}

// SelfSubjectAccessReview checks whether or the current user can perform an action.  Not filling in a
// spec.namespace means "in all namespaces".  Self is a special case, because users should always be able
// to check whether they can perform an action
message SelfSubjectAccessReview {
  // Standard list metadata.

  // Valid operators are In, NotIn, Exists and DoesNotExist.
  optional string operator = 2;

  // values is an array of string values. If the operator is In or NotIn,
  // the values array must be non-empty. If the operator is Exists or DoesNotExist,
  // the values array must be empty. This array is replaced during a strategic
  // merge patch.
  // +optional
  repeated string values = 3;
}

  // that matches the template's node selector (or on every node if no node
  // selector is specified).
  // The only allowed template.spec.restartPolicy value is "Always".
  // More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#pod-template
  optional k8s.io.api.core.v1.PodTemplateSpec template = 2;

  // The command line tool kubectl, for example, allows use of the singular resource name in place of plurals.
  // The singular form of a resource should always be an optional element - when in doubt use the canonical resource name.
  optional string singularResource = 4;

  // verbs is a list of supported API operation types (this includes

}

// DEPRECATED 1.9 - This group version of NetworkPolicySpec is deprecated by networking/v1/NetworkPolicySpec.
message NetworkPolicySpec {
  // Selects the pods to which this NetworkPolicy object applies.  The array of ingress rules
  // is applied to any pods selected by this field. Multiple network policies can select the
  // same set of pods.  In this case, the ingress rules for each are combined additively.

  // (succeeded or failed), the controller does three steps to account for it
  // in the job status:
  //
  // 1. Add the pod UID to the arrays in this field.
  // 2. Remove the pod finalizer.
  // 3. Remove the pod UID from the arrays while increasing the corresponding
  //     counter.
  //
  // Old jobs might not be tracked using this field, in which case the field
  // remains null.
  // +optional

  // that matches the template's node selector (or on every node if no node
  // selector is specified).
  // The only allowed template.spec.restartPolicy value is "Always".
  // More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#pod-template
  optional k8s.io.api.core.v1.PodTemplateSpec template = 2;

}

// SelfSubjectAccessReview checks whether or the current user can perform an action.  Not filling in a
// spec.namespace means "in all namespaces".  Self is a special case, because users should always be able
// to check whether they can perform an action
message SelfSubjectAccessReview {
  // Standard list metadata.

  //
  // Equality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].
  // Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:
  //   - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and

  optional int32 endPort = 3;
}

// NetworkPolicySpec provides the specification of a NetworkPolicy
message NetworkPolicySpec {
  // podSelector selects the pods to which this NetworkPolicy object applies.
  // The array of ingress rules is applied to any pods selected by this field.
  // Multiple network policies can select the same set of pods. In this case,
  // the ingress rules for each are combined additively.