code: func (set RoleSet) CheckKubeGroups(ttl time.Duration) ([]string, error) {
  	groups := make(map[string]bool)
  	var matchedTTL bool
  	for _, role := range set {
  		maxSessionTTL := role.GetOptions().MaxSessionTTL.Value()
  		if ttl <= maxSessionTTL && maxSessionTTL != 0 {
  			matchedTTL = true
  			for _, group := range role.GetKubeGroups(Allow) {
  				groups[group] = true
  			}
  		}
  	}
  	if !matchedTTL {
  		return nil, trace.AccessDenied("this user cannot request kubernetes access for %v", ttl)
  	}
  	if len(groups) == 0 {
  		return nil, trace.AccessDenied("this user cannot request kubernetes access, has no assigned groups")
  	}
  	out := make([]string, 0, len(groups))
  	for group := range groups {
  		out = append(out, group)
  	}
  	return out, nil
  }
docs: // CheckKubeGroups check if role can login into kubernetes
  // and returns a combined list of allowed groups