# The requester identity Kyverno actually saw on prod when CDI created the importer pod
# (from the kyverno-admission-controller log of the blocked request, 2026-09-06):
#   user={"username":"system:serviceaccount:cdi:cdi-sa","groups":["system:serviceaccounts",
#         "system:serviceaccounts:cdi","system:authenticated"], ...}
#   roles=["cdi:cdi-deployment"]  clusterroles=["cdi", …]
# `kyverno test` feeds this to the engine as the AdmissionReview userInfo so
# `match.subjects` can be evaluated offline.
apiVersion: cli.kyverno.io/v1alpha1
kind: UserInfo
metadata:
  name: cdi-controller
clusterRoles:
  - cdi
roles:
  - cdi:cdi-deployment
userInfo:
  username: system:serviceaccount:cdi:cdi-sa
  groups:
    - system:serviceaccounts
    - system:serviceaccounts:cdi
    - system:authenticated