// APIGroup is the group for the resource being referenced. It is
  // empty for the core API. This matches the group in the APIVersion
  // that is used when creating the resources.
  // +optional
  optional string apiGroup = 1;

  // Resource is the type of resource being referenced, for example "pods".
  optional string resource = 3;

  // Name is the name of resource being referenced.
  optional string name = 4;

        return propertyNameExpression?.getReferencedNameAsName()
    }

/**
 * Referenced callable symbol, even if it not completely correctly resolved.
 */
private val FirQualifiedAccessExpression.referencedCallableSymbol: FirCallableSymbol<*>?
    get() {
        return toResolvedCallableSymbol()
    }

/**
 * Referenced [ClassId], even if it is not completely correctly resolved.
 */

      return created;
    }

    // N.B. Draining the queue is only necessary to ensure that we don't accumulate empty references
    // in the array. We could skip this if we decide we don't care about holding on to Reference
    // objects indefinitely.
    private void drainQueue() {
      Reference<? extends L> ref;
      while ((ref = queue.poll()) != null) {

  // apiGroup is the group for the resource being referenced. If APIGroup is
  // not specified, the specified Kind must be in the core API group. For any
  // other third-party types, APIGroup is required.
  // +optional
  optional string aPIGroup = 1;

  // kind is the type of resource being referenced.
  optional string kind = 2;

  // name is the name of resource being referenced.
  optional string name = 3;

  // apiGroup is the group for the resource being referenced. If APIGroup is
  // not specified, the specified Kind must be in the core API group. For any
  // other third-party types, APIGroup is required.
  // +optional
  optional string aPIGroup = 1;

  // kind is the type of resource being referenced.
  optional string kind = 2;

  // name is the name of resource being referenced.
  optional string name = 3;

  [[2]] Localhost (127.0.0.1) may also be unavailable if the whole
        network stack is offline.

  [[3]] "Remote" repositories referenced using the file:// protocol may
        be available. However, if that file:// url references a
        file-share, as in the case of an NFS or SMB mount, that will
        be unavailable.

  So, offline mode has several implications, some of which may not be

      const auto& iter = input_nodes.find(node);
      if (iter == input_nodes.end()) {
        // This node is not referenced in inputs. Add it to the body.
        body_nodes->push_back(node);
      } else {
        // This node is referenced in inputs. Currently, we place an
        // artificial restriction and require that when num_opers=-1, such
        // nodes must have a single output.

  // Kind is the API kind the resources belong to.
  // Required.
  optional string kind = 2;
}

// ParamRef references a parameter resource
// +structType=atomic
message ParamRef {
  // Name of the resource being referenced.
  optional string name = 1;

  // Namespace of the referenced resource.
  // Should be empty for the cluster-scoped resources
  // +optional
  optional string namespace = 2;
}

- `GenerateKey`: Takes a key ID and generates a new data key from a master key referenced by the key ID. It returns the new data key in two different forms: The plain data key and the data key encrypted using the master key.

- `DecryptKey`: Takes a key ID and an encrypted data key and returns the plain data key - the decryption of the encrypted data key using the master key referenced by the key ID - on success or an error otherwise.

	c.lock.RLock()
	defer c.lock.RUnlock()

	return &kes.ListIter[string]{
		NextFunc: c.client.ListKeys,
	}, nil
}

// GenerateKey generates a new data encryption key using
// the key at the KES server referenced by the key ID.
//
// The default key ID will be used if keyID is empty.
//
// The context is associated and tied to the generated DEK.
// The same context must be provided when the generated