kind: ClusterRoleBinding
metadata:
  name: gce:beta:kubelet-certificate-bootstrap
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: gce:beta:kubelet-certificate-bootstrap
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: kubelet
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:

					[]rbacv1.Subject{
						{Kind: rbacv1.GroupKind, APIGroup: rbacv1.GroupName, Name: user.SystemPrivilegedGroup},
						{Kind: rbacv1.UserKind, APIGroup: rbacv1.GroupName, Name: "super-admin"},
						{Kind: rbacv1.GroupKind, APIGroup: rbacv1.GroupName, Name: "super-admins"},
						{Kind: rbacv1.UserKind, APIGroup: rbacv1.GroupName, Name: "admin"},
						{Kind: rbacv1.GroupKind, APIGroup: rbacv1.GroupName, Name: "admins"},
					},
				},
				{

			ObjectMeta: metav1.ObjectMeta{Name: "master"},
			RoleRef:    rbac.RoleRef{APIGroup: rbac.GroupName, Kind: "ClusterRole", Name: "valid"},
			Subjects: []rbac.Subject{
				{Name: "validsaname", APIGroup: "", Namespace: "foo", Kind: rbac.ServiceAccountKind},
				{Name: "valid@username", APIGroup: rbac.GroupName, Kind: rbac.UserKind},
				{Name: "valid@groupname", APIGroup: rbac.GroupName, Kind: rbac.GroupKind},
			},
		},
	)
	if len(errs) != 0 {

		if subject.APIGroup != rbac.GroupName {
			allErrs = append(allErrs, field.NotSupported(fldPath.Child("apiGroup"), subject.APIGroup, []string{rbac.GroupName}))
		}

	case rbac.GroupKind:
		// TODO(ericchiang): What other restrictions on group name are there?
		if subject.APIGroup != rbac.GroupName {
			allErrs = append(allErrs, field.NotSupported(fldPath.Child("apiGroup"), subject.APIGroup, []string{rbac.GroupName}))

      kubernetes.io/bootstrapping: rbac-defaults
    name: system:public-info-viewer
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: system:public-info-viewer
  subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: system:authenticated
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: system:unauthenticated

				RoleRef: rbacapi.RoleRef{Name: "foo", APIGroup: v1alpha1.GroupName},
				Subjects: []rbacapi.Subject{
					{Kind: "User", APIGroup: v1alpha1.GroupName, Name: "myuser"},
					{Kind: "Group", APIGroup: v1alpha1.GroupName, Name: "mygroup"},
					{Kind: "ServiceAccount", APIGroup: "", Name: "mysa", Namespace: "myns"},
					{Kind: "User", APIGroup: v1alpha1.GroupName, Name: "myuser"},
					{Kind: "Group", APIGroup: v1alpha1.GroupName, Name: "mygroup"},

		},
		{
			name: "valid v1alpha1 config",
			input: `
kind: Configuration
apiVersion: resourcequota.admission.k8s.io/v1alpha1
limitedResources:
- apiGroup: ""
  resource: persistentvolumeclaims
  matchContains:
  - .storageclass.storage.k8s.io/requests.storage
- apiGroup: ""
  resource: pods
  matchScopes:
  - scopeName: PriorityClass
    operator: In
    values:
    - cluster-services
`,

	if len(obj.RoleRef.APIGroup) == 0 {
		obj.RoleRef.APIGroup = GroupName
	}
}
func SetDefaults_RoleBinding(obj *rbacv1.RoleBinding) {
	if len(obj.RoleRef.APIGroup) == 0 {
		obj.RoleRef.APIGroup = GroupName
	}
}
func SetDefaults_Subject(obj *rbacv1.Subject) {
	if len(obj.APIGroup) == 0 {
		switch obj.Kind {
		case rbacv1.ServiceAccountKind:
			obj.APIGroup = ""
		case rbacv1.UserKind:

{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"{{kube_user}}", "namespace": "*", "resource": "*", "apiGroup": "*", "nonResourcePath": "*"}}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"kubelet", "namespace": "*", "resource": "*", "apiGroup": "*", "nonResourcePath": "*"}}

		return err
	}

	// specifically set the APIGroup for the three subjects recognized in v1alpha1
	switch {
	case in.Kind == rbacv1alpha1.ServiceAccountKind:
		out.APIGroup = ""
	case in.Kind == rbacv1alpha1.UserKind:
		out.APIGroup = GroupName
	case in.Kind == rbacv1alpha1.GroupKind:
		out.APIGroup = GroupName
	default: