/proxy
  - pods/portforward
  - persistentvolumeclaims
  - secrets
  - services
  - serviceaccounts
  - resourcequotas
  verbs:
  - '*'
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:

// is a tunneled Kubernetes spdy protocol; false otherwise.
func protocolSupportsWebsocketTunneling(protocol string) bool {
	return strings.HasPrefix(protocol, portforward.WebsocketsSPDYTunnelingPrefix) && strings.HasSuffix(protocol, portforward.KubernetesSuffix)
}

// handle implements a websocket handler.
func (conn *Conn) handle(ws *websocket.Conn) {
	conn.initialize(ws)
	defer conn.Close()

	"k8s.io/apimachinery/pkg/util/httpstream/spdy"
	"k8s.io/apimachinery/pkg/util/httpstream/wsstream"
	utilnet "k8s.io/apimachinery/pkg/util/net"
	constants "k8s.io/apimachinery/pkg/util/portforward"
	"k8s.io/client-go/tools/portforward"
	"k8s.io/klog/v2"
)

// TunnelingHandler is a handler which tunnels SPDY through WebSockets.
type TunnelingHandler struct {
	// Used to communicate between upstream SPDY and downstream tunnel.

  - leases
  verbs:
  - get
  - create
  - update
- apiGroups:
  - ""
  resources:
  - configmaps
  - endpoints
  - events
  - namespaces
  - pods
  - pods/proxy
  - pods/portforward
  - persistentvolumeclaims
  - secrets
  - services
  - serviceaccounts
  - resourcequotas
  verbs:
  - '*'
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:

	recordError(operation, err)
	return out, err
}

func (in instrumentedRuntimeService) PortForward(ctx context.Context, req *runtimeapi.PortForwardRequest) (*runtimeapi.PortForwardResponse, error) {
	const operation = "port_forward"
	defer recordOperation(operation, time.Now())

	resp, err := in.service.PortForward(ctx, req)
	recordError(operation, err)
	return resp, err
}

		storage[resource+"/attach"] = podStorage.Attach
		storage[resource+"/status"] = podStorage.Status
		storage[resource+"/log"] = podStorage.Log
		storage[resource+"/exec"] = podStorage.Exec
		storage[resource+"/portforward"] = podStorage.PortForward
		storage[resource+"/proxy"] = podStorage.Proxy
		storage[resource+"/binding"] = podStorage.Binding
		if podStorage.Eviction != nil {
			storage[resource+"/eviction"] = podStorage.Eviction
		}

  resources:
  - namespaces
  - pods
  - replicationcontrollers
  - services
  verbs:
  - get
  - list
  - watch
  - patch
- apiGroups: [""]
  resources:
  - pods/portforward
  verbs:
  - create
  - post
- apiGroups: ["extensions", "apps"]
  resources:
  - daemonsets
  - deployments
  - replicasets
  - statefulsets
  verbs:
  - get
  - list
  - watch

      rbac.authorization.k8s.io/aggregate-to-edit: "true"
    name: system:aggregate-to-edit
  rules:
  - apiGroups:
    - ""
    resources:
    - pods/attach
    - pods/exec
    - pods/portforward
    - pods/proxy
    - secrets
    - services/proxy
    verbs:
    - get
    - list
    - watch
  - apiGroups:
    - ""
    resources:
    - serviceaccounts
    verbs: