{
  "apiVersion": "v1",
  "groupVersion": "certificates.k8s.io/v1alpha1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "ClusterTrustBundle",
      "name": "clustertrustbundles",
      "namespaced": false,
      "singularName": "clustertrustbundle",
      "storageVersionHash": "XGGGW2kGm+w=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",

{
  "apiVersion": "v1",
  "groupVersion": "events.k8s.io/v1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "Event",
      "name": "events",
      "namespaced": true,
      "shortNames": [
        "ev"
      ],
      "singularName": "event",
      "storageVersionHash": "r2yiGXH7wu8=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",

{
  "apiVersion": "v1",
  "groupVersion": "storage.k8s.io/v1alpha1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "VolumeAttributesClass",
      "name": "volumeattributesclasses",
      "namespaced": false,
      "shortNames": [
        "vac"
      ],
      "singularName": "volumeattributesclass",
      "storageVersionHash": "HPC8kMG1ukQ=",
      "verbs": [
        "create",
        "delete",

	GetNamespace() string

	// GetPolicyName returns the name of the (Validating/Mutating)AdmissionPolicy,
	// which is cluster-scoped, so namespace is usually left blank.
	// But we leave the door open to add a namespaced vesion in the future
	GetPolicyName() types.NamespacedName
	GetParamRef() *v1.ParamRef

	GetMatchResources() *v1.MatchResources

            system uses when creating a volume snapshot. A specific VolumeSnapshotClass
            is used by specifying its name in a VolumeSnapshot object. VolumeSnapshotClasses
            are non-namespaced
          properties:
            apiVersion:
              description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest

	cache.SharedIndexInformer
	Lister[T]
}

// Lister[T] helps list Ts.
// All objects returned here must be treated as read-only.
type Lister[T any] interface {
	NamespacedLister[T]
	Namespaced(namespace string) NamespacedLister[T]

  // Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
  // Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"),  but not both.
  // +optional
  repeated string nonResourceURLs = 5;
}

		kernel: utilkernel.TCPKeepAliveProbesNamespacedKernelVersion,
	},
}

// SafeSysctlAllowlist returns the allowlist of safe sysctls and safe sysctl patterns (ending in *).
//
// A sysctl is called safe iff
// - it is namespaced in the container or the pod
// - it is isolated, i.e. has no influence on any other pod on the same node.
func SafeSysctlAllowlist() []string {
	if goruntime.GOOS != "linux" {
		return nil
	}

# limitations under the License.
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: serviceexports.{{ .Group }}
spec:
  group: {{ .Group }}
  scope: Namespaced
  names:
    plural: serviceexports
    singular: serviceexport
    kind: ServiceExport
    shortNames:
      - svcex
  versions:
    - name: {{ .Version }}
      served: true
      storage: true

			Code:    http.StatusNotFound,
			Reason:  metav1.StatusReasonNotFound,
			Message: fmt.Sprintf("%s not found", name),
		}}
	}
	result = obj.(T)
	return result, nil
}

func (w lister[T]) Namespaced(namespace string) NamespacedLister[T] {
	return namespacedLister[T]{namespace: namespace, indexer: w.indexer}
}

func NewLister[T runtime.Object](indexer cache.Indexer) lister[T] {
	return lister[T]{indexer: indexer}