User:            info,
		Verb:            verb,
		Name:            signerName,
		APIGroup:        "certificates.k8s.io",
		APIVersion:      "*",
		Resource:        "signers",
		ResourceRequest: true,
	}
}

func buildWildcardAttributes(info user.Info, verb, signerName string) authorizer.Attributes {
	parts := strings.Split(signerName, "/")
	domain := parts[0]

		APIGroup:        a.GetAPIGroup(),
		APIVersion:      a.GetAPIVersion(),
		Resource:        a.GetResource(),
		Subresource:     a.GetSubresource(),
		Name:            a.GetName(),
		ResourceRequest: a.IsResourceRequest(),
		Path:            a.GetPath(),
	}

	if u := a.GetUser(); u != nil {
		di := &user.DefaultInfo{
			Name: u.GetName(),
			UID:  u.GetUID(),
		}

		APIGroup:        "",
		APIVersion:      "v1",
		Verb:            a.ExpectedVerb,
		Resource:        "nodes",
		Name:            authzTestNodeName,
		Subresource:     a.ExpectedSubresource,
		ResourceRequest: true,
		Path:            a.Path,
	}

	assert.Equal(t, expectedAttributes, attrs)
}

func AuthzTestUser() user.Info {
	return &user.DefaultInfo{Name: authzTestUserName}
}

		Verb:            apiVerb,
		Namespace:       "",
		APIGroup:        "",
		APIVersion:      "v1",
		Resource:        "nodes",
		Subresource:     "proxy",
		Name:            string(n.nodeName),
		ResourceRequest: true,
		Path:            requestPath,
	}

	// Override subresource for specific paths
	// This allows subdividing access to the kubelet API
	switch {
	case isSubpath(requestPath, statsPath):

	paramRef := binding.Spec.ParamRef
	verb := "get"

	if len(paramRef.Name) == 0 {
		verb = "list"
	}

	attrs = authorizer.AttributesRecord{
		User:            user,
		Verb:            verb,
		ResourceRequest: true,
		Name:            paramRef.Name,
		Namespace:       paramRef.Namespace, // if empty, no namespace indicates get across all namespaces
		APIGroup:        apiGroup,
		APIVersion:      apiVersion,

	if !found {
		return nil, errors.New("no RequestInfo found in the context")
	}

	// Start with common attributes that apply to resource and non-resource requests
	attribs.ResourceRequest = requestInfo.IsResourceRequest
	attribs.Path = requestInfo.Path
	attribs.Verb = requestInfo.Verb

	attribs.APIGroup = requestInfo.APIGroup
	attribs.APIVersion = requestInfo.APIVersion

				Namespace:       "kittensandponies",
				APIGroup:        "group3",
				APIVersion:      "v7beta3",
				Resource:        "pods",
				Subresource:     "proxy",
				Name:            "my-pod",
				ResourceRequest: true,
				Path:            "/foo",
			},
			want: authorizationv1beta1.SubjectAccessReview{
				TypeMeta: expTypeMeta,
				Spec: authorizationv1beta1.SubjectAccessReviewSpec{
					User:   "jane",

			DriverName: driver1,
		}},
	}
	claimParametersOne := &resourceapi.ResourceClaimParameters{
		DriverRequests: []resourceapi.DriverRequests{{
			DriverName: driver1,
			Requests: []resourceapi.ResourceRequest{{
				ResourceRequestModel: resourceapi.ResourceRequestModel{
					NamedResources: &resourceapi.NamedResourcesRequest{
						Selector: "true",
					},
				},
			}},
		}},
	}

  // NamedResources describes available resources using the named resources model.
  //
  // +optional
  optional NamedResourcesResources namedResources = 1;
}

// ResourceRequest is a request for resources from one particular driver.
message ResourceRequest {
  // VendorParameters are arbitrary setup parameters for the requested
  // resource. They are ignored while allocating a claim.
  //
  // +optional

	VendorParameters runtime.Object

	// Requests describes all resources that are needed from the driver.
	Requests []ResourceRequest
}

// ResourceRequest is a request for resources from one particular driver.
type ResourceRequest struct {
	// VendorParameters are arbitrary setup parameters for the requested
	// resource. They are ignored while allocating a claim.