// +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // provisioner indicates the type of the provisioner.
  optional string provisioner = 2;

  // parameters holds the parameters for the provisioner that should
  // create volumes of this storage class.
  // +optional
  map<string, string> parameters = 3;

  // +optional
  repeated PolicyRule rules = 2;

  // AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
  // If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
  // stomped by the controller.
  // +optional
  optional AggregationRule aggregationRule = 3;
}

    throw new IllegalStateException("Optional.get() cannot be called on an absent value");
  }

  @Override
  public T or(T defaultValue) {
    return checkNotNull(defaultValue, "use Optional.orNull() instead of Optional.or(null)");
  }

  @SuppressWarnings("unchecked") // safe covariant cast
  @Override
  public Optional<T> or(Optional<? extends T> secondChoice) {
    return (Optional<T>) checkNotNull(secondChoice);
  }

  // +optional
  optional string namespace = 6;

  // Operation is the operation being performed. This may be different than the operation
  // requested. e.g. a patch can result in either a CREATE or UPDATE Operation.
  optional string operation = 7;

  // UserInfo is information about the requesting user
  optional k8s.io.api.authentication.v1.UserInfo userInfo = 8;

  // Object is the object from the incoming request.
  // +optional

  // +optional
  optional string namespace = 6;

  // Operation is the operation being performed. This may be different than the operation
  // requested. e.g. a patch can result in either a CREATE or UPDATE Operation.
  optional string operation = 7;

  // UserInfo is information about the requesting user
  optional k8s.io.api.authentication.v1.UserInfo userInfo = 8;

  // Object is the object from the incoming request.
  // +optional

  // observed renewTime.
  // +optional
  optional int32 leaseDurationSeconds = 2;

  // acquireTime is a time when the current lease was acquired.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.MicroTime acquireTime = 3;

  // renewTime is a time when the current holder of a lease has last
  // updated the lease.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.MicroTime renewTime = 4;

  // +optional
  optional UserSubject user = 2;

  // `group` matches based on user group name.
  // +optional
  optional GroupSubject group = 3;

  // `serviceAccount` matches ServiceAccounts.
  // +optional
  optional ServiceAccountSubject serviceAccount = 4;
}

// UserSubject holds detailed information for user-kind subject.
message UserSubject {

message ClusterRole {
  // Standard object's metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Rules holds all the PolicyRules for this ClusterRole
  // +optional
  repeated PolicyRule rules = 2;

  // AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.

    name: Optional[str] = None
    call: Optional[Callable[..., Any]] = None
    request_param_name: Optional[str] = None
    websocket_param_name: Optional[str] = None
    http_connection_param_name: Optional[str] = None
    response_param_name: Optional[str] = None
    background_tasks_param_name: Optional[str] = None
    security_scopes_param_name: Optional[str] = None

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec holds information about the request being evaluated
  optional TokenReviewSpec spec = 2;

  // Status is filled in by the server and indicates whether the token can be authenticated.
  // +optional
  optional TokenReviewStatus status = 3;
}

// TokenReviewSpec is a description of the token authentication request.