func getCSINodeRelationships(n *Node) (*RelationshipMap, error) {
	var csin storagev1.CSINode
	err := runtime.DefaultUnstructuredConverter.FromUnstructured(n.UnstructuredContent(), &csin)
	if err != nil {
		return nil, err
	}
	var ref ObjectReference
	result := newRelationshipMap()
	for _, d := range csin.Spec.Drivers {
		ref = ObjectReference{Group: storagev1.GroupName, Kind: "CSIDriver", Name: d.Name}
		result.AddDependentByKey(ref.Key(), RelationshipCSINodeDriver)
	}
	return &result, nil
}
getCSINodeRelationships returns a map of relationships that this CSINode has
with other objects, based on what was referenced in its manifest.
package graph
import (
	"strings"
	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
	corev1 "k8s.io/api/core/v1"
	eventsv1 "k8s.io/api/events/v1"
	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
	networkingv1 "k8s.io/api/networking/v1"
	nodev1 "k8s.io/api/node/v1"
	policyv1 "k8s.io/api/policy/v1"
	policyv1beta1 "k8s.io/api/policy/v1beta1"
	rbacv1 "k8s.io/api/rbac/v1"
	schedulingv1 "k8s.io/api/scheduling/v1"
	storagev1 "k8s.io/api/storage/v1"
	storagev1beta1 "k8s.io/api/storage/v1beta1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/labels"
	"k8s.io/apimachinery/pkg/runtime"
	"k8s.io/apimachinery/pkg/types"
	"k8s.io/apimachinery/pkg/util/sets"
	"k8s.io/apiserver/pkg/authentication/serviceaccount"
	"k8s.io/apiserver/pkg/authentication/user"
	apiregistrationv1 "k8s.io/kube-aggregator/pkg/apis/apiregistration/v1"
)
const (
	ValidatedPSPAnnotation = "kubernetes.io/psp"
)
const (
	RelationshipAPIService Relationship = "APIService"
	RelationshipClusterRoleAggregationRule Relationship = "ClusterRoleAggregationRule"
	RelationshipClusterRolePolicyRule      Relationship = "ClusterRolePolicyRule"
	RelationshipClusterRoleBindingSubject  Relationship = "ClusterRoleBindingSubject"
	RelationshipClusterRoleBindingRole     Relationship = "ClusterRoleBindingRole"
	RelationshipRoleBindingSubject         Relationship = "RoleBindingSubject"
	RelationshipRoleBindingRole            Relationship = "RoleBindingRole"
	RelationshipRolePolicyRule             Relationship = "RolePolicyRule"
	RelationshipCSINodeDriver Relationship = "CSINodeDriver"
	RelationshipCSIStorageCapacityStorageClass Relationship = "CSIStorageCapacityStorageClass"
	RelationshipEventRegarding Relationship = "EventRegarding"
	RelationshipEventRelated   Relationship = "EventRelated"
	RelationshipIngressClass           Relationship = "IngressClass"
	RelationshipIngressClassParameters Relationship = "IngressClassParameters"
	RelationshipIngressResource        Relationship = "IngressResource"
	RelationshipIngressService         Relationship = "IngressService"
	RelationshipIngressTLSSecret       Relationship = "IngressTLSSecret"
	RelationshipWebhookConfigurationService Relationship = "WebhookConfigurationService"
	RelationshipNetworkPolicy Relationship = "NetworkPolicy"
	RelationshipControllerRef Relationship = "ControllerReference"
	RelationshipOwnerRef      Relationship = "OwnerReference"
	RelationshipPersistentVolumeClaim           Relationship = "PersistentVolumeClaim"
	RelationshipPersistentVolumeCSIDriver       Relationship = "PersistentVolumeCSIDriver"
	RelationshipPersistentVolumeCSIDriverSecret Relationship = "PersistentVolumeCSIDriverSecret"
	RelationshipPersistentVolumeStorageClass    Relationship = "PersistentVolumeStorageClass"
	RelationshipPodContainerEnv          Relationship = "PodContainerEnvironment"
	RelationshipPodImagePullSecret       Relationship = "PodImagePullSecret"  
	RelationshipPodNode                  Relationship = "PodNode"
	RelationshipPodPriorityClass         Relationship = "PodPriorityClass"
	RelationshipPodRuntimeClass          Relationship = "PodRuntimeClass"
	RelationshipPodSecurityPolicy        Relationship = "PodSecurityPolicy"
	RelationshipPodServiceAccount        Relationship = "PodServiceAccount"
	RelationshipPodVolume                Relationship = "PodVolume"
	RelationshipPodVolumeCSIDriver       Relationship = "PodVolumeCSIDriver"
	RelationshipPodVolumeCSIDriverSecret Relationship = "PodVolumeCSIDriverSecret"  
	RelationshipPodDisruptionBudget Relationship = "PodDisruptionBudget"
	RelationshipPodSecurityPolicyAllowedCSIDriver    Relationship = "PodSecurityPolicyAllowedCSIDriver"
	RelationshipPodSecurityPolicyAllowedRuntimeClass Relationship = "PodSecurityPolicyAllowedRuntimeClass"
	RelationshipPodSecurityPolicyDefaultRuntimeClass Relationship = "PodSecurityPolicyDefaultRuntimeClass"
	RelationshipRuntimeClass Relationship = "RuntimeClass"
	RelationshipService Relationship = "Service"
	RelationshipServiceAccountImagePullSecret Relationship = "ServiceAccountImagePullSecret"
	RelationshipServiceAccountSecret          Relationship = "ServiceAccountSecret"
	RelationshipStorageClassProvisioner Relationship = "StorageClassProvisioner"
	RelationshipVolumeAttachmentAttacher                    Relationship = "VolumeAttachmentAttacher"
	RelationshipVolumeAttachmentNode                        Relationship = "VolumeAttachmentNode"
	RelationshipVolumeAttachmentSourceVolume                Relationship = "VolumeAttachmentSourceVolume"
	RelationshipVolumeAttachmentSourceVolumeClaim           Relationship = "VolumeAttachmentSourceVolumeClaim"
	RelationshipVolumeAttachmentSourceVolumeCSIDriver       Relationship = "VolumeAttachmentSourceVolumeCSIDriver"
	RelationshipVolumeAttachmentSourceVolumeCSIDriverSecret Relationship = "VolumeAttachmentSourceVolumeCSIDriverSecret"
	RelationshipVolumeAttachmentSourceVolumeStorageClass    Relationship = "VolumeAttachmentSourceVolumeStorageClass"
)
func getAPIServiceRelationships(n *Node) (*RelationshipMap, error) {
	var apisvc apiregistrationv1.APIService
	err := runtime.DefaultUnstructuredConverter.FromUnstructured(n.UnstructuredContent(), &apisvc)
	if err != nil {
		return nil, err
	}
	var ref ObjectReference
	result := newRelationshipMap()
	if svc := apisvc.Spec.Service; svc != nil {
		ref = ObjectReference{Kind: "Service", Namespace: svc.Namespace, Name: svc.Name}
		result.AddDependencyByKey(ref.Key(), RelationshipAPIService)
	}
	return &result, nil
}
func getClusterRoleRelationships(n *Node) (*RelationshipMap, error) {
	var cr rbacv1.ClusterRole
	err := runtime.DefaultUnstructuredConverter.FromUnstructured(n.UnstructuredContent(), &cr)
	if err != nil {
		return nil, err
	}
	var os ObjectSelector
	var ols ObjectLabelSelector
	var ref ObjectReference
	result := newRelationshipMap()
	if ar := cr.AggregationRule; ar != nil {
		for ix := range ar.ClusterRoleSelectors {
			selector, err := metav1.LabelSelectorAsSelector(&ar.ClusterRoleSelectors[ix])
			if err != nil {
				return nil, err
			}
			ols = ObjectLabelSelector{Group: rbacv1.GroupName, Kind: "ClusterRole", Selector: selector}
			result.AddDependencyByLabelSelector(ols, RelationshipClusterRoleAggregationRule)
		}
	}
	for _, r := range cr.Rules {
		if podSecurityPolicyMatches(r) {
			switch len(r.ResourceNames) {
			case 0:
				os = ObjectSelector{Group: policyv1beta1.GroupName, Kind: "PodSecurityPolicy"}
				result.AddDependencyBySelector(os, RelationshipClusterRolePolicyRule)
			default:
				for _, n := range r.ResourceNames {
					ref = ObjectReference{Group: policyv1beta1.GroupName, Kind: "PodSecurityPolicy", Name: n}
					result.AddDependencyByKey(ref.Key(), RelationshipClusterRolePolicyRule)
				}
			}
		}
	}
	return &result, nil
}
func getClusterRoleBindingRelationships(n *Node) (*RelationshipMap, error) {
	var crb rbacv1.ClusterRoleBinding
	err := runtime.DefaultUnstructuredConverter.FromUnstructured(n.UnstructuredContent(), &crb)
	if err != nil {
		return nil, err
	}
	var os ObjectSelector
	var ref ObjectReference
	result := newRelationshipMap()
	for _, s := range crb.Subjects {
		switch s.Kind {
		case rbacv1.ServiceAccountKind:
			if s.APIGroup == corev1.GroupName && s.Namespace != "" {
				ref = ObjectReference{Kind: "ServiceAccount", Namespace: s.Namespace, Name: s.Name}
				result.AddDependentByKey(ref.Key(), RelationshipClusterRoleBindingSubject)
			}
		case rbacv1.GroupKind:
			if s.APIGroup == rbacv1.GroupName && s.Namespace == "" {
				switch {
				case s.Name == user.AllAuthenticated:
					os = ObjectSelector{Kind: "ServiceAccount"}
					result.AddDependentBySelector(os, RelationshipClusterRoleBindingSubject)
				case s.Name == serviceaccount.AllServiceAccountsGroup:
					os = ObjectSelector{Kind: "ServiceAccount"}
					result.AddDependentBySelector(os, RelationshipClusterRoleBindingSubject)
				case strings.HasPrefix(s.Name, serviceaccount.ServiceAccountGroupPrefix):
					sns := s.Name[len(serviceaccount.ServiceAccountGroupPrefix):]
					os = ObjectSelector{Kind: "ServiceAccount", Namespaces: sets.NewString(sns)}
					result.AddDependentBySelector(os, RelationshipClusterRoleBindingSubject)
				}
			}
		case rbacv1.UserKind:
			if s.APIGroup == rbacv1.GroupName && s.Namespace == "" {
				ns, sa, err := serviceaccount.SplitUsername(s.Name)
				if err == nil {
					ref = ObjectReference{Kind: "ServiceAccount", Namespace: ns, Name: sa}
					result.AddDependentByKey(ref.Key(), RelationshipClusterRoleBindingSubject)
				}
			}
		}
	}
	r := crb.RoleRef
	if r.APIGroup == rbacv1.GroupName && r.Kind == "ClusterRole" {
		ref = ObjectReference{Group: rbacv1.GroupName, Kind: "ClusterRole", Name: r.Name}
		result.AddDependencyByKey(ref.Key(), RelationshipRoleBindingRole)
	}
	return &result, nil
}