// for this resource across all versions in the API group.
  // Resources with non-empty groups are located at /apis/<APIGroupDiscovery.objectMeta.name>/<APIVersionDiscovery.version>/<APIResourceDiscovery.Resource>
  // Resources with empty groups are located at /api/v1/<APIResourceDiscovery.Resource>
  optional string resource = 1;

  // Populated by the API server on creation and immutable.
  // +optional
  optional string uid = 3;

  // groups contains group membership of the user that created the CertificateSigningRequest.
  // Populated by the API server on creation and immutable.
  // +listType=atomic
  // +optional
  repeated string groups = 4;

  // extra contains extra attributes of the user that created the CertificateSigningRequest.

  // namespaced indicates if a resource is namespaced or not.
  optional bool namespaced = 2;

  // group is the preferred group of the resource.  Empty implies the group of the containing resource list.
  // For subresources, this may have a different value, for example: Scale".
  optional string group = 8;

  // version is the preferred version of the resource.  Empty implies the version of the containing resource list

  repeated FlowSchemaCondition conditions = 1;
}

// GroupSubject holds detailed information for group-kind subject.
message GroupSubject {
  // name is the user group that matches, or "*" to match all user groups.
  // See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some
  // well-known group names.
  // Required.
  optional string name = 1;
}

  repeated FlowSchemaCondition conditions = 1;
}

// GroupSubject holds detailed information for group-kind subject.
message GroupSubject {
  // name is the user group that matches, or "*" to match all user groups.
  // See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some
  // well-known group names.
  // Required.
  optional string name = 1;
}

}

// Rule is a tuple of APIGroups, APIVersion, and Resources.It is recommended
// to make sure that all the tuple expansions are valid.
message Rule {
  // APIGroups is the API groups the resources belong to. '*' is all groups.
  // If '*' is present, the length of the slice must be one.
  // Required.
  // +listType=atomic
  repeated string apiGroups = 1;

// to specify a cluster or namespace-scoped resource.
message IngressClassParametersReference {
  // apiGroup is the group for the resource being referenced. If APIGroup is
  // not specified, the specified Kind must be in the core API group. For any
  // other third-party types, APIGroup is required.
  // +optional
  optional string aPIGroup = 1;

  //
  // Default is "false".
  //
  // +featureGate=SELinuxMountReadWriteOncePod
  // +optional
  optional bool seLinuxMount = 8;
}

// DEPRECATED - This group version of CSINode is deprecated by storage/v1/CSINode.
// See the release notes for more information.
// CSINode holds information about all CSI drivers installed on a node.

  // deleted and another user by the same name is added, they will have
  // different UIDs.
  // +optional
  optional string uid = 2;

  // The names of groups this user is a part of.
  // +optional
  repeated string groups = 3;

  // Any additional information provided by the authenticator.
  // +optional
  map<string, ExtraValue> extra = 4;

  repeated string verbs = 1;

  // APIGroups is the name of the APIGroup that contains the resources.  If multiple API groups are specified, any action requested against one of
  // the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
  // +optional
  repeated string apiGroups = 3;