"extra":  extra,
	}
	if obj.ResourceAttributes != nil {
		ret["resourceAttributes"] = map[string]string{
			"namespace":   obj.ResourceAttributes.Namespace,
			"verb":        obj.ResourceAttributes.Verb,
			"group":       obj.ResourceAttributes.Group,
			"version":     obj.ResourceAttributes.Version,
			"resource":    obj.ResourceAttributes.Resource,
			"subresource": obj.ResourceAttributes.Subresource,

		{
			name:               "match on user name but not resourceAttributes",
			attr:               bobAttr,
			expectedCompileErr: "",
			expectedDecision:   authorizer.DecisionNoOpinion,
			expressions: []apiserver.WebhookMatchCondition{
				{
					Expression: "request.user == 'bob'",
				},
				{
					Expression: "has(request.resourceAttributes) && request.resourceAttributes.namespace == 'kittensandponies'",
				},
			},

type SubjectAccessReviewSpec struct {
	// ResourceAuthorizationAttributes describes information for a resource access request
	// +optional
	ResourceAttributes *ResourceAttributes `json:"resourceAttributes,omitempty" protobuf:"bytes,1,opt,name=resourceAttributes"`
	// NonResourceAttributes describes information for a non-resource access request
	// +optional

type SubjectAccessReviewSpec struct {
	// ResourceAuthorizationAttributes describes information for a resource access request
	// +optional
	ResourceAttributes *ResourceAttributes `json:"resourceAttributes,omitempty" protobuf:"bytes,1,opt,name=resourceAttributes"`
	// NonResourceAttributes describes information for a non-resource access request
	// +optional

	}
	resourceAttributesDeclType := buildResourceAttributesType(f, fs)
	resourceAttributeType := reflect.TypeOf(v1.ResourceAttributes{})
	if len(resourceAttributesDeclType.Fields) != resourceAttributeType.NumField() {
		t.Fatalf("expected %d fields for ResourceAttributes, got %d", resourceAttributeType.NumField(), len(resourceAttributesDeclType.Fields))
	}

func (m *ResourceAttributes) Reset()      { *m = ResourceAttributes{} }
func (*ResourceAttributes) ProtoMessage() {}
func (*ResourceAttributes) Descriptor() ([]byte, []int) {
	return fileDescriptor_8eab727787743457, []int{4}
}
func (m *ResourceAttributes) XXX_Unmarshal(b []byte) error {
	return m.Unmarshal(b)
}
func (m *ResourceAttributes) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {

		UID:                   in.UID,
	}
}

func v1ResourceAttributesToV1beta1ResourceAttributes(in *authorizationv1.ResourceAttributes) *authorizationv1beta1.ResourceAttributes {
	if in == nil {
		return nil
	}
	return &authorizationv1beta1.ResourceAttributes{
		Namespace:   in.Namespace,
		Verb:        in.Verb,
		Group:       in.Group,
		Version:     in.Version,
		Resource:    in.Resource,

func (m *ResourceAttributes) Reset()      { *m = ResourceAttributes{} }
func (*ResourceAttributes) ProtoMessage() {}
func (*ResourceAttributes) Descriptor() ([]byte, []int) {
	return fileDescriptor_aafd0e5e70cec678, []int{4}
}
func (m *ResourceAttributes) XXX_Unmarshal(b []byte) error {
	return m.Unmarshal(b)
}
func (m *ResourceAttributes) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {

  // final step in the path.  "*" means all.
  // +optional
  repeated string nonResourceURLs = 2;
}

// ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface
message ResourceAttributes {
  // Namespace is the namespace of the action being requested.  Currently, there is no distinction between no namespace and all namespaces

  // final step in the path.  "*" means all.
  // +optional
  // +listType=atomic
  repeated string nonResourceURLs = 2;
}

// ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface
message ResourceAttributes {
  // Namespace is the namespace of the action being requested.  Currently, there is no distinction between no namespace and all namespaces