code: func computeReconciledRoleBinding(existing, expected RoleBinding, removeExtraSubjects bool) (*ReconcileClusterRoleBindingResult, error) {
  	result := &ReconcileClusterRoleBindingResult{Operation: ReconcileNone}
  
  	result.Protected = (existing.GetAnnotations()[rbacv1.AutoUpdateAnnotationKey] == "false")
  
  	// Reset the binding completely if the roleRef is different
  	if expected.GetRoleRef() != existing.GetRoleRef() {
  		result.RoleBinding = expected
  		result.Operation = ReconcileRecreate
  		return result, nil
  	}
  
  	// Start with a copy of the existing object
  	result.RoleBinding = existing.DeepCopyRoleBinding()
  
  	// Merge expected annotations and labels
  	result.RoleBinding.SetAnnotations(merge(expected.GetAnnotations(), result.RoleBinding.GetAnnotations()))
  	if !reflect.DeepEqual(result.RoleBinding.GetAnnotations(), existing.GetAnnotations()) {
  		result.Operation = ReconcileUpdate
  	}
  	result.RoleBinding.SetLabels(merge(expected.GetLabels(), result.RoleBinding.GetLabels()))
  	if !reflect.DeepEqual(result.RoleBinding.GetLabels(), existing.GetLabels()) {
  		result.Operation = ReconcileUpdate
  	}
  
  	// Compute extra and missing subjects
  	result.MissingSubjects, result.ExtraSubjects = diffSubjectLists(expected.GetSubjects(), existing.GetSubjects())
  
  	switch {
  	case !removeExtraSubjects && len(result.MissingSubjects) > 0:
  		// add missing subjects in the union case
  		result.RoleBinding.SetSubjects(append(result.RoleBinding.GetSubjects(), result.MissingSubjects...))
  		result.Operation = ReconcileUpdate
  
  	case removeExtraSubjects && (len(result.MissingSubjects) > 0 || len(result.ExtraSubjects) > 0):
  		// stomp to expected subjects in the non-union case
  		result.RoleBinding.SetSubjects(expected.GetSubjects())
  		result.Operation = ReconcileUpdate
  	}
  
  	return result, nil
  }
docs: // computeReconciledRoleBinding returns the rolebinding that must be created and/or updated to make the
  // existing rolebinding's subjects, roleref, labels, and annotations match the expected rolebinding