// stomped by the controller.
  // +optional
  optional AggregationRule aggregationRule = 3;
}

// ClusterRoleBinding references a ClusterRole, but not contain it.  It can reference a ClusterRole in the global namespace,
// and adds who information via Subject.
message ClusterRoleBinding {
  // Standard object's metadata.
  // +optional

  // The list ordering isn't significant, may contain duplicates, and possibly be incomplete.
  repeated ResourceRule resourceRules = 1;

  // NonResourceRules is the list of actions the subject is allowed to perform on non-resources.
  // The list ordering isn't significant, may contain duplicates, and possibly be incomplete.
  repeated NonResourceRule nonResourceRules = 2;

// Package-wide variables from generator "generated".
option go_package = "k8s.io/api/resource/v1alpha2";

// AllocationResult contains attributes of an allocated resource.
message AllocationResult {
  // ResourceHandles contain the state associated with an allocation that
  // should be maintained throughout the lifetime of a claim. Each
  // ResourceHandle contains data that should be passed to a specific kubelet

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time time = 1;

  // message represents the error encountered during Attach or Detach operation.
  // This string maybe logged, so it should not contain sensitive
  // information.
  // +optional
  optional string message = 2;

// HTTPIngressPath associates a path with a backend. Incoming urls matching the
// path are forwarded to the backend.
message HTTPIngressPath {
  // path is matched against the path of an incoming request. Currently it can
  // contain characters disallowed from the conventional "path" part of a URL
  // as defined by RFC 3986. Paths must begin with a '/' and must be present
  // when using PathType with value "Exact" or "Prefix".
  // +optional

  // If the signer cannot issue the certificate, a condition of type "Failed" is added and this field remains empty.
  //
  // Validation requirements:
  //  1. certificate must contain one or more PEM blocks.
  //  2. All PEM blocks must have the "CERTIFICATE" label, contain no headers, and the encoded data
  //   must be a BER-encoded ASN.1 Certificate structure as described in section 4 of RFC5280.

  optional bool force = 2;

  // fieldManager is a name associated with the actor or entity
  // that is making these changes. The value must be less than or
  // 128 characters long, and only contain printable characters,
  // as defined by https://golang.org/pkg/unicode/#IsPrint. This
  // field is required.
  optional string fieldManager = 3;
}

  // Name is the name of the object as presented in the request.  On a CREATE operation, the client may omit name and
  // rely on the server to generate the name.  If that is the case, this field will contain an empty string.
  // +optional
  optional string name = 5;

  // Namespace is the namespace associated with the request (if any).
  // +optional
  optional string namespace = 6;

  // If this field is not specified, it will default based on the existence of Ingress or Egress rules;
  // policies that contain an Egress section are assumed to affect Egress, and all policies
  // (whether or not they contain an Ingress section) are assumed to affect Ingress.
  // If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ].

option go_package = "k8s.io/api/apps/v1";

// ControllerRevision implements an immutable snapshot of state data. Clients
// are responsible for serializing and deserializing the objects that contain
// their internal state.
// Once a ControllerRevision has been successfully created, it can not be updated.
// The API Server will fail validation of all requests that attempt to mutate