Verb:            "impersonate",
				APIGroup:        gvk.Group,
				APIVersion:      gvk.Version,
				Namespace:       impersonationRequest.Namespace,
				Name:            impersonationRequest.Name,
				ResourceRequest: true,
			}

			switch gvk.GroupKind() {
			case v1.SchemeGroupVersion.WithKind("ServiceAccount").GroupKind():
				actingAsAttributes.Resource = "serviceaccounts"

	// Requests describes all resources that are needed from the driver.
	// +listType=atomic
	Requests []ResourceRequest `json:"requests,omitempty" protobuf:"bytes,3,opt,name=requests"`
}

// ResourceRequest is a request for resources from one particular driver.
type ResourceRequest struct {
	// VendorParameters are arbitrary setup parameters for the requested
	// resource. They are ignored while allocating a claim.

func (m *ResourceRequest) Reset()      { *m = ResourceRequest{} }
func (*ResourceRequest) ProtoMessage() {}
func (*ResourceRequest) Descriptor() ([]byte, []int) {
	return fileDescriptor_4312f5b44a31ec02, []int{38}
}
func (m *ResourceRequest) XXX_Unmarshal(b []byte) error {
	return m.Unmarshal(b)
}
func (m *ResourceRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {

	return map_ResourceModel
}

var map_ResourceRequest = map[string]string{
	"":                 "ResourceRequest is a request for resources from one particular driver.",
	"vendorParameters": "VendorParameters are arbitrary setup parameters for the requested resource. They are ignored while allocating a claim.",
}

func (ResourceRequest) SwaggerDoc() map[string]string {
	return map_ResourceRequest
}

				dedupOwnerReferencesAndAddWarning(newObj, req.Context(), true)
				return newObj, nil
			})
		}

		createAuthorizerAttributes := authorizer.AttributesRecord{
			User:            userInfo,
			ResourceRequest: true,
			Path:            req.URL.Path,
			Verb:            "create",
			APIGroup:        scope.Resource.Group,
			APIVersion:      scope.Resource.Version,
			Resource:        scope.Resource.Resource,

	subresource string
	namespace   string
	name        string
}

func (a resourceCheckVal) Authorize(ctx context.Context, verb string) ref.Val {
	attr := &authorizer.AttributesRecord{
		ResourceRequest: true,
		APIGroup:        a.groupCheck.group,
		APIVersion:      "*",
		Resource:        a.resource,
		Subresource:     a.subresource,
		Namespace:       a.namespace,
		Name:            a.name,

		}
		allErrs = append(allErrs, validateResourceRequests(request.Requests, idxPath.Child("requests"), requestStored)...)
	}
	return allErrs
}

func validateResourceRequests(requests []resource.ResourceRequest, fldPath *field.Path, requestStored bool) field.ErrorList {
	var allErrs field.ErrorList
	for i, request := range requests {
		idxPath := fldPath.Index(i)

		mutatingAdmission, _ := admit.(admission.MutationInterface)
		createAuthorizerAttributes := authorizer.AttributesRecord{
			User:            userInfo,
			ResourceRequest: true,
			Path:            req.URL.Path,
			Verb:            "create",
			APIGroup:        scope.Resource.Group,
			APIVersion:      scope.Resource.Version,
			Resource:        scope.Resource.Resource,

	requests := resourcev1alpha2.DriverRequests{
		DriverName: driverName,
	}
	for _, selector := range selectors {
		request := resourcev1alpha2.ResourceRequest{
			ResourceRequestModel: resourcev1alpha2.ResourceRequestModel{
				NamedResources: &resourcev1alpha2.NamedResourcesRequest{
					Selector: selector,
				},
			},
		}

		Shareable: true,
		DriverRequests: []resourcev1alpha2.DriverRequests{
			{
				DriverName: class.DriverName,
				Requests: []resourcev1alpha2.ResourceRequest{
					{
						ResourceRequestModel: resourcev1alpha2.ResourceRequestModel{
							// TODO: This only works because NamedResources is
							// the only model currently implemented. We need to