selfLink: selfLinkValue
  uid: uidValue
spec:
  extra:
    extraKey:
    - extraValue
  groups:
  - groupsValue
  nonResourceAttributes:
    path: pathValue
    verb: verbValue
  resourceAttributes:
    group: groupValue
    name: nameValue
    namespace: namespaceValue
    resource: resourceValue
    subresource: subresourceValue
    verb: verbValue
    version: versionValue
  uid: uidValue

  selfLink: selfLinkValue
  uid: uidValue
spec:
  extra:
    extraKey:
    - extraValue
  group:
  - groupValue
  nonResourceAttributes:
    path: pathValue
    verb: verbValue
  resourceAttributes:
    group: groupValue
    name: nameValue
    namespace: namespaceValue
    resource: resourceValue
    subresource: subresourceValue
    verb: verbValue
    version: versionValue
  uid: uidValue

	err := func() error {
		resp, err := s.sar.Create(context.Background(), &authorizationv1.SubjectAccessReview{
			ObjectMeta: metav1.ObjectMeta{},
			Spec: authorizationv1.SubjectAccessReviewSpec{
				ResourceAttributes: &authorizationv1.ResourceAttributes{
					Namespace: namespace,
					Verb:      "list",
					Resource:  "secrets",
				},
				User: user,
			},
		}, metav1.CreateOptions{})
		if err != nil {
			return err

				TypeMeta: expTypeMeta,
				Spec: authorizationv1beta1.SubjectAccessReviewSpec{
					User:   "jane",
					UID:    "1",
					Groups: []string{"group1", "group2"},
					ResourceAttributes: &authorizationv1beta1.ResourceAttributes{
						Verb:        "GET",
						Namespace:   "kittensandponies",
						Group:       "group3",
						Version:     "v7beta3",
						Resource:    "pods",
						Subresource: "proxy",

func checkCanCreateResources(c kube.CLIClient, namespace, group, version, resource string) error {
	s := &authorizationapi.SelfSubjectAccessReview{
		Spec: authorizationapi.SelfSubjectAccessReviewSpec{
			ResourceAttributes: &authorizationapi.ResourceAttributes{
				Namespace: namespace,
				Verb:      "create",
				Group:     group,
				Version:   version,
				Resource:  resource,
			},
		},
	}

							ConnectionInfo: api.WebhookConnectionInfo{
								Type: "InClusterConfig",
							},
							MatchConditions: []api.WebhookMatchCondition{
								{
									Expression: "has(request.resourceAttributes) && request.resourceAttributes.namespace == 'kube-system'",
								},
								{
									Expression: "request.user == 'admin'",
								},
							},
						},
					},
				},
			},

				Type:        []string{"object"},
				Properties: map[string]spec.Schema{
					"resourceAttributes": {
						SchemaProps: spec.SchemaProps{
							Description: "ResourceAuthorizationAttributes describes information for a resource access request",
							Ref:         ref("k8s.io/api/authorization/v1.ResourceAttributes"),
						},
					},
					"nonResourceAttributes": {
						SchemaProps: spec.SchemaProps{

- SubjectAccessReview requests sent to webhook authorizers now default `spec.resourceAttributes.version` to `*` if unset. ([#116937](https://github.com/kubernetes/kubernetes/pull/116937), [@AxeZhan](https://github.com/AxeZhan)) [SIG Apps and Auth]

          "type": "array"
        }
      },
      "required": [
        "verbs"
      ],
      "type": "object"
    },
    "io.k8s.api.authorization.v1.ResourceAttributes": {
      "description": "ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface",
      "properties": {
        "group": {

        }
      },
      "required": [
        "verbs"
      ],
      "type": "object"
    },
    "io.k8s.api.authorization.v1.ResourceAttributes": {
      "description": "ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface",
      "properties": {
        "group": {