ClusterRoleEvaluatorParseScope parses the requested scope, determining the requested role name, namespace, and if access to escalating objects is required.

these must agree with the scope authorizer, but it's an API we cannot realistically change.

these must agree with the scope authorizer, but it's an API we cannot realistically change.

UserListAllProjects gives explicit permission to see the projects a user can see.

UserListScopedProjects gives explicit permission to see the projects that this token can see.

ScopeDescribers map prefixes to a function that handles that prefix.

role:<clusterrole name>:<namespace to allow the cluster role, * means all>.

user:<scope name>.

ScopeDescriber takes a scope and returns metadata about it.