default:
		verb := text
		if i := strings.Index(text, " "); i >= 0 {
			verb = verb[:i]
		}
		flag := pragmaFlag(verb)
		const runtimePragmas = ir.Systemstack | ir.Nowritebarrier | ir.Nowritebarrierrec | ir.Yeswritebarrierrec
		if !base.Flag.CompilingRuntime && flag&runtimePragmas != 0 {
			p.error(syntax.Error{Pos: pos, Msg: fmt.Sprintf("//%s only allowed in runtime", verb)})
		}

				Subjects: []flowcontrol.Subject{{
					Kind: flowcontrol.SubjectKindUser,
					User: &flowcontrol.UserSubject{Name: username},
				}},
				NonResourceRules: []flowcontrol.NonResourcePolicyRule{{
					Verbs:           []string{"*"},
					NonResourceURLs: []string{"*"},
				}},
			}},
		},
	}
	plcObj = &flowcontrol.PriorityLevelConfiguration{
		ObjectMeta: metav1.ObjectMeta{
			Name: plName,
		},

        "properties": {
          "path": {
            "description": "Path is the URL path of the request",
            "type": "string"
          },
          "verb": {
            "description": "Verb is the standard HTTP verb",
            "type": "string"
          }
        },
        "type": "object"
      },
      "io.k8s.api.authorization.v1.NonResourceRule": {

			}},
			ResourceRules: []flowcontrol.ResourcePolicyRule{{
				Verbs:        []string{flowcontrol.VerbAll},
				APIGroups:    []string{flowcontrol.APIGroupAll},
				Resources:    []string{flowcontrol.ResourceAll},
				ClusterScope: true,
				Namespaces:   []string{flowcontrol.NamespaceEvery},
			}},
			NonResourceRules: []flowcontrol.NonResourcePolicyRule{{
				Verbs:           []string{flowcontrol.VerbAll},
				NonResourceURLs: []string{"/"},

	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/sets"
	"k8s.io/apiserver/pkg/endpoints/request"

	"k8s.io/klog/v2"
)

// readOnlyVerbs contains verbs for read-only requests.
var readOnlyVerbs = sets.NewString("get", "list", "watch", "proxy")

// watchIdentifier identifies group of watches that are similar.
// As described in the "Priority and Fairness" KEP, we consider

						Verbs:     getVerbs(p.Spec.Readonly),
						APIGroups: []string{p.Spec.APIGroup},
						Resources: []string{p.Spec.Resource},
					}
					var resourceRule authorizer.ResourceRuleInfo = &r
					resourceRules = append(resourceRules, resourceRule)
				}
				if len(p.Spec.NonResourcePath) > 0 {
					r := authorizer.DefaultNonResourceRuleInfo{
						Verbs:           getVerbs(p.Spec.Readonly),

    - serviceaccounts
    verbs:
    - create
  - apiGroups:
    - ""
    resources:
    - secrets
    verbs:
    - delete
  - apiGroups:
    - ""
    resources:
    - configmaps
    - namespaces
    - secrets
    - serviceaccounts
    verbs:
    - get
  - apiGroups:
    - ""
    resources:
    - secrets
    - serviceaccounts
    verbs:
    - update
  - apiGroups:

  - apiGroups: [""]
    verbs: ["update"]
    resources: ["pods/finalizers"]
{{- end }}
  - apiGroups: ["networking.istio.io"]
    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
    resources: [ "workloadentries" ]
  - apiGroups: ["networking.istio.io"]
    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]

                    "version": ""
                  },
                  "subresource": "status",
                  "verbs": [
                    "get",
                    "patch",
                    "update"
                  ]
                }
              ],
              "verbs": [
                "create",
                "delete",
                "deletecollection",
                "get",

  - apiGroups: [""]
    verbs: ["update"]
    resources: ["pods/finalizers"]
{{- end }}
  - apiGroups: ["networking.istio.io"]
    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
    resources: [ "workloadentries" ]
  - apiGroups: ["networking.istio.io"]
    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]