// but is not limited to get, list, watch, create, update, patch,
  // delete, deletecollection, and proxy).
  // +listType=set
  repeated string verbs = 5;

  // shortNames is a list of suggested short names of the resource.
  // +listType=set
  repeated string shortNames = 6;

  // categories is a list of the grouped resources this resource belongs to (e.g. 'all').

  // deleted and another user by the same name is added, they will have
  // different UIDs.
  // +optional
  optional string uid = 2;

  // The names of groups this user is a part of.
  // +optional
  repeated string groups = 3;

  // Any additional information provided by the authenticator.
  // +optional
  map<string, ExtraValue> extra = 4;

  // Resources is a list of resources this rule applies to. '*' represents all resources.
  // +optional
  repeated string resources = 3;

  // ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
  // +optional
  repeated string resourceNames = 4;

  // If not specified, this will default to the time zone of the kube-controller-manager process.
  // The set of valid time zone names and the time zone offset is loaded from the system-wide time zone
  // database by the API server during CronJob validation and the controller manager during execution.

  // appProtocol represents the application protocol for this port.
  // This field follows standard Kubernetes label syntax.
  // Un-prefixed names are reserved for IANA standard service names (as per
  // RFC-6335 and https://www.iana.org/assignments/service-names).
  // Non-standard protocols should use prefixed names such as
  // mycompany.com/my-custom-protocol.
  // +optional
  optional string appProtocol = 4;
}

  //
  // * Un-prefixed protocol names - reserved for IANA standard service names (as per
  // RFC-6335 and https://www.iana.org/assignments/service-names).
  //
  // * Kubernetes-defined prefixed names:
  //   * 'kubernetes.io/h2c' - HTTP/2 over cleartext as described in https://www.rfc-editor.org/rfc/rfc7540
  //
  // * Other protocols should use implementation-defined prefixed names such as
  // mycompany.com/my-custom-protocol.

  // Resources is a list of resources this rule applies to. '*' represents all resources.
  // +optional
  repeated string resources = 4;

  // ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
  // +optional
  repeated string resourceNames = 5;

  // '*/foo' represents the subresource 'foo' for all resources in the specified apiGroups.
  // +optional
  repeated string resources = 3;

  // ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
  // +optional
  repeated string resourceNames = 4;

  // named with the signer name as a prefix (translating slashes to colons).
  // For example, for the signer name `example.com/foo`, valid
  // ClusterTrustBundle object names include `example.com:foo:abc` and
  // `example.com:foo:v1`.
  //
  // If signerName is empty, then the ClusterTrustBundle object's name must
  // not have such a prefix.
  //

  // deleted and another user by the same name is added, they will have
  // different UIDs.
  // +optional
  optional string uid = 2;

  // The names of groups this user is a part of.
  // +optional
  repeated string groups = 3;

  // Any additional information provided by the authenticator.
  // +optional
  map<string, ExtraValue> extra = 4;