selfLink: selfLinkValue
  uid: uidValue
spec:
  extra:
    extraKey:
    - extraValue
  groups:
  - groupsValue
  nonResourceAttributes:
    path: pathValue
    verb: verbValue
  resourceAttributes:
    group: groupValue
    name: nameValue
    namespace: namespaceValue
    resource: resourceValue
    subresource: subresourceValue
    verb: verbValue
    version: versionValue
  uid: uidValue

  selfLink: selfLinkValue
  uid: uidValue
spec:
  extra:
    extraKey:
    - extraValue
  group:
  - groupValue
  nonResourceAttributes:
    path: pathValue
    verb: verbValue
  resourceAttributes:
    group: groupValue
    name: nameValue
    namespace: namespaceValue
    resource: resourceValue
    subresource: subresourceValue
    verb: verbValue
    version: versionValue
  uid: uidValue

}

func (NonResourceRule) SwaggerDoc() map[string]string {
	return map_NonResourceRule
}

var map_ResourceAttributes = map[string]string{
	"":            "ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface",

}

func (NonResourceRule) SwaggerDoc() map[string]string {
	return map_NonResourceRule
}

var map_ResourceAttributes = map[string]string{
	"":            "ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface",

		return nil, apierrors.NewBadRequest(fmt.Sprintf("namespace is required on this type: %v", namespace))
	}
	if namespace != localSubjectAccessReview.Namespace {
		return nil, apierrors.NewBadRequest(fmt.Sprintf("spec.resourceAttributes.namespace must match namespace: %v", namespace))
	}

	if createValidation != nil {
		if err := createValidation(ctx, obj.DeepCopyObject()); err != nil {
			return nil, err
		}
	}

	err := func() error {
		resp, err := s.sar.Create(context.Background(), &authorizationv1.SubjectAccessReview{
			ObjectMeta: metav1.ObjectMeta{},
			Spec: authorizationv1.SubjectAccessReviewSpec{
				ResourceAttributes: &authorizationv1.ResourceAttributes{
					Namespace: namespace,
					Verb:      "list",
					Resource:  "secrets",
				},
				User: user,
			},
		}, metav1.CreateOptions{})
		if err != nil {
			return err

				TypeMeta: expTypeMeta,
				Spec: authorizationv1beta1.SubjectAccessReviewSpec{
					User:   "jane",
					UID:    "1",
					Groups: []string{"group1", "group2"},
					ResourceAttributes: &authorizationv1beta1.ResourceAttributes{
						Verb:        "GET",
						Namespace:   "kittensandponies",
						Group:       "group3",
						Version:     "v7beta3",
						Resource:    "pods",
						Subresource: "proxy",

					},
				}, nil
			})
			approver := sarApprover{
				client: client,
				recognizers: []csrRecognizer{
					{
						successMessage: "tester",
						permission:     authorization.ResourceAttributes{Group: "foo", Resource: "bar", Subresource: "baz"},
						recognize: func(csr *capi.CertificateSigningRequest, x509cr *x509.CertificateRequest) bool {
							return c.recognized
						},
					},
				},
			}

          }
        },
        "required": [
          "verbs"
        ],
        "type": "object"
      },
      "io.k8s.api.authorization.v1.ResourceAttributes": {
        "description": "ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface",
        "properties": {
          "group": {

func checkCanCreateResources(c kube.CLIClient, namespace, group, version, resource string) error {
	s := &authorizationapi.SelfSubjectAccessReview{
		Spec: authorizationapi.SelfSubjectAccessReviewSpec{
			ResourceAttributes: &authorizationapi.ResourceAttributes{
				Namespace: namespace,
				Verb:      "create",
				Group:     group,
				Version:   version,
				Resource:  resource,
			},
		},
	}