//
  // The following VolumeConext will be passed if podInfoOnMount is set to true.
  // This list might grow, but the prefix will be used.
  // "csi.storage.k8s.io/pod.name": pod.Name
  // "csi.storage.k8s.io/pod.namespace": pod.Namespace
  // "csi.storage.k8s.io/pod.uid": string(pod.UID)
  // "csi.storage.k8s.io/ephemeral": "true" if the volume is an ephemeral inline volume
  //                                 defined by a CSIVolumeSource, otherwise "false"

  //
  // The following VolumeContext will be passed if podInfoOnMount is set to true.
  // This list might grow, but the prefix will be used.
  // "csi.storage.k8s.io/pod.name": pod.Name
  // "csi.storage.k8s.io/pod.namespace": pod.Namespace
  // "csi.storage.k8s.io/pod.uid": string(pod.UID)
  // "csi.storage.k8s.io/ephemeral": "true" if the volume is an ephemeral inline volume
  //                                 defined by a CSIVolumeSource, otherwise "false"

  //
  // The following VolumeContext will be passed if podInfoOnMount is set to true.
  // This list might grow, but the prefix will be used.
  // "csi.storage.k8s.io/pod.name": pod.Name
  // "csi.storage.k8s.io/pod.namespace": pod.Namespace
  // "csi.storage.k8s.io/pod.uid": string(pod.UID)
  // "csi.storage.k8s.io/ephemeral": "true" if the volume is an ephemeral inline volume
  //                                 defined by a CSIVolumeSource, otherwise "false"

	"nodeTopology":      "nodeTopology defines which nodes have access to the storage for which capacity was reported. If not set, the...

// RoleBinding references a role, but does not contain it.  It can reference a Role in the same namespace or a ClusterRole in the global namespace.
// It adds who information via Subjects and namespace information by which namespace it exists in.  RoleBindings in a given
// namespace only have effect in that namespace.
// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleBinding, and will no longer be served in v1.22.

  //
  // The following VolumeConext will be passed if podInfoOnMount is set to true.
  // This list might grow, but the prefix will be used.
  // "csi.storage.k8s.io/pod.name": pod.Name
  // "csi.storage.k8s.io/pod.namespace": pod.Namespace
  // "csi.storage.k8s.io/pod.uid": string(pod.UID)
  // "csi.storage.k8s.io/ephemeral": "true" if the volume is an ephemeral inline volume
  //                                 defined by a CSIVolumeSource, otherwise "false"

func ruleMatchesResource(r *audit.PolicyRule, attrs authorizer.Attributes) bool {
	if !attrs.IsResourceRequest() {
		return false
	}

	if len(r.Namespaces) > 0 {
		if !hasString(r.Namespaces, attrs.GetNamespace()) { // Non-namespaced resources use the empty string.
			return false
		}
	}
	if len(r.Resources) == 0 {
		return true
	}

	apiGroup := attrs.GetAPIGroup()

            "type": "string"
          },
          "namespace": {
            "description": "Namespace is the namespace of the action being requested.  Currently, there is no distinction between no namespace and all namespaces \"\" (empty) is defaulted for LocalSubjectAccessReviews \"\" (empty) is empty for cluster-scoped resources \"\" (empty) means \"all\" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview",

    - path: staging/src/k8s.io/kubectl/testdata/set/namespaced-resource.yaml
      match: registry.k8s.io\/pause:\d+\.\d+
    - path: test/cmd/core.sh
      match: registry.k8s.io\/pause:\d+\.\d+
    - path: test/fixtures/pkg/kubectl/cmd/set/multi-resource-yaml.yaml
      match: registry.k8s.io\/pause:\d+\.\d+
    - path: test/fixtures/pkg/kubectl/cmd/set/namespaced-resource.yaml
      match: registry.k8s.io\/pause:\d+\.\d+

	}

	return errs.ToError()
}

// GetPrunedResources get the list of resources to be removed
// 1. if includeClusterResources is false, we list the namespaced resources by matching revision and component labels.
// 2. if includeClusterResources is true, we list the namespaced and cluster resources by component labels only.
// If componentName is not empty, only resources associated with specific components would be returned