kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/controller_policy_test.go

var rolesWithAllowStar …

// TestNoStarsForControllers confirms that no controller role has star verbs, groups,
// or resources.  There are three known exceptions: namespace lifecycle and GC which have to
// delete anything, and HPA, which has the power to read metrics associated
// with any object.
func TestNoStarsForControllers(t *testing.T) { … }

func TestControllerRoleLabel(t *testing.T) { … }