})
	}
}

func TestServiceConversion(t *testing.T) {
	serviceName := "service1"
	namespace := "default"
	saA := "serviceaccountA"
	saB := "serviceaccountB"
	saC := "spiffe://accounts.google.com/serviceaccountC@cloudservices.gserviceaccount.com"
	saD := "spiffe://accounts.google.com/serviceaccountD@developer.gserviceaccount.com"

	ip := "10.0.0.1"

	tnow := time.Now()
	localSvc := corev1.Service{

  - pods
  - pods/proxy
  - pods/portforward
  - persistentvolumeclaims
  - secrets
  - services
  - serviceaccounts
  - resourcequotas
  verbs:
  - '*'
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: istio-operator
subjects:
- kind: ServiceAccount
  name: istio-operator
  namespace: operator-test-namespace
roleRef:
  kind: ClusterRole

                            from Calico-controlled endpoints."
                          type: string
                        serviceAccounts:
                          description: ServiceAccounts is an optional field that restricts
                            the rule to only apply to traffic that originates from

    ```

- Create a service account or use an existing service account, and download the service account private key.

    - In the [Service Accounts page](https://console.cloud.google.com/iam-admin/serviceaccounts),
    click CREATE SERVICE ACCOUNT, or select one of the existing service accounts.

    - Click "Create Key" from the drop-down menu, and select the default JSON key type. The key file

	{Group: "", Resource: "pods/exec"},
	{Group: "", Resource: "pods/portforward"},

	// ref: https://github.com/kubernetes/kubernetes/issues/122205#issuecomment-1927390823
	{Group: "", Resource: "serviceaccounts/token"},
}

// excluded is the list of resources that the expression-based admission controllers
// should ignore.
// The version is omitted, all versions of the same GroupResource are treated the same.

)

func Test_tokenSupplier_GetRequestMetadata(t *testing.T) {
	ctx := context.Background()
	cli := NewFakeClient()
	clientset := cli.Kube().(*fake.Clientset)
	clientset.PrependReactor("create", "serviceaccounts",
		func(action clienttesting.Action) (handled bool, ret runtime.Object, err error) {
			act, ok := action.(clienttesting.CreateActionImpl)
			if !ok {
				return false, nil, nil
			}

	"v1/podtemplates":           "LIXB2x4IFpk=",
	"v1/replicationcontrollers": "Jond2If31h0=",
	"v1/resourcequotas":         "8uhSgffRX6w=",
	"v1/secrets":                "S6u1pOWzb84=",
	"v1/serviceaccounts":        "pbx9ZvyFpBE=",
	"v1/services":               "0/CO1lhkEBI=",
	"autoscaling/v1/horizontalpodautoscalers": "qwQve8ut294=",
	"autoscaling/v2/horizontalpodautoscalers": "qwQve8ut294=",

  - pods
  - pods/proxy
  - pods/portforward
  - persistentvolumeclaims
  - secrets
  - services
  - serviceaccounts
  - resourcequotas
  verbs:
  - '*'
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: istio-operator
subjects:
- kind: ServiceAccount
  name: istio-operator
  namespace: operator-test-namespace
roleRef:
  kind: ClusterRole

    - deads2k
    - liggitt
    - tallclair
  sig-auth-policy-reviewers:
    - deads2k
    - liggitt
    - tallclair
    - krmayankk
  sig-auth-serviceaccounts-approvers:
    - deads2k
    - enj
    - liggitt
    - mikedanese
  sig-auth-serviceaccounts-reviewers:
    - deads2k
    - enj
    - liggitt
    - mikedanese
  # SIG Release
  release-engineering-approvers:

}

func getServiceAccountsName(kubeClient kube.CLIClient, toComplete, ns string) ([]string, error) {
	ctx := context.Background()
	saList, err := kubeClient.Kube().CoreV1().ServiceAccounts(ns).List(ctx, metav1.ListOptions{})
	if err != nil {
		return nil, err
	}

	var saNameList []string
	for _, sa := range saList.Items {
		if toComplete == "" || strings.HasPrefix(sa.Name, toComplete) {