code: func ValidateRoleBindingSubject(subject rbac.Subject, isNamespaced bool, fldPath *field.Path) field.ErrorList {
  	allErrs := field.ErrorList{}
  
  	if len(subject.Name) == 0 {
  		allErrs = append(allErrs, field.Required(fldPath.Child("name"), ""))
  	}
  
  	switch subject.Kind {
  	case rbac.ServiceAccountKind:
  		if len(subject.Name) > 0 {
  			for _, msg := range validation.ValidateServiceAccountName(subject.Name, false) {
  				allErrs = append(allErrs, field.Invalid(fldPath.Child("name"), subject.Name, msg))
  			}
  		}
  		if len(subject.APIGroup) > 0 {
  			allErrs = append(allErrs, field.NotSupported(fldPath.Child("apiGroup"), subject.APIGroup, []string{""}))
  		}
  		if !isNamespaced && len(subject.Namespace) == 0 {
  			allErrs = append(allErrs, field.Required(fldPath.Child("namespace"), ""))
  		}
  
  	case rbac.UserKind:
  		// TODO(ericchiang): What other restrictions on user name are there?
  		if subject.APIGroup != rbac.GroupName {
  			allErrs = append(allErrs, field.NotSupported(fldPath.Child("apiGroup"), subject.APIGroup, []string{rbac.GroupName}))
  		}
  
  	case rbac.GroupKind:
  		// TODO(ericchiang): What other restrictions on group name are there?
  		if subject.APIGroup != rbac.GroupName {
  			allErrs = append(allErrs, field.NotSupported(fldPath.Child("apiGroup"), subject.APIGroup, []string{rbac.GroupName}))
  		}
  
  	default:
  		allErrs = append(allErrs, field.NotSupported(fldPath.Child("kind"), subject.Kind, []string{rbac.ServiceAccountKind, rbac.UserKind, rbac.GroupKind}))
  	}
  
  	return allErrs
  }
docs: // ValidateRoleBindingSubject is exported to allow types outside of the RBAC API group to embed a rbac.Subject and reuse this validation logic