// Invalid APIGroup or Name values will fail validation
	switch roleRef.Kind {
	case "ClusterRole":
		attrs.APIGroup = roleRef.APIGroup
		attrs.APIVersion = "*"
		attrs.Resource = "clusterroles"
		attrs.Name = roleRef.Name
	case "Role":
		attrs.APIGroup = roleRef.APIGroup
		attrs.APIVersion = "*"
		attrs.Resource = "roles"
		attrs.Name = roleRef.Name

			// match defaulter
			if len(r.APIGroup) == 0 {
				r.APIGroup = rbac.GroupName
			}
		},
		func(r *rbac.Subject, c fuzz.Continue) {
			switch c.Int31n(3) {
			case 0:
				r.Kind = rbac.ServiceAccountKind
				r.APIGroup = ""
				c.FuzzNoCustom(&r.Name)
				c.FuzzNoCustom(&r.Namespace)
			case 1:
				r.Kind = rbac.UserKind
				r.APIGroup = rbac.GroupName
				c.FuzzNoCustom(&r.Name)

	// Register three groups
	handler.AddGroup(metav1.APIGroup{Name: "x"})
	handler.AddGroup(metav1.APIGroup{Name: "y"})
	handler.AddGroup(metav1.APIGroup{Name: "z"})
	// Register three additional groups that come earlier alphabetically
	handler.AddGroup(metav1.APIGroup{Name: "a"})
	handler.AddGroup(metav1.APIGroup{Name: "b"})
	handler.AddGroup(metav1.APIGroup{Name: "c"})

{
  "components": {
    "schemas": {
      "io.k8s.apimachinery.pkg.apis.meta.v1.APIGroup": {
        "description": "APIGroup contains the name, the supported versions, and the preferred version of a group.",
        "properties": {
          "apiVersion": {

{
  "components": {
    "schemas": {
      "io.k8s.apimachinery.pkg.apis.meta.v1.APIGroup": {
        "description": "APIGroup contains the name, the supported versions, and the preferred version of a group.",
        "properties": {
          "apiVersion": {

{
  "components": {
    "schemas": {
      "io.k8s.apimachinery.pkg.apis.meta.v1.APIGroup": {
        "description": "APIGroup contains the name, the supported versions, and the preferred version of a group.",
        "properties": {
          "apiVersion": {

{
  "components": {
    "schemas": {
      "io.k8s.apimachinery.pkg.apis.meta.v1.APIGroup": {
        "description": "APIGroup contains the name, the supported versions, and the preferred version of a group.",
        "properties": {
          "apiVersion": {

			client: newMockClusterRoleBinddingClientForTest(t, &rbac.ClusterRoleBinding{
				ObjectMeta: metav1.ObjectMeta{
					Name: constants.NodeKubeletBootstrap,
				},
				RoleRef: rbac.RoleRef{
					APIGroup: rbac.GroupName,
					Kind:     "ClusterRole",
					Name:     constants.NodeBootstrapperClusterRoleName,
				},
				Subjects: []rbac.Subject{
					{
						Kind: rbac.GroupKind,

	return RegisterDefaults(scheme)
}

func SetDefaults_ClusterRoleBinding(obj *rbacv1alpha1.ClusterRoleBinding) {
	if len(obj.RoleRef.APIGroup) == 0 {
		obj.RoleRef.APIGroup = GroupName
	}
}
func SetDefaults_RoleBinding(obj *rbacv1alpha1.RoleBinding) {
	if len(obj.RoleRef.APIGroup) == 0 {
		obj.RoleRef.APIGroup = GroupName
	}
}
func SetDefaults_Subject(obj *rbacv1alpha1.Subject) {
	if len(obj.APIVersion) == 0 {
		switch obj.Kind {

	Group string

	// Readonly matches readonly requests when true, and all requests when false
	Readonly bool

	// APIGroup is the name of an API group. APIGroup, Resource, and Namespace are required to match resource requests.
	// "*" matches all API groups
	APIGroup string

	// Resource is the name of a resource. APIGroup, Resource, and Namespace are required to match resource requests.
	// "*" matches all resources
	Resource string