return gvk.RequestAuthentication, true
	case *k8sioapicorev1.Secret:
		return gvk.Secret, true
	case *k8sioapicorev1.Service:
		return gvk.Service, true
	case *k8sioapicorev1.ServiceAccount:
		return gvk.ServiceAccount, true
	case *istioioapinetworkingv1alpha3.ServiceEntry:
		return gvk.ServiceEntry, true
	case *apiistioioapinetworkingv1alpha3.ServiceEntry:
		return gvk.ServiceEntry, true

	}), true)

	// Create CRD later
	saCalls := atomic.NewInt32(0)
	// When should return false
	assert.Equal(t, ctl.KnownOrCallback(gvr.ServiceAccount, func(s <-chan struct{}) {
		assert.Equal(t, s, stop)
		saCalls.Inc()
	}), false)
	clienttest.MakeCRD(t, c, gvr.ServiceAccount)
	// And call the callback when the CRD is created
	assert.EventuallyEqual(t, saCalls.Load, 1)
}

func TestCRDWatcherMinimumVersion(t *testing.T) {

				firstError = err
			}
		} else {
			return k, nil
		}
	}
	return nil, firstError
}

func (a *AggregateController) Authorize(serviceAccount, namespace string) error {
	return a.authController.Authorize(serviceAccount, namespace)
}

func (a *AggregateController) AddEventHandler(f func(name string, namespace string)) {
	// no ops
}

    logging:
      level: info

    logAsJson: false

    # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
    # to use for pulling any images in pods that reference this ServiceAccount.
    # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
    # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.

		ValidateProto: validation.EmptyValidate,
	}.MustBuild()

	ServiceAccount = resource.Builder{
		Identifier:    "ServiceAccount",
		Group:         "",
		Kind:          "ServiceAccount",
		Plural:        "serviceaccounts",
		Version:       "v1",
		Proto:         "k8s.io.api.core.v1.ServiceAccount",
		ReflectType:   reflect.TypeOf(&k8sioapicorev1.ServiceAccount{}).Elem(),
		ProtoPackage:  "k8s.io/api/core/v1",

    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:metrics-server
subjects:
- kind: ServiceAccount
  name: metrics-server

      namespaces:
      - namespacesValue
      resources:
      - resourcesValue
      verbs:
      - verbsValue
    subjects:
    - group:
        name: nameValue
      kind: kindValue
      serviceAccount:
        name: nameValue
        namespace: namespaceValue
      user:
        name: nameValue
status:
  conditions:
  - lastTransitionTime: "2003-01-01T01:01:01Z"
    message: messageValue

apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{.ServiceAccount | quote}}
  namespace: {{.Namespace | quote}}
  annotations:
    {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }}
  labels:
    {{- toJsonMap
      .InfrastructureLabels
      (strdict

      namespaces:
      - namespacesValue
      resources:
      - resourcesValue
      verbs:
      - verbsValue
    subjects:
    - group:
        name: nameValue
      kind: kindValue
      serviceAccount:
        name: nameValue
        namespace: namespaceValue
      user:
        name: nameValue
status:
  conditions:
  - lastTransitionTime: "2003-01-01T01:01:01Z"
    message: messageValue

          {
            "kind": "kindValue",
            "user": {
              "name": "nameValue"
            },
            "group": {
              "name": "nameValue"
            },
            "serviceAccount": {
              "namespace": "namespaceValue",
              "name": "nameValue"
            }
          }
        ],
        "resourceRules": [
          {
            "verbs": [