kubernetes/test/integration/clustertrustbundles/admission_establishtrust_test.go

// Verifies that the ClusterTrustBundle attest admission plugin correctly
// enforces that a user has "attest" on the affected signer name.
func TestCTBAttestPlugin(t *testing.T) { … }

func grantUserPermissionToAttestFor(ctx context.Context, t *testing.T, client kubernetes.Interface, username string, signerNames ...string) { … }

func buildApprovalClusterRoleForSigners(name string, signerNames ...string) *rbacv1.ClusterRole { … }

func buildClusterRoleBindingForUser(name, username, clusterRoleName string) *rbacv1.ClusterRoleBinding { … }