"storageVersionHash": "39NQlfNR+bo=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",
        "patch",
        "update",
        "watch"
      ]
    },
    {
      "kind": "Ingress",
      "name": "ingresses/status",
      "namespaced": true,
      "singularName": "",
      "verbs": [
        "get",
        "patch",
        "update"

}

// DefaultResourceRuleInfo holds information that describes a rule for the resource
type DefaultResourceRuleInfo struct {
	Verbs         []string
	APIGroups     []string
	Resources     []string
	ResourceNames []string
}

func (i *DefaultResourceRuleInfo) GetVerbs() []string {
	return i.Verbs
}

func (i *DefaultResourceRuleInfo) GetAPIGroups() []string {
	return i.APIGroups
}

rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - create
  - get
  - patch
  - update
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
  name: gce:cloud-provider
rules:
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - patch
  - update
- apiGroups:

      "storageVersionHash": "GJVAJZSZBIw=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",
        "patch",
        "update",
        "watch"
      ]
    },
    {
      "kind": "FlowSchema",
      "name": "flowschemas/status",
      "namespaced": false,
      "singularName": "",
      "verbs": [
        "get",
        "patch",

rules:
  - apiGroups: [""]
    resources:
      - nodes/metrics
    verbs:
      - get
  - apiGroups: [""]
    resources:
      - pods
      - nodes
    verbs:
      - get
      - list
      - watch
  - apiGroups: ["apps"]
    resources:
      - deployments
    resourceNames:
      - metrics-server-v0.7.1
    verbs:
      - get
      - patch
  - nonResourceURLs:
    - /metrics
    verbs:

	}
}

func TestPolicyRuleBuilder(t *testing.T) {
	tests := []struct {
		testName   string
		verbs      []string
		groups     []string
		resources  []string
		names      []string
		urls       []string
		expected   bool
		policyRule rbac.PolicyRule
	}{
		{
			testName:   "all empty",
			verbs:      nil,
			groups:     nil,
			resources:  nil,
			names:      nil,
			urls:       nil,

      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",
        "patch",
        "update",
        "watch"
      ]
    },
    {
      "kind": "Role",
      "name": "roles",
      "namespaced": true,
      "singularName": "role",
      "storageVersionHash": "7FuwZcIIItM=",
      "verbs": [
        "create",
        "delete",

	}
	info, ok := debug.ReadBuildInfo()
	if !ok {
		return nil, fmt.Errorf("no build info")
	}
	year, month, day := time.Now().UTC().Date()
	goVers := info.GoVersion
	// E.g.,  goVers:"go1.22-20240109-RC01 cl/597041403 +dcbe772469 X:loopvar"
	words := strings.Fields(goVers)
	goVers = words[0]
	progPkgPath := info.Path
	if progPkgPath == "" {
		progPkgPath = strings.TrimSuffix(filepath.Base(os.Args[0]), ".exe")
	}

		}

		if !foundThisVersion {
			continue
		}
		foundVersion = true

		verbs := metav1.Verbs([]string{"delete", "deletecollection", "get", "list", "patch", "create", "update", "watch"})
		// if we're terminating we don't allow some verbs
		if apiextensionshelpers.IsCRDConditionTrue(crd, apiextensionsv1.Terminating) {
			verbs = metav1.Verbs([]string{"delete", "deletecollection", "get", "list", "watch"})
		}

# invalid config. We use --server-dry-run so no config is persisted.
- apiGroups: ["networking.istio.io"]
  verbs: ["create"]
  resources: ["gateways"]

# For storing CA secret
- apiGroups: [""]
  resources: ["secrets"]
  # TODO lock this down to istio-ca-cert if not using the DNS cert mesh config
  verbs: ["create", "get", "watch", "list", "update", "delete"]