"Subject matches the originator of a request, as identified by the request authentication system. There are three ways of matching an originator; by user, group, or service account."
kind indicates which one of the other fields is non-empty. Required"
"GroupSubject holds detailed information for group-kind subject."
"name is the user group that matches, or \"*\" to match all user groups. See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some well-known group names. Required."
"ServiceAccountSubject holds detailed information for service-account-kind subject."
name is the name of matching ServiceAccount objects, or \"*\" to match regardless of name. Required."
namespace is the namespace of matching ServiceAccount objects. Required."
"UserSubject holds detailed information for user-kind subject."
name is the username that matches, or \"*\" to match all usernames. Required."