var map_AggregationRule = map[string]string{
	"":                     "AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole",
	"clusterRoleSelectors": "ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules. If any of the selectors match, then the ClusterRole's permissions will be added",
}

func (AggregationRule) SwaggerDoc() map[string]string {

		Verb: "bind",
		// check against the namespace where the binding is being created (or the empty namespace for clusterrolebindings).
		// this allows delegation to bind particular clusterroles in rolebindings within particular namespaces,
		// and to authorize binding a clusterrole across all namespaces in a clusterrolebinding.
		Namespace:       bindingNamespace,
		ResourceRequest: true,
	}

option go_package = "k8s.io/api/rbac/v1";

// AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
message AggregationRule {
  // ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
  // If any of the selectors match, then the ClusterRole's permissions will be added
  // +optional

	"k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy"
)

func BenchmarkEnsureRBACPolicy(b *testing.B) {
	for n := 0; n < b.N; n++ {
		var policy = &PolicyData{
			ClusterRoles:               append(bootstrappolicy.ClusterRoles(), bootstrappolicy.ControllerRoles()...),
			ClusterRoleBindings:        append(bootstrappolicy.ClusterRoleBindings(), bootstrappolicy.ControllerRoleBindings()...),

		NewListFunc:               func() runtime.Object { return &rbac.ClusterRoleList{} },
		DefaultQualifiedResource:  rbac.Resource("clusterroles"),
		SingularQualifiedResource: rbac.Resource("clusterrole"),

		CreateStrategy: clusterrole.Strategy,
		UpdateStrategy: clusterrole.Strategy,
		DeleteStrategy: clusterrole.Strategy,

	_ = obj.(*rbac.ClusterRole)
}

// PrepareForUpdate clears fields that are not allowed to be set by end users on update.
func (strategy) PrepareForUpdate(ctx context.Context, obj, old runtime.Object) {
	newClusterRole := obj.(*rbac.ClusterRole)
	oldClusterRole := old.(*rbac.ClusterRole)

	_, _ = newClusterRole, oldClusterRole
}

// Validate validates a new ClusterRole. Validation must check for a correct signature.

  - create
  - update
- apiGroups:
  - policy
  resources:
  - poddisruptionbudgets
  verbs:
  - '*'
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - clusterrolebindings
  - clusterroles
  - roles
  - rolebindings
  verbs:
  - '*'
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - get
  - create
  - update
- apiGroups:
  - ""

        "deletecollection",
        "get",
        "list",
        "patch",
        "update",
        "watch"
      ]
    },
    {
      "kind": "ClusterRole",
      "name": "clusterroles",
      "namespaced": false,
      "singularName": "clusterrole",
      "storageVersionHash": "bYE5ZWDrJ44=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",

	}
	role := func(name string, labels map[string]string, rules []rbacv1.PolicyRule) *rbacv1.ClusterRole {
		return &rbacv1.ClusterRole{
			ObjectMeta: metav1.ObjectMeta{Name: name, Labels: labels},
			Rules:      rules,
		}
	}
	combinedRole := func(selectors []map[string]string, rules ...[]rbacv1.PolicyRule) *rbacv1.ClusterRole {
		ret := &rbacv1.ClusterRole{
			ObjectMeta:      metav1.ObjectMeta{Name: "combined"},

    users: ["tim"]
    userGroups: ["testers", "developers"]
    verbs: ["patch", "delete", "create"]
    resources:
      - group: ""
      - group: "rbac.authorization.k8s.io"
        resources: ["clusterroles", "clusterrolebindings"]
    namespaces: ["default", "kube-system"]
  - level: Metadata
`

const policyWithNoVersionOrKind = `
rules:
  - level: None
    nonResourceURLs:
      - /healthz*