repeated PolicyRule rules = 2;

  // AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
  // If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
  // stomped by the controller.
  // +optional
  optional AggregationRule aggregationRule = 3;
}

  // re-acquire conflicting fields owned by other people.
  optional bool force = 2;

  // fieldManager is a name associated with the actor or entity
  // that is making these changes. The value must be less than or
  // 128 characters long, and only contain printable characters,
  // as defined by https://golang.org/pkg/unicode/#IsPrint. This
  // field is required.
  optional string fieldManager = 3;

  // Defaults to 1. This field is alpha-level and is only honored by servers that enable the
  // MaxUnavailableStatefulSet feature. The field applies to all pods in the range 0 to
  // Replicas-1. That means if there is any unavailable pod in the range 0 to Replicas-1, it
  // will be counted towards MaxUnavailable.
  // +optional
  optional k8s.io.apimachinery.pkg.util.intstr.IntOrString maxUnavailable = 2;
}

  // regarding contains the object this Event is about. In most cases it's an Object reporting controller
  // implements, e.g. ReplicaSetController implements ReplicaSets and this event is emitted because
  // it acts on some changes in a ReplicaSet object.
  // +optional
  optional k8s.io.api.core.v1.ObjectReference regarding = 8;

  // related is the optional secondary object for more complex actions. E.g. when regarding object triggers

  // Defaults to 1. This field is alpha-level and is only honored by servers that enable the
  // MaxUnavailableStatefulSet feature. The field applies to all pods in the range 0 to
  // Replicas-1. That means if there is any unavailable pod in the range 0 to Replicas-1, it
  // will be counted towards MaxUnavailable.
  // +optional
  optional k8s.io.apimachinery.pkg.util.intstr.IntOrString maxUnavailable = 2;
}

  // except is a slice of CIDRs that should not be included within an IPBlock
  // Valid examples are "192.168.1.0/24" or "2001:db8::/64"
  // Except values will be rejected if they are outside the cidr range
  // +optional
  repeated string except = 2;
}

// Ingress is a collection of rules that allow inbound connections to reach the
// endpoints defined by a backend. An Ingress can be configured to give services

  // FlowSchema is among those with the numerically lowest (which we take to be logically highest)
  // MatchingPrecedence.  Each MatchingPrecedence value must be ranged in [1,10000].
  // Note that if the precedence is not specified, it will be set to 1000 as default.
  // +optional
  optional int32 matchingPrecedence = 2;

  // FlowSchema is among those with the numerically lowest (which we take to be logically highest)
  // MatchingPrecedence.  Each MatchingPrecedence value must be ranged in [1,10000].
  // Note that if the precedence is not specified, it will be set to 1000 as default.
  // +optional
  optional int32 matchingPrecedence = 2;

  // previous fields.
  //
  // This is defined since CSI spec 1.4.0 as the largest size
  // that may be used in a
  // CreateVolumeRequest.capacity_range.required_bytes field to
  // create a volume with the same parameters as those in
  // GetCapacityRequest. The corresponding value in the Kubernetes
  // API is ResourceRequirements.Requests in a volume claim.
  //

  // +optional
  optional string rule = 1;

  // ranges are the allowed ranges of fs groups.  If you would like to force a single
  // fs group then supply a single range with the same start and end. Required for MustRunAs.
  // +optional
  repeated IDRange ranges = 2;
}

// HostPortRange defines a range of host ports that will be enabled by a policy