func (store *IAMStoreSys) GetUsers() map[string]madmin.UserInfo {
	cache := store.rlock()
	defer store.runlock()

	result := map[string]madmin.UserInfo{}
	for k, u := range cache.iamUsersMap {
		v := u.Credentials

		if v.IsTemp() || v.IsServiceAccount() {
			continue
		}
		pl, _ := cache.iamUserPolicyMap.Load(k)
		result[k] = madmin.UserInfo{
			PolicyName: pl.Policies,

	if !sys.Initialized() {
		return nil, errServerNotInitialized
	}

	select {
	case <-sys.configLoaded:
		return sys.store.GetBucketUsers(bucket)
	case <-ctx.Done():
		return nil, ctx.Err()
	}
}

// ListUsers - list all users.
func (sys *IAMSys) ListUsers(ctx context.Context) (map[string]madmin.UserInfo, error) {
	if !sys.Initialized() {

	out.AuditID = types.UID(in.AuditID)
	out.Stage = audit.Stage(in.Stage)
	out.RequestURI = in.RequestURI
	out.Verb = in.Verb
	out.User = in.User
	out.ImpersonatedUser = (*authenticationv1.UserInfo)(unsafe.Pointer(in.ImpersonatedUser))
	out.SourceIPs = *(*[]string)(unsafe.Pointer(&in.SourceIPs))
	out.UserAgent = in.UserAgent
	out.ObjectRef = (*audit.ObjectReference)(unsafe.Pointer(in.ObjectRef))

			claim.Namespace,
			claim.Name,
			api.Resource("persistentvolumeclaims").WithVersion("version"),
			"", // subresource
			admission.Create,
			&metav1.CreateOptions{},
			false, // dryRun
			nil,   // userInfo
		)
		err := admissiontesting.WithReinvocationTesting(t, ctrl).Admit(context.TODO(), attrs, nil)
		klog.Infof("Got %v", err)
		if err != nil && !test.expectError {

	//
	// CEL expressions have access to the contents of UserInfo, organized into CEL variable:
	// - 'user' - authentication.k8s.io/v1, Kind=UserInfo object
	//    Refer to https://github.com/kubernetes/api/blob/release-1.28/authentication/v1/types.go#L105-L122 for the definition.
	//    API documentation: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#userinfo-v1-authentication-k8s-io
	//

	userInfo := &authenticationv1.UserInfo{
		Extra:    make(map[string]authenticationv1.ExtraValue),
		Groups:   info.GetGroups(),
		UID:      info.GetUID(),
		Username: info.GetName(),
	}
	// Convert the extra information in the user object
	for key, val := range info.GetExtra() {
		userInfo.Extra[key] = authenticationv1.ExtraValue(val)
	}

		Description: "Name has system critical prefix",
	}

	tests := []struct {
		name            string
		existingClasses []*scheduling.PriorityClass
		newClass        *scheduling.PriorityClass
		userInfo        user.Info
		operation       admission.Operation
		expectError     bool
	}{
		{
			"create operator with default class",
			[]*scheduling.PriorityClass{},
			defaultClass1,
			nil,

	Verb string `json:"verb" protobuf:"bytes,5,opt,name=verb"`
	// Authenticated user information.
	User authnv1.UserInfo `json:"user" protobuf:"bytes,6,opt,name=user"`
	// Impersonated user information.
	// +optional
	ImpersonatedUser *authnv1.UserInfo `json:"impersonatedUser,omitempty" protobuf:"bytes,7,opt,name=impersonatedUser"`
	// Source IPs, from where the request originated and intermediate proxies.

MINIO_IDENTITY_OPENID_CLAIM_USERINFO        (on|off)    Enable fetching claims from UserInfo Endpoint for authenticated user
MINIO_IDENTITY_OPENID_KEYCLOAK_REALM        (string)    Specify Keycloak 'realm' name, only honored if vendor was set to 'keycloak' as value, if no realm is specified 'master' is default

	*out = *in
	out.TypeMeta = in.TypeMeta
	in.User.DeepCopyInto(&out.User)
	if in.ImpersonatedUser != nil {
		in, out := &in.ImpersonatedUser, &out.ImpersonatedUser
		*out = new(authenticationv1.UserInfo)
		(*in).DeepCopyInto(*out)
	}
	if in.SourceIPs != nil {
		in, out := &in.SourceIPs, &out.SourceIPs
		*out = make([]string, len(*in))
		copy(*out, *in)
	}
	if in.ObjectRef != nil {