// for this resource across all versions in the API group.
  // Resources with non-empty groups are located at /apis/<APIGroupDiscovery.objectMeta.name>/<APIVersionDiscovery.version>/<APIResourceDiscovery.Resource>
  // Resources with empty groups are located at /api/v1/<APIResourceDiscovery.Resource>
  optional string resource = 1;

  // namespaced indicates if a resource is namespaced or not.
  optional bool namespaced = 2;

  // group is the preferred group of the resource.  Empty implies the group of the containing resource list.
  // For subresources, this may have a different value, for example: Scale".
  optional string group = 8;

  // version is the preferred version of the resource.  Empty implies the version of the containing resource list

  // an API request to apps/v1beta1 deployments would be converted and sent to the webhook
  // with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),
  // and `requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"}` (indicating the kind of the original API request).
  //

import "k8s.io/apimachinery/pkg/util/intstr/generated.proto";

// Package-wide variables from generator "generated".
option go_package = "k8s.io/api/extensions/v1beta1";

// DEPRECATED - This group version of DaemonSet is deprecated by apps/v1beta2/DaemonSet. See the release notes for
// more information.
// DaemonSet represents the configuration of a daemon set.
message DaemonSet {
  // Standard object's metadata.

  repeated FlowSchemaCondition conditions = 1;
}

// GroupSubject holds detailed information for group-kind subject.
message GroupSubject {
  // name is the user group that matches, or "*" to match all user groups.
  // See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some
  // well-known group names.
  // Required.
  optional string name = 1;
}

  repeated FlowSchemaCondition conditions = 1;
}

// GroupSubject holds detailed information for group-kind subject.
message GroupSubject {
  // name is the user group that matches, or "*" to match all user groups.
  // See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some
  // well-known group names.
  // Required.
  optional string name = 1;
}

  // User is the user you're testing for.
  // If you specify "User" but not "Group", then is it interpreted as "What if User were not a member of any groups
  // +optional
  optional string user = 3;

  // Groups is the groups you're testing for.
  // +optional
  repeated string group = 4;

// or a value for non-objects such as user and group names.
// +structType=atomic
message Subject {
  // Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
  // If the Authorizer does not recognized the kind value, the Authorizer should report an error.
  optional string kind = 1;

  // APIGroup holds the API group of the referenced subject.

  // an API request to apps/v1beta1 deployments would be converted and sent to the webhook
  // with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),
  // and `requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"}` (indicating the kind of the original API request).
  //

message SupplementalGroupsStrategyOptions {
  // rule is the strategy that will dictate what supplemental groups is used in the SecurityContext.
  // +optional
  optional string rule = 1;

  // ranges are the allowed ranges of supplemental groups.  If you would like to force a single
  // supplemental group then supply a single range with the same start and end. Required for MustRunAs.
  // +optional
  repeated IDRange ranges = 2;