//      implementations prior to v1.22)
  //   2. Signer whose configured maximum is shorter than the requested duration
  //   3. Signer whose configured minimum is longer than the requested duration
  //
  // The minimum valid value for expirationSeconds is 600, i.e. 10 minutes.
  //
  // +optional
  optional int32 expirationSeconds = 8;

  // mounted only with a single SELinux context.
  //
  // When "false", Kubernetes won't pass any special SELinux mount options to the driver.
  // This is typical for volumes that represent subdirectories of a bigger shared filesystem.
  //
  // Default is "false".
  //
  // +featureGate=SELinuxMountReadWriteOncePod
  // +optional
  optional bool seLinuxMount = 8;
}

  // storageClassName represents the name of the StorageClass that the reported capacity applies to.
  // It must meet the same requirements as the name of a StorageClass
  // object (non-empty, DNS subdomain). If that object no longer exists,
  // the CSIStorageCapacity object is obsolete and should be removed by its
  // creator.
  // This field is immutable.
  optional string storageClassName = 3;

  // that may be executing at a time --- for each such priority
  // level:
  //
  //             ACV(l) = ceil( SCL * ACS(l) / ( sum[priority levels k] ACS(k) ) )
  //
  // bigger numbers of ACS mean more reserved concurrent requests (at the
  // expense of every other PL).
  // This field has a default value of 30.
  // +optional
  optional int32 assuredConcurrencyShares = 1;

  // that may be executing at a time --- for each such priority
  // level:
  //
  //             ACV(l) = ceil( SCL * ACS(l) / ( sum[priority levels k] ACS(k) ) )
  //
  // bigger numbers of ACS mean more reserved concurrent requests (at the
  // expense of every other PL).
  // This field has a default value of 30.
  // +optional
  optional int32 assuredConcurrencyShares = 1;

Copyright (c) 2012 Alex Ogier. All rights reserved.
Copyright (c) 2012 The Go Authors. All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:

   * Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
   * Redistributions in binary form must reproduce the above

		./pilot/pkg/security/authz/builder/... \
		./cni/pkg/plugin/...

update-golden: refresh-goldens

# Keep dummy target since some build pipelines depend on this
gen-charts:
	@echo "This target is no longer required and will be removed in the future"

gen-addons:
	manifests/addons/gen.sh

gen: \
	mod-download-go \
	go-gen \
	mirror-licenses \
	format \
	update-crds \
	proto \

}

// ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22.
message ClusterRole {
  // Standard object's metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Rules holds all the PolicyRules for this ClusterRole

}

// ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22.
message ClusterRole {
  // Standard object's metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Rules holds all the PolicyRules for this ClusterRole

  // mounted only with a single SELinux context.
  //
  // When "false", Kubernetes won't pass any special SELinux mount options to the driver.
  // This is typical for volumes that represent subdirectories of a bigger shared filesystem.
  //
  // Default is "false".
  //
  // +featureGate=SELinuxMountReadWriteOncePod
  // +optional
  optional bool seLinuxMount = 8;
}