//	Name              |   256B | unlimited | unlimited
//	Linkname          |   100B | unlimited | unlimited
//	Size              | uint33 | unlimited |    uint89
//	Mode              | uint21 |    uint21 |    uint57
//	Uid/Gid           | uint21 | unlimited |    uint57
//	Uname/Gname       |    32B | unlimited |       32B
//	ModTime           | uint33 | unlimited |     int89
//	AccessTime        |    n/a | unlimited |     int89

  // it needs a reflection here.
  // +optional
  map<string, ExtraValue> extra = 5;

  // UID information about the requesting user.
  // +optional
  optional string uid = 6;
}

// SubjectAccessReviewStatus
message SubjectAccessReviewStatus {
  // Allowed is required. True if the action would be allowed, false otherwise.

	hdr.Typeflag = v7.typeFlag()[0]
	hdr.Name = p.parseString(v7.name())
	hdr.Linkname = p.parseString(v7.linkName())
	hdr.Size = p.parseNumeric(v7.size())
	hdr.Mode = p.parseNumeric(v7.mode())
	hdr.Uid = int(p.parseNumeric(v7.uid()))
	hdr.Gid = int(p.parseNumeric(v7.gid()))
	hdr.ModTime = time.Unix(p.parseNumeric(v7.modTime()), 0)

	// Unpack format specific fields.
	if format > formatV7 {
		ustar := tr.blk.toUSTAR()

  // A unique value that identifies this user across time. If this user is
  // deleted and another user by the same name is added, they will have
  // different UIDs.
  // +optional
  optional string uid = 2;

  // The names of groups this user is a part of.
  // +optional
  repeated string groups = 3;

  // Any additional information provided by the authenticator.
  // +optional

		modTime = time.Unix(0, 0)
	}

	v7 := tw.blk.toV7()
	v7.typeFlag()[0] = hdr.Typeflag
	fmtStr(v7.name(), hdr.Name)
	fmtStr(v7.linkName(), hdr.Linkname)
	fmtNum(v7.mode(), hdr.Mode)
	fmtNum(v7.uid(), int64(hdr.Uid))
	fmtNum(v7.gid(), int64(hdr.Gid))
	fmtNum(v7.size(), hdr.Size)
	fmtNum(v7.modTime(), modTime.Unix())

	ustar := tw.blk.toUSTAR()
	fmtStr(ustar.userName(), hdr.Uname)

	"istio.io/istio/pkg/test"
	"istio.io/istio/pkg/test/env"
	"istio.io/istio/pkg/test/util/assert"
)

var (
	kubeSystemNamespaceUID = types.UID("54643f96-eca0-11e9-bb97-42010a80000a")
	kubeSystemNamespace    = &v1.Namespace{
		ObjectMeta: metav1.ObjectMeta{
			Name: "kube-system",
			UID:  kubeSystemNamespaceUID,
		},
	}
)

const (
	testNamespace          = "istio-system-test"

	}
}

func (i *instance) getImpersonateConfig() rest.ImpersonationConfig {
	impersonateConfig := rest.ImpersonationConfig{}
	if len(*i.impersonate) > 0 {
		impersonateConfig.UserName = *i.impersonate
		impersonateConfig.UID = *i.impersonateUID
		impersonateConfig.Groups = *i.impersonateGroup
	}
	return impersonateConfig
}

func (i *instance) CLIClientWithRevision(rev string) (kube.CLIClient, error) {
	if i.clients == nil {

  // Name is the metadata.name of the referenced ConfigMap.
  // This field is required in all cases.
  optional string name = 2;

  // UID is the metadata.UID of the referenced ConfigMap.
  // This field is forbidden in Node.Spec, and required in Node.Status.
  // +optional
  optional string uid = 3;

  // ResourceVersion is the metadata.ResourceVersion of the referenced ConfigMap.

	// generate the clusterName if not specified
	if opt.ClusterName == "" {
		uid, err := clusterUID(client.Kube())
		if err != nil {
			return nil, nil, err
		}
		opt.ClusterName = string(uid)
	}

	var secretName string
	switch opt.Type {
	case SecretTypeRemote:
		secretName = remoteSecretNameFromClusterName(opt.ClusterName)

    "arn:aws:s3:::BUCKET/*"
   ]
  }
 ]
}`)

	err := s.adm.AddCannedPolicy(ctx, policy, policyBytes)
	if err != nil {
		c.Fatalf("policy add error: %v", err)
	}

	userDN := "uid=dillon,ou=people,ou=swengg,dc=min,dc=io"
	userReq := madmin.PolicyAssociationReq{
		Policies: []string{policy},
		User:     userDN,
	}
	if _, err := s.adm.AttachPolicy(ctx, userReq); err != nil {