# The requesting identity the policy keys on. WITHOUT THIS the `subjects` match never fires
# and every case in resources.yaml would trivially "pass" — a test proving nothing, which is
# worse than no test because it reads as coverage.
apiVersion: cli.kyverno.io/v1alpha1
kind: UserInfo
metadata:
  name: pm-agent-dispatcher
userInfo:
  username: system:serviceaccount:pm-agent:pm-agent
  groups:
    - system:serviceaccounts
    - system:serviceaccounts:pm-agent
    - system:authenticated