"description": "Standard object's metadata."
          },
          "roleRef": {
            "allOf": [
              {
                "$ref": "#/components/schemas/io.k8s.api.rbac.v1.RoleRef"
              }
            ],
            "default": {},
            "description": "RoleRef can only reference a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error. This field is immutable."

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: istio-reader
    release: istio
  name: istio-reader-clusterrole-istio-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: istio-reader-clusterrole-istio-system
subjects:
- kind: ServiceAccount
  name: istio-reader-service-account
  namespace: istio-system

							},
						},
					},
					"roleRef": {
						SchemaProps: spec.SchemaProps{
							Description: "RoleRef can only reference a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error. This field is immutable.",
							Default:     map[string]interface{}{},
							Ref:         ref("k8s.io/api/rbac/v1.RoleRef"),
						},
					},
				},

      - delete
---
# Source: calico/templates/calico-kube-controllers-rbac.yaml
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: calico-kube-controllers
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: calico-kube-controllers
subjects:
- kind: ServiceAccount
  name: calico-kube-controllers
  namespace: kube-system
---

rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: {{ include "gateway.serviceAccountName" . }} namespace: {{ .Release.Namespace }} labels: {{- include "gateway.labels" . | nindent 4}} annotations: {{- .Values.annotations | toYaml | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: {{ include "gateway.serviceAccountName" . }} subjects: - kind: ServiceAccount name: {{ include "gateway.serviceAccountName" . }} {{- end }} manifests/charts/gateway/templates/NOTES.txt "{{ include...

        assertTrue(roleSet.contains("role2"));

        encrypted = false;
        value = "role1,role2,role3";
        roleSet = decodedRoleList(roleQueryHelperImpl, value, encrypted);
        assertEquals(3, roleSet.size());
        assertTrue(roleSet.contains("role1"));
        assertTrue(roleSet.contains("role2"));
        assertTrue(roleSet.contains("role3"));
    }

        }

        if (defaultRoleList != null) {
            roleSet.addAll(defaultRoleList);
        }

        if (logger.isDebugEnabled()) {
            logger.debug("roleSet: {}", roleSet);
        }

        if (request != null) {
            request.setAttribute(USER_ROLES, roleSet);
        }
        return roleSet;
    }

        if (queryContext.roleQueryEnabled()) {
            final Set<String> roleSet = ComponentUtil.getRoleQueryHelper().build(searchRequestType);
            if (!roleSet.isEmpty()) {
                queryContext.addQuery(boolQuery -> buildRoleQuery(roleSet, boolQuery));
            }
        }
    }

    public void buildRoleQuery(final Set<String> roleSet, final BoolQueryBuilder boolQuery) {

            final Set<String> roleSet = ComponentUtil.getRoleQueryHelper().build(SearchRequestType.JSON); // TODO SearchRequestType?
            final QueryHelper queryHelper = ComponentUtil.getQueryHelper();
            if (!roleSet.isEmpty()) {
                queryHelper.buildRoleQuery(roleSet, boolQuery);
            }
            builder.setQuery(boolQuery);

          "description": "Standard object's metadata."
        },
        "roleRef": {
          "$ref": "#/definitions/io.k8s.api.rbac.v1.RoleRef",
          "description": "RoleRef can only reference a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error. This field is immutable."
        },
        "subjects": {