"resources": [
            {
              "resource": "clustertrustbundles",
              "responseKind": {
                "group": "",
                "kind": "ClusterTrustBundle",
                "version": ""
              },
              "scope": "Cluster",
              "singularResource": "clustertrustbundle",
              "verbs": [
                "create",
                "delete",

	for _, vol := range pod.Spec.Volumes {
		if vol.VolumeSource.Projected != nil {
			for _, src := range vol.VolumeSource.Projected.Sources {
				if src.ClusterTrustBundle != nil {
					return admission.NewForbidden(a, fmt.Errorf("node %q can not create pods that reference clustertrustbundles", nodeName))
				}
			}
		}
	}

	for _, v := range pod.Spec.Volumes {
		if v.PersistentVolumeClaim != nil {

	WaitForCacheSync() error
	// Returns hostutil.HostUtils
	GetHostUtil() hostutil.HostUtils

	// Returns trust anchors from the named ClusterTrustBundle.
	GetTrustAnchorsByName(name string, allowMissing bool) ([]byte, error)

	// Returns trust anchors from the ClusterTrustBundles selected by signer
	// name and label selector.

// Experimental!
func ExtractClusterTrustBundleStatus(clusterTrustBundle *certificatesv1alpha1.ClusterTrustBundle, fieldManager string) (*ClusterTrustBundleApplyConfiguration, error) {
	return extractClusterTrustBundle(clusterTrustBundle, fieldManager, "status")
}

		},
		{
			name:       "forbid create of pod referencing clustertrustbundle",
			podsGetter: noExistingPods,
			attributes: admission.NewAttributesRecord(ctbpod, nil, podKind, ctbpod.Namespace, ctbpod.Name, podResource, "", admission.Create, &metav1.CreateOptions{}, false, mynode),
			err:        "reference clustertrustbundles",
		},
		{
			name:       "forbid create of pod referencing persistentvolumeclaim",

	"name":          "Select a single ClusterTrustBundle by object name.  Mutually-exclusive with signerName and labelSelector.",
	"signerName":    "Select all ClusterTrustBundles that match this signer name. Mutually-exclusive with name.  The contents of all selected ClusterTrustBundles will be unified and deduplicated.",

apiVersion: certificates.k8s.io/v1alpha1
kind: ClusterTrustBundle
metadata:
  annotations:
    annotationsKey: annotationsValue
  creationTimestamp: "2008-01-01T01:01:01Z"
  deletionGracePeriodSeconds: 10
  deletionTimestamp: "2009-01-01T01:01:01Z"
  finalizers:
  - finalizersValue
  generateName: generateNameValue
  generation: 7
  labels:
    labelsKey: labelsValue
  managedFields:
  - apiVersion: apiVersionValue

{
  "kind": "ClusterTrustBundle",
  "apiVersion": "certificates.k8s.io/v1alpha1",
  "metadata": {
    "name": "nameValue",
    "generateName": "generateNameValue",
    "namespace": "namespaceValue",
    "selfLink": "selfLinkValue",
    "uid": "uidValue",
    "resourceVersion": "resourceVersionValue",
    "generation": 7,
    "creationTimestamp": "2008-01-01T01:01:01Z",
    "deletionTimestamp": "2009-01-01T01:01:01Z",

{
  "kind": "ClusterTrustBundle",
  "apiVersion": "certificates.k8s.io/v1alpha1",
  "metadata": {
    "name": "nameValue",
    "generateName": "generateNameValue",
    "namespace": "namespaceValue",
    "selfLink": "selfLinkValue",
    "uid": "uidValue",
    "resourceVersion": "resourceVersionValue",
    "generation": 7,
    "creationTimestamp": "2008-01-01T01:01:01Z",
    "deletionTimestamp": "2009-01-01T01:01:01Z",

{
  "kind": "ClusterTrustBundle",
  "apiVersion": "certificates.k8s.io/v1alpha1",
  "metadata": {
    "name": "nameValue",
    "generateName": "generateNameValue",
    "namespace": "namespaceValue",
    "selfLink": "selfLinkValue",
    "uid": "uidValue",
    "resourceVersion": "resourceVersionValue",
    "generation": 7,
    "creationTimestamp": "2008-01-01T01:01:01Z",
    "deletionTimestamp": "2009-01-01T01:01:01Z",