aggregationRule:
  clusterRoleSelectors:
  - matchExpressions:
    - key: keyValue
      operator: operatorValue
      values:
      - valuesValue
    matchLabels:
      matchLabelsKey: matchLabelsValue
apiVersion: rbac.authorization.k8s.io/v1alpha1
kind: ClusterRole
metadata:
  annotations:
    annotationsKey: annotationsValue
  creationTimestamp: "2008-01-01T01:01:01Z"
  deletionGracePeriodSeconds: 10

      "resources": [
        "resourcesValue"
      ],
      "resourceNames": [
        "resourceNamesValue"
      ],
      "nonResourceURLs": [
        "nonResourceURLsValue"
      ]
    }
  ],
  "aggregationRule": {
    "clusterRoleSelectors": [
      {
        "matchLabels": {
          "matchLabelsKey": "matchLabelsValue"
        },
        "matchExpressions": [
          {
            "key": "keyValue",

	return true
}

func hasInvalidLabelValueInLabelSelector(role *rbac.ClusterRole) bool {
	if role.AggregationRule != nil {
		labelSelectorValidationOptions := metav1validation.LabelSelectorValidationOptions{AllowInvalidLabelValueInSelector: false}
		for _, selector := range role.AggregationRule.ClusterRoleSelectors {
			if len(metav1validation.ValidateLabelSelector(&selector, labelSelectorValidationOptions, nil)) > 0 {

				).RuleOrDie(),
			},
		},
		{
			// a role for a namespace level admin.  It is `edit` plus the power to grant permissions to other users.
			ObjectMeta: metav1.ObjectMeta{Name: "admin"},
			AggregationRule: &rbacv1.AggregationRule{
				ClusterRoleSelectors: []metav1.LabelSelector{
					{MatchLabels: map[string]string{"rbac.authorization.k8s.io/aggregate-to-admin": "true"}},
				},
			},
		},
		{

apiVersion: v1
items:
- aggregationRule:
    clusterRoleSelectors:
    - matchLabels:
        rbac.authorization.k8s.io/aggregate-to-admin: "true"
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    annotations:
      rbac.authorization.kubernetes.io/autoupdate: "true"
    creationTimestamp: null
    labels:
      kubernetes.io/bootstrapping: rbac-defaults
    name: admin
  rules: null

		if apierrors.IsNotFound(err) {
			continue
		}
		if err != nil {
			return err
		}
		if existingRole.AggregationRule != nil {
			// the old role already moved to an aggregated role, so there are no custom rules to migrate at this point
			return nil
		}
		klog.V(1).Infof("migrating %v to %v", existingRole.Name, newName)

        "properties": {
          "aggregationRule": {
            "allOf": [
              {
                "$ref": "#/components/schemas/io.k8s.api.rbac.v1.AggregationRule"
              }
            ],

							},
						},
					},
					"aggregationRule": {
						SchemaProps: spec.SchemaProps{
							Description: "AggregationRule is an optional field that describes how to build the Rules for this ClusterRole. If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be stomped by the controller.",
							Ref:         ref("k8s.io/api/rbac/v1.AggregationRule"),
						},
					},
				},

      "properties": {
        "aggregationRule": {
          "$ref": "#/definitions/io.k8s.api.rbac.v1.AggregationRule",
          "description": "AggregationRule is an optional field that describes how to build the Rules for this ClusterRole. If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be stomped by the controller."

      "properties": {
        "aggregationRule": {
          "$ref": "#/definitions/io.k8s.api.rbac.v1.AggregationRule",
          "description": "AggregationRule is an optional field that describes how to build the Rules for this ClusterRole. If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be stomped by the controller."