Name      string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	Namespace string `protobuf:"bytes,2,opt,name=namespace,proto3" json:"namespace,omitempty"`
	// Determine the scope of this RBAC policy.
	// If set to NAMESPACE, the 'namespace' field value will be used.
	Scope Scope `protobuf:"varint,3,opt,name=scope,proto3,enum=istio.security.Scope" json:"scope,omitempty"`

        },
        {
          "group": "rbac.authorization.k8s.io",
          "kind": "DeleteOptions",
          "version": "v1"
        },
        {
          "group": "rbac.authorization.k8s.io",
          "kind": "DeleteOptions",
          "version": "v1alpha1"
        },
        {
          "group": "rbac.authorization.k8s.io",
          "kind": "DeleteOptions",

			Class: httpOpts.class,
		}, model.WasmPluginTypeHTTP)

		// Metadata exchange filter needs to be added before any other HTTP filters are added. This is done to
		// ensure that mx filter comes before HTTP RBAC filter. This is related to https://github.com/istio/istio/issues/41066
		filters = appendMxFilter(httpOpts, filters)
		// TODO: how to deal with ext-authz? It will be in the ordering twice

	// Metadata exchange goes first, so RBAC failures, etc can access the state. See https://github.com/istio/istio/issues/41066
	if !cc.hbone {
		filters = append(filters, buildMetadataExchangeNetworkFilters()...)
	}

	// Authn
	filters = extension.PopAppendNetwork(filters, wasm, extensions.PluginPhase_AUTHN)

	// Authz. Since this is HTTP, we only add WASM network filters -- not TCP RBAC, stats, etc.

	// EvaluationError is an indication that some error occurred during the authorization check.
	// It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
	// For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
	// +optional
	EvaluationError string `json:"evaluationError,omitempty" protobuf:"bytes,3,opt,name=evaluationError"`
}

    if [[ -n "${GCP_AUTHN_CACHE_TTL:-}" ]]; then
      params+=" --authentication-token-webhook-cache-ttl=${GCP_AUTHN_CACHE_TTL}"
    fi
  fi

  local authorization_mode="RBAC"
  local -r src_dir="${KUBE_HOME}/kube-manifests/kubernetes/gci-trusty"

  # Enable ABAC mode unless the user explicitly opts out with ENABLE_LEGACY_ABAC=false
  if [[ "${ENABLE_LEGACY_ABAC:-}" != "false" ]]; then

		"k8s.io/api/rbac/v1.RoleRef":                                                                            schema_k8sio_api_rbac_v1_RoleRef(ref),
		"k8s.io/api/rbac/v1.Subject":                                                                            schema_k8sio_api_rbac_v1_Subject(ref),

							wellknown.TCPProxy,
						},
						HTTPFilters: []string{},
						TotalMatch:  true,
					},
				},
				Filters: []string{wellknown.ProxyProtocol},
			},
		},
		{
			name: "TCP RBAC and Stats",
			configs: []config.Config{
				{
					Meta: config.Meta{Name: "gateway", Namespace: "testns", GroupVersionKind: gvk.Gateway},
					Spec: &networking.Gateway{
						Servers: []*networking.Server{

	_ "k8s.io/kubernetes/pkg/apis/batch/install"
	_ "k8s.io/kubernetes/pkg/apis/certificates/install"
	_ "k8s.io/kubernetes/pkg/apis/core/install"
	_ "k8s.io/kubernetes/pkg/apis/policy/install"
	_ "k8s.io/kubernetes/pkg/apis/rbac/install"
	_ "k8s.io/kubernetes/pkg/apis/storage/install"
	"k8s.io/kubernetes/pkg/controller"
	"k8s.io/kubernetes/pkg/controller/deployment/util"
	"k8s.io/kubernetes/pkg/controller/testutil"
	"k8s.io/utils/ptr"
)

- Kubeadm: avoided uploading a defaulted flag value "--authorization-mode=Node,RBAC" for the kube-apiserver in the ClusterConfiguration stored in the "kube-system/kubeadm-config" ConfigMap. "Node,RBAC" are already the kubeadm defaults for this flag, so this action is redundant. ([#123555](https://github.com/kubernetes/kubernetes/pull/123555), [@neolit123](https://github.com/neolit123))