// If any of the selectors match, then the ClusterRole's permissions will be added
  // +optional
  repeated k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector clusterRoleSelectors = 1;
}

// ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22.
message ClusterRole {

}

func (AggregationRule) SwaggerDoc() map[string]string {
	return map_AggregationRule
}

var map_ClusterRole = map[string]string{
	"":                "ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding. Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22.",

  // +optional
  // +listType=atomic
  repeated .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector clusterRoleSelectors = 1;
}

// ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22.
message ClusterRole {

  // +optional
  // +listType=atomic
  repeated .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector clusterRoleSelectors = 1;
}

// ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22.
message ClusterRole {

		printAncestorTraceback(ancestor)
	}
}

// traceback2 prints a stack trace starting at u. It skips the first "skip"
// logical frames, after which it prints at most "max" logical frames. It
// returns n, which is the number of logical frames skipped and printed, and
// lastN, which is the number of logical frames skipped or printed just in the
// physical frame that u references.

}

message Group {
  // Rules are OR-ed (e.g. ANY rule can match)
  // This is a generic form of the authz policy's to, from and when
  repeated Rules rules = 1;
}

message Rules {
  // The logical behavior between the matches (if there are more than one)
//  MatchBehavior match_behavior = 1;

  // Conditions within a rule are AND-ed (e.g. ALL conditions must be true)
  repeated Match matches = 2;
}

			return sum, err
		}
		mr.readers[i] = nil // permit early GC
	}
	mr.readers = nil
	return sum, nil
}

var _ WriterTo = (*multiReader)(nil)

// MultiReader returns a Reader that's the logical concatenation of
// the provided input readers. They're read sequentially. Once all
// inputs have returned EOF, Read will return EOF.  If any of the readers
// return a non-nil, non-EOF error, Read will return that error.

// Expression represents a logical disjunction of clauses
type Expression struct {
	And []*AndCondition `parser:"@@ ( \"OR\" @@ )*"`
}

// ListExpr represents a literal list with elements as expressions.
type ListExpr struct {
	Elements []*Expression `parser:"\"(\" @@ ( \",\" @@ )* \")\" | \"[\" @@ ( \",\" @@ )* \"]\""`
}

// AndCondition represents logical conjunction of clauses
type AndCondition struct {

		`\000\123\x00\312\xFE\u0123\ubabe\U0000babe`,
		"backslashes 2 (backquote)")
	assert("\\x\\u\\U\\", `\x\u\U\`, "backslash 3 (backquote)")

	// test large and surrogate-half runes. perhaps not the most logical place for these tests.
	var r int32
	r = 0x10ffff // largest rune value
	s = string(r)
	assert(s, "\xf4\x8f\xbf\xbf", "largest rune")
	r = 0x10ffff + 1
	s = string(r)
	assert(s, "\xef\xbf\xbd", "too-large rune")

  // +optional
  // +listType=atomic
  repeated .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector clusterRoleSelectors = 1;
}

// ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
message ClusterRole {
  // Standard object's metadata.
  // +optional