//
  // Defaults to ReadWriteOnceWithFSType, which will examine each volume
  // to determine if Kubernetes should modify ownership and permissions of the volume.
  // With the default policy the defined fsGroup will only be applied
  // if a fstype is defined and the volume's access mode contains ReadWriteOnce.
  //
  // +optional
  optional string fsGroupPolicy = 5;

  // tokenRequests indicates the CSI driver needs pods' service account

var configDumpFile string

func checkCmd(ctx cli.Context) *cobra.Command {
	cmd := &cobra.Command{
		Use:   "check [<type>/]<name>[.<namespace>]",
		Short: "Check AuthorizationPolicy applied in the pod.",
		Long: `Check prints the AuthorizationPolicy applied to a pod by directly checking
the Envoy configuration of the pod. The command is especially useful for inspecting

message DaemonSetStatus {
  // The number of nodes that are running at least 1
  // daemon pod and are supposed to run the daemon pod.
  // More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/
  optional int32 currentNumberScheduled = 1;

  // The number of nodes that are running the daemon pod, but are
  // not supposed to run the daemon pod.
  // More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/

message DaemonSetStatus {
  // The number of nodes that are running at least 1
  // daemon pod and are supposed to run the daemon pod.
  // More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/
  optional int32 currentNumberScheduled = 1;

  // The number of nodes that are running the daemon pod, but are
  // not supposed to run the daemon pod.
  // More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/

}

// CertificateSigningRequestStatus contains conditions used to indicate
// approved/denied/failed status of the request, and the issued certificate.
message CertificateSigningRequestStatus {
  // conditions applied to the request. Known conditions are "Approved", "Denied", and "Failed".
  // +listType=map
  // +listMapKey=type
  // +optional
  repeated CertificateSigningRequestCondition conditions = 1;

		}
	}

	return cfgs
}

// printConfigs prints the applied configs based on the member's type.
// When there is the array is empty, caller should make sure the intended
// log is handled in their methods.
func printConfigs(writer io.Writer, configs []*config.Config) {
	if len(configs) == 0 {
		return
	}
	fmt.Fprintf(writer, "Applied %s:\n", configs[0].Meta.GroupVersionKind.Kind)
	var cfgNames string

#### Caching

  // details.
  //
  // Defaults to unset
  // +optional
  optional string resourceVersion = 4;

  // resourceVersionMatch determines how resourceVersion is applied to list calls.
  // It is highly recommended that resourceVersionMatch be set for list calls where
  // resourceVersion is set
  // See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for

these fields are applied and merged with the output of this step. The result of this step is a merge of configuration
profile defaults and user overlays, all expressed in Helm values.yaml format. This final values.yaml configuration
is passed to the Helm rendering library and used to render the charts. The rendered manifests are passed to the next
step.

    # . implies these objects are visible to only to sidecars in the same namespace, or if imported as a Sidecar.egress.host
    defaultConfigVisibilitySettings: []

    # Default node selector to be applied to all deployments so that all pods can be
    # constrained to run a particular nodes. Each component can overwrite these default
    # values by adding its node selector block in the relevant section below and setting