code: func (r *RoleV2) CheckAndSetDefaults() error {
  	// make sure we have defaults for all fields
  	if r.Metadata.Name == "" {
  		return trace.BadParameter("missing parameter Name")
  	}
  	if r.Metadata.Namespace == "" {
  		r.Metadata.Namespace = defaults.Namespace
  	}
  	if r.Spec.MaxSessionTTL == 0 {
  		r.Spec.MaxSessionTTL = Duration(defaults.MaxCertDuration)
  	}
  	if r.Spec.MaxSessionTTL.Duration() < defaults.MinCertDuration {
  		return trace.BadParameter("maximum session TTL can not be less than %v", defaults.MinCertDuration)
  	}
  	if r.Spec.Namespaces == nil {
  		r.Spec.Namespaces = []string{defaults.Namespace}
  	}
  	if r.Spec.NodeLabels == nil {
  		r.Spec.NodeLabels = map[string]string{Wildcard: Wildcard}
  	}
  	if r.Spec.Resources == nil {
  		r.Spec.Resources = map[string][]string{
  			KindSSHSession:    RO(),
  			KindRole:          RO(),
  			KindNode:          RO(),
  			KindAuthServer:    RO(),
  			KindReverseTunnel: RO(),
  			KindCertAuthority: RO(),
  		}
  	}
  
  	// restrict wildcards
  	for _, login := range r.Spec.Logins {
  		if login == Wildcard {
  			return trace.BadParameter("wildcard matcher is not allowed in logins")
  		}
  	}
  	for key, val := range r.Spec.NodeLabels {
  		if key == Wildcard && val != Wildcard {
  			return trace.BadParameter("selector *:<val> is not supported")
  		}
  	}
  
  	return nil
  }
docs: // Check checks validity of all parameters and sets defaults