code: func BuildAuthz(client authorizationclient.SubjectAccessReviewInterface, authz kubeletconfig.KubeletAuthorization) (authorizer.Authorizer, error) {
  	switch authz.Mode {
  	case kubeletconfig.KubeletAuthorizationModeAlwaysAllow:
  		return authorizerfactory.NewAlwaysAllowAuthorizer(), nil
  
  	case kubeletconfig.KubeletAuthorizationModeWebhook:
  		if client == nil {
  			return nil, errors.New("no client provided, cannot use webhook authorization")
  		}
  		authorizerConfig := authorizerfactory.DelegatingAuthorizerConfig{
  			SubjectAccessReviewClient: client,
  			AllowCacheTTL:             authz.Webhook.CacheAuthorizedTTL.Duration,
  			DenyCacheTTL:              authz.Webhook.CacheUnauthorizedTTL.Duration,
  		}
  		return authorizerConfig.New()
  
  	case "":
  		return nil, fmt.Errorf("No authorization mode specified")
  
  	default:
  		return nil, fmt.Errorf("Unknown authorization mode %s", authz.Mode)
  
  	}
  }
docs: // BuildAuthz creates an authorizer compatible with the kubelet's needs