// It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
  // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
  // +optional
  optional string evaluationError = 3;
}

// SubjectRulesReviewStatus contains the result of a rules check. This check can be incomplete depending on

  // Items is a list of RoleBindings
  repeated RoleBinding items = 2;
}

// RoleList is a collection of Roles
message RoleList {
  // Standard object's metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is a list of Roles
  repeated Role items = 2;
}

// RoleRef contains information that points to the role being used
// +structType=atomic

  failurePolicy: Fail
  reinvocationPolicy: "{{ .reinvocationPolicy }}"
  admissionReviewVersions: ["v1beta1", "v1"]
{{- end }}
{{- /* Installed for each revision - not installed for cluster resources ( cluster roles, bindings, crds) */}}
{{- if not .Values.global.operatorManageWebhooks }}
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
{{- if eq .Release.Namespace "istio-system"}}

  failurePolicy: Fail
  reinvocationPolicy: "{{ .reinvocationPolicy }}"
  admissionReviewVersions: ["v1beta1", "v1"]
{{- end }}
{{- /* Installed for each revision - not installed for cluster resources ( cluster roles, bindings, crds) */}}
{{- if not .Values.global.operatorManageWebhooks }}
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
{{- if eq .Release.Namespace "istio-system"}}

  //
  // For more information about implementing this mode, see
  // https://kubernetes-csi.github.io/docs/ephemeral-local-volumes.html
  // A driver can support one or more of these modes and
  // more modes may be added in the future.
  //
  // This field is immutable.
  //
  // +optional
  repeated string volumeLifecycleModes = 3;

  // It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
  // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
  // +optional
  optional string evaluationError = 3;
}

// SubjectRulesReviewStatus contains the result of a rules check. This check can be incomplete depending on

  // In addition, The Pod name takes the form
  // `$(job-name)-$(index)-$(random-string)`,
  // the Pod hostname takes the form `$(job-name)-$(index)`.
  //
  // More completion modes can be added in the future.
  // If the Job controller observes a mode that it doesn't recognize, which
  // is possible during upgrades due to version skew, the controller
  // skips updates for the Job.
  // +optional

  - update
- apiGroups:
  - policy
  resources:
  - poddisruptionbudgets
  verbs:
  - '*'
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - clusterrolebindings
  - clusterroles
  - roles
  - rolebindings
  verbs:
  - '*'
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - get
  - create
  - update
- apiGroups:
  - ""
  resources:

  repeated RoleBinding items = 2;
}

// RoleList is a collection of Roles.
// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleList, and will no longer be served in v1.22.
message RoleList {
  // Standard object's metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is a list of Roles
  repeated Role items = 2;
}

  repeated RoleBinding items = 2;
}

// RoleList is a collection of Roles
// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleList, and will no longer be served in v1.22.
message RoleList {
  // Standard object's metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is a list of Roles
  repeated Role items = 2;
}