// User is the user you're testing for.
  // If you specify "User" but not "Groups", then is it interpreted as "What if User were not a member of any groups
  // +optional
  optional string user = 3;

  // Groups is the groups you're testing for.
  // +optional
  repeated string groups = 4;

  repeated string verbs = 1;

  // APIGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of
  // the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
  // +optional
  repeated string apiGroups = 2;

  // for this resource across all versions in the API group.
  // Resources with non-empty groups are located at /apis/<APIGroupDiscovery.objectMeta.name>/<APIVersionDiscovery.version>/<APIResourceDiscovery.Resource>
  // Resources with empty groups are located at /api/v1/<APIResourceDiscovery.Resource>
  optional string resource = 1;

  // User is the user you're testing for.
  // If you specify "User" but not "Group", then is it interpreted as "What if User were not a member of any groups
  // +optional
  optional string user = 3;

  // Groups is the groups you're testing for.
  // +optional
  repeated string group = 4;

  // Populated by the API server on creation and immutable.
  // +optional
  optional string uid = 3;

  // groups contains group membership of the user that created the CertificateSigningRequest.
  // Populated by the API server on creation and immutable.
  // +listType=atomic
  // +optional
  repeated string groups = 4;

  // extra contains extra attributes of the user that created the CertificateSigningRequest.

  // deleted and another user by the same name is added, they will have
  // different UIDs.
  // +optional
  optional string uid = 2;

  // The names of groups this user is a part of.
  // +optional
  repeated string groups = 3;

  // Any additional information provided by the authenticator.
  // +optional
  map<string, ExtraValue> extra = 4;

  // UID information about the requesting user.
  // See user.Info interface for details.
  // +optional
  optional string uid = 3;

  // Group information about the requesting user.
  // See user.Info interface for details.
  // +listType=atomic
  // +optional
  repeated string groups = 4;

  // Extra information about the requesting user.
  // See user.Info interface for details.
  // +optional

// locate the consumer of a ResourceClaim. The user must be a resource in the same
// namespace as the ResourceClaim.
message ResourceClaimConsumerReference {
  // APIGroup is the group for the resource being referenced. It is
  // empty for the core API. This matches the group in the APIVersion
  // that is used when creating the resources.
  // +optional
  optional string apiGroup = 1;

  // The encodingVersion must be included in the decodableVersions.
  // +listType=set
  repeated string decodableVersions = 3;
}

// Storage version of a specific resource.
message StorageVersion {
  // The name is <group>.<resource>.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec is an empty spec. It is here to comply with Kubernetes API style.
  optional StorageVersionSpec spec = 2;

// to specify a cluster or namespace-scoped resource.
message IngressClassParametersReference {
  // apiGroup is the group for the resource being referenced. If APIGroup is
  // not specified, the specified Kind must be in the core API group. For any
  // other third-party types, APIGroup is required.
  // +optional
  optional string aPIGroup = 1;