if err != nil {
				return nil, err
			}
			return []string{ret}, nil
		}
		claims = append(claims, s[begin+1:end])
		begin = end + 1
	}
	return claims, nil
}

func MetadataStringMatcherForJWTClaim(claim string, m *matcherpb.StringMatcher) *matcherpb.MetadataMatcher {
	return MetadataValueMatcherForJWTClaim(claim, &matcherpb.ValueMatcher{
		MatchPattern: &matcherpb.ValueMatcher_StringMatch{
			StringMatch: m,
		},

                        help="iss claim. Default is `******@****.***`")
    parser.add_argument("-aud", "--aud",
                        help="aud claim. This is comma-separated-list of audiences")
    parser.add_argument("-sub", "--sub",
                        help="sub claim. If not provided, it is set to the same as iss claim.")
    parser.add_argument("-claims", "--claims",

	}
	return claims
}

func annotateClaim(claim *v1.PersistentVolumeClaim, ann map[string]string) *v1.PersistentVolumeClaim {
	if claim.Annotations == nil {
		claim.Annotations = map[string]string{}
	}
	for key, val := range ann {
		claim.Annotations[key] = val
	}
	return claim
}

// volumeWithAnnotation saves given annotation into given volume.

    outputPayloadToHeader: "x-test-payload"
    outputClaimToHeaders:
    - header: "x-jwt-iss"
      claim: "iss"
    - header: "x-jwt-iat"
      claim: "iat"
    - header: "x-jwt-nested-claim"
      claim: "nested.nested-2.key2"
  - issuer: "******@****.***"
    jwksUri: "https://raw.githubusercontent.com/istio/istio/master/tests/common/jwt/jwks.json"

	"shareable":      "Shareable indicates whether the allocated claim is meant to be shareable by multiple consumers at the same time.",

  -sub SUB, --sub SUB   sub claim. If not provided, it is set to the same as
                        iss claim.
  -claims CLAIMS, --claims CLAIMS
                        Other claims in format name1:value1,name2:value2 etc.
                        Only string values are supported.
```

## Example

Here is an example of using sa-jwt.py to generate a JWT token.

```bash

	for i, claim = range claimsToProvision {
		logger.V(5).Info("Updating claims objects to trigger volume provisioning", "pod", klog.KObj(pod), "PVC", klog.KObj(claim))
		newClaim, err := b.kubeClient.CoreV1().PersistentVolumeClaims(claim.Namespace).Update(ctx, claim, metav1.UpdateOptions{})
		if err != nil {

	}
	namespace := private.Namespace
	if len(namespace) == 0 {
		return nil, errors.New("namespace claim is missing")
	}
	secretName := private.SecretName
	if len(secretName) == 0 {
		return nil, errors.New("secretName claim is missing")
	}
	serviceAccountName := private.ServiceAccountName
	if len(serviceAccountName) == 0 {
		return nil, errors.New("serviceAccountName claim is missing")
	}

  // VendorClassParameters are the per-claim configuration parameters
  // from the resource class at the time that the claim was allocated.
  //
  // +optional
  optional .k8s.io.apimachinery.pkg.runtime.RawExtension vendorClassParameters = 1;

  // VendorClaimParameters are the per-claim configuration parameters
  // from the resource claim parameters at the time that the claim was
  // allocated.
  //
  // +optional

                        help="iss claim. This should be your service account email.")
    parser.add_argument("-aud", "--aud",
                        help="aud claim. This is comma-separated-list of audiences")
    parser.add_argument("-sub", "--sub",
                        help="sub claim. If not provided, it is set to the same as iss claim.")
    parser.add_argument("-claims", "--claims",