code: func compressUsername(username string) string {
  	switch {
  	// Known internal identities.
  	case username == "admin" ||
  		username == "client" ||
  		username == "kube_proxy" ||
  		username == "kubelet" ||
  		username == "system:serviceaccount:kube-system:default":
  		return username
  	// Probably an email address.
  	case strings.Contains(username, "@"):
  		return "email_id"
  	// Anything else (custom service accounts, custom external identities, etc.)
  	default:
  		return "other"
  	}
  }
docs: // compressUsername maps all possible usernames onto a small set of categories
  // of usernames. This is done both to limit the cardinality of the
  // authorized_user_requests metric, and to avoid pushing actual usernames in the
  // metric.