code: func ValidateTokenGroups(usages []string, groups []string, fldPath *field.Path) field.ErrorList {
  	allErrs := field.ErrorList{}
  
  	// adding groups only makes sense for authentication
  	usagesSet := sets.NewString(usages...)
  	usageAuthentication := strings.TrimPrefix(bootstrapapi.BootstrapTokenUsageAuthentication, bootstrapapi.BootstrapTokenUsagePrefix)
  	if len(groups) > 0 && !usagesSet.Has(usageAuthentication) {
  		allErrs = append(allErrs, field.Invalid(fldPath, groups, fmt.Sprintf("token groups cannot be specified unless --usages includes %q", usageAuthentication)))
  	}
  
  	// validate any extra group names
  	for _, group := range groups {
  		if err := bootstraputil.ValidateBootstrapGroupName(group); err != nil {
  			allErrs = append(allErrs, field.Invalid(fldPath, groups, err.Error()))
  		}
  	}
  
  	return allErrs
  }
docs: // ValidateTokenGroups validates token groups