// namespace as the ResourceClaim.
message ResourceClaimConsumerReference {
  // APIGroup is the group for the resource being referenced. It is
  // empty for the core API. This matches the group in the APIVersion
  // that is used when creating the resources.
  // +optional
  optional string apiGroup = 1;

  // Resource is the type of resource being referenced, for example "pods".
  optional string resource = 3;

- apiGroups: [""] resources: ["events"] verbs: ["get", "list", "watch", "delete", "patch", "update", "create" ] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: istio-cni labels: app: istio-cni release: istio istio.io/rev: default install.operator.istio.io/owning-resource: unknown operator.istio.io/component: "Cni" roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: istio-cni subjects: - kind: ServiceAccount name: istio-cni namespace: kube-system...

	if ref == nil {
		return allErrs
	}

	// group is required but the Core group is the empty value, so it can not be enforced.
	if ref.APIGroup != "" {
		for _, msg := range utilvalidation.IsDNS1123Subdomain(ref.APIGroup) {
			allErrs = append(allErrs, field.Invalid(fldPath.Child("apiGroup"), ref.APIGroup, msg))
		}
	}

	if ref.Kind == "" {
		allErrs = append(allErrs, field.Required(fldPath.Child("kind"), ""))
	} else {

	rdm.lock.Lock()
	defer rdm.lock.Unlock()

	key := groupKey{
		source: source,
		name:   apiGroup.Group,
	}

	group, exists := rdm.apiGroups[key]
	if !exists {
		return
	}

	modified := false
	for i := range group.Versions {
		if group.Versions[i].Version == apiGroup.Version {

	return autoConvert_rbac_RoleList_To_v1alpha1_RoleList(in, out, s)
}

func autoConvert_v1alpha1_RoleRef_To_rbac_RoleRef(in *v1alpha1.RoleRef, out *rbac.RoleRef, s conversion.Scope) error {
	out.APIGroup = in.APIGroup
	out.Kind = in.Kind
	out.Name = in.Name
	return nil
}

// Convert_v1alpha1_RoleRef_To_rbac_RoleRef is an autogenerated conversion function.

			err = json.Unmarshal(body, &group)
			if err != nil {
				t.Errorf("[%d] unexpected error parsing json body at path %q: %v", i, path, err)
				continue
			}
		} else {
			// API groups return APIGroup
			group := metav1.APIGroup{}
			err = json.Unmarshal(body, &group)
			if err != nil {
				t.Errorf("[%d] unexpected error parsing json body at path %q: %v", i, path, err)
				continue
			}

	out.Resource = in.Resource
	out.Namespace = in.Namespace
	out.Name = in.Name
	out.UID = types.UID(in.UID)
	out.APIGroup = in.APIGroup
	out.APIVersion = in.APIVersion
	out.ResourceVersion = in.ResourceVersion
	out.Subresource = in.Subresource
	return nil
}

			Verb:            "get",
			Namespace:       "default",
			APIGroup:        "", // Core
			APIVersion:      "v1",
			Resource:        "pods",
			Name:            "busybox",
			ResourceRequest: true,
			Path:            "/api/v1/namespaces/default/pods/busybox",
		},
		"cluster": &authorizer.AttributesRecord{
			User:            tim,
			Verb:            "get",
			APIGroup:        "rbac.authorization.k8s.io", // Core

	"":         "ResourceClaimConsumerReference contains enough information to let you locate the consumer of a ResourceClaim. The user must be a resource in the same namespace as the ResourceClaim.",
	"apiGroup": "APIGroup is the group for the resource being referenced. It is empty for the core API. This matches the group in the APIVersion that is used when creating the resources.",

		deleteAttributes := authorizer.AttributesRecord{
			User:            attributes.GetUserInfo(),
			Verb:            "delete",
			Namespace:       attributes.GetNamespace(),
			APIGroup:        attributes.GetResource().Group,
			APIVersion:      attributes.GetResource().Version,
			Resource:        attributes.GetResource().Resource,
			Subresource:     attributes.GetSubresource(),