)

func Test_tokenSupplier_GetRequestMetadata(t *testing.T) {
	ctx := context.Background()
	cli := NewFakeClient()
	clientset := cli.Kube().(*fake.Clientset)
	clientset.PrependReactor("create", "serviceaccounts",
		func(action clienttesting.Action) (handled bool, ret runtime.Object, err error) {
			act, ok := action.(clienttesting.CreateActionImpl)
			if !ok {
				return false, nil, nil
			}

	"v1/podtemplates":           "LIXB2x4IFpk=",
	"v1/replicationcontrollers": "Jond2If31h0=",
	"v1/resourcequotas":         "8uhSgffRX6w=",
	"v1/secrets":                "S6u1pOWzb84=",
	"v1/serviceaccounts":        "pbx9ZvyFpBE=",
	"v1/services":               "0/CO1lhkEBI=",
	"autoscaling/v1/horizontalpodautoscalers": "qwQve8ut294=",
	"autoscaling/v2/horizontalpodautoscalers": "qwQve8ut294=",

  - pods
  - pods/proxy
  - pods/portforward
  - persistentvolumeclaims
  - secrets
  - services
  - serviceaccounts
  - resourcequotas
  verbs:
  - '*'
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: istio-operator
subjects:
- kind: ServiceAccount
  name: istio-operator
  namespace: operator-test-namespace
roleRef:
  kind: ClusterRole

    - deads2k
    - liggitt
    - tallclair
  sig-auth-policy-reviewers:
    - deads2k
    - liggitt
    - tallclair
    - krmayankk
  sig-auth-serviceaccounts-approvers:
    - deads2k
    - enj
    - liggitt
    - mikedanese
  sig-auth-serviceaccounts-reviewers:
    - deads2k
    - enj
    - liggitt
    - mikedanese
  # SIG Release
  release-engineering-approvers:

}

func getServiceAccountsName(kubeClient kube.CLIClient, toComplete, ns string) ([]string, error) {
	ctx := context.Background()
	saList, err := kubeClient.Kube().CoreV1().ServiceAccounts(ns).List(ctx, metav1.ListOptions{})
	if err != nil {
		return nil, err
	}

	var saNameList []string
	for _, sa := range saList.Items {
		if toComplete == "" || strings.HasPrefix(sa.Name, toComplete) {

    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
    resources: [ "services" ]
  - apiGroups: [""]
    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
    resources: [ "serviceaccounts"]

}

func CreateCertificate(t framework.TestContext, i Instance, serviceAccount, namespace string) (Cert, error) {
	c := t.Clusters().Default()
	rootCert, err := FetchRootCert(c.Kube())
	if err != nil {
		return Cert{}, fmt.Errorf("failed to fetch root cert: %v", err)
	}

	token, err := GetServiceAccountToken(c.Kube(), "istio-ca", namespace, serviceAccount)
	if err != nil {
		return Cert{}, err
	}

	tokenNamespace, tokenServiceAccount string, audiences []string, expirationSeconds int64,
) (*authenticationv1.TokenRequest, error) {
	return client.Kube().CoreV1().ServiceAccounts(tokenNamespace).CreateToken(ctx, tokenServiceAccount,
		&authenticationv1.TokenRequest{
			Spec: authenticationv1.TokenRequestSpec{
				Audiences:         audiences,
				ExpirationSeconds: &expirationSeconds,
			},

    logging:
      level: info

    logAsJson: false

    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
    # to use for pulling any images in pods that reference this ServiceAccount.
    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.

	resourcequotastore "k8s.io/kubernetes/pkg/registry/core/resourcequota/storage"
	secretstore "k8s.io/kubernetes/pkg/registry/core/secret/storage"
	serviceaccountstore "k8s.io/kubernetes/pkg/registry/core/serviceaccount/storage"
	"k8s.io/kubernetes/pkg/serviceaccount"
)

// GenericConfig provides information needed to build RESTStorage
// for generic resources in core. It implements the "normal" RESTStorageProvider interface.
type GenericConfig struct {