groupsList := listedConfigItems[groupsListKey]
		for _, item := range groupsList {
			group := path.Dir(item)
			if err := iamOS.loadGroup(ctx, group, cache.iamGroupsMap); err != nil && err != errNoSuchGroup {
				return fmt.Errorf("unable to load the group `%s`: %w", group, err)
			}
		}
	}

	bootstrapTraceMsg("loading user policy mapping")

  // Verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy.  "*" means all.
  // +optional
  optional string verb = 2;

  // Group is the API Group of the Resource.  "*" means all.
  // +optional
  optional string group = 3;

  // Version is the API Version of the Resource.  "*" means all.
  // +optional
  optional string version = 4;

	workloadCmd := &cobra.Command{
		Use:   "workload",
		Short: "Commands to assist in configuring and deploying workloads running on VMs and other non-Kubernetes environments",
		Example: `  # workload group yaml generation
  istioctl x workload group create

  # workload entry configuration generation
  istioctl x workload entry configure`,
	}
	workloadCmd.AddCommand(groupCommand(ctx))
	workloadCmd.AddCommand(entryCommand(ctx))

  repeated FlowSchemaCondition conditions = 1;
}

// GroupSubject holds detailed information for group-kind subject.
message GroupSubject {
  // name is the user group that matches, or "*" to match all user groups.
  // See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some
  // well-known group names.
  // Required.
  optional string name = 1;
}

  repeated FlowSchemaCondition conditions = 1;
}

// GroupSubject holds detailed information for group-kind subject.
message GroupSubject {
  // name is the user group that matches, or "*" to match all user groups.
  // See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some
  // well-known group names.
  // Required.
  optional string name = 1;
}

	exit_1
}

./mc admin user add minio1 foobar foo12345

## add foobar-g group with foobar
./mc admin group add minio2 foobar-g foobar

./mc admin policy attach minio1 consoleAdmin --user=foobar
sleep 5

./mc admin user info minio2 foobar

./mc admin group info minio1 foobar-g

./mc admin policy create minio1 rw ./docs/site-replication/rw.json

sleep 5

            "scaleDistribution": {
              "type": "linear"
            },
            "showPoints": "never",
            "spanNulls": false,
            "stacking": {
              "group": "A",
              "mode": "none"
            },
            "thresholdsStyle": {
              "mode": "off"
            }
          },
          "links": [],
          "mappings": [],

                                <la:errors/>
                            </div>
                            <la:form action="/admin/failureurl/">
                                <div class="form-group row">
                                    <label for="url" class="col-sm-2 text-sm-right col-form-label"><la:message
                                            key="labels.failure_url_search_url"/></label>

				</la:info>
				<la:errors header="errors.front_header" footer="errors.front_footer" prefix="errors.front_prefix"
					suffix="errors.front_suffix"
				/>
			</div>
			<div class="form-group row">
				<label for="as_q" class="col-lg-3 col-md-4 col-sm-5 col-12 col-form-label"><la:message
						key="labels.advance_search_must_queries"
					/></label>
				<div class="col-lg-5 col-md-8 col-sm-7 col-xs-6">

		if baseDN.Parsed.AncestorOf(udn) {
			return true
		}
	}
	return false
}

// IsLDAPGroupDN determines if the given string could be a group DN from LDAP.
func (l Config) IsLDAPGroupDN(group string) bool {
	gdn, err := ldap.ParseDN(group)
	if err != nil {
		return false
	}
	for _, baseDN := range l.LDAP.GroupSearchBaseDistNames {
		if baseDN.Parsed.AncestorOf(gdn) {
			return true
		}
	}