// +optional
  repeated PolicyRule rules = 2;

  // AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
  // If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
  // stomped by the controller.
  // +optional
  optional AggregationRule aggregationRule = 3;
}

func (m *AggregationRule) Reset()      { *m = AggregationRule{} }
func (*AggregationRule) ProtoMessage() {}
func (*AggregationRule) Descriptor() ([]byte, []int) {
	return fileDescriptor_c5bc2d145acd4e45, []int{0}
}
func (m *AggregationRule) XXX_Unmarshal(b []byte) error {
	return m.Unmarshal(b)
}
func (m *AggregationRule) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {

func (m *AggregationRule) Reset()      { *m = AggregationRule{} }
func (*AggregationRule) ProtoMessage() {}
func (*AggregationRule) Descriptor() ([]byte, []int) {
	return fileDescriptor_758889dfd9a88fa6, []int{0}
}
func (m *AggregationRule) XXX_Unmarshal(b []byte) error {
	return m.Unmarshal(b)
}
func (m *AggregationRule) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {

	if errors.IsNotFound(err) {
		return nil
	}
	if err != nil {
		return err
	}
	if sharedClusterRole.AggregationRule == nil {
		return nil
	}

	newPolicyRules := []rbacv1.PolicyRule{}
	for i := range sharedClusterRole.AggregationRule.ClusterRoleSelectors {
		selector := sharedClusterRole.AggregationRule.ClusterRoleSelectors[i]
		runtimeLabelSelector, err := metav1.LabelSelectorAsSelector(&selector)
		if err != nil {

aggregationRule:
  clusterRoleSelectors:
  - matchExpressions:
    - key: keyValue
      operator: operatorValue
      values:
      - valuesValue
    matchLabels:
      matchLabelsKey: matchLabelsValue
apiVersion: rbac.authorization.k8s.io/v1alpha1
kind: ClusterRole
metadata:
  annotations:
    annotationsKey: annotationsValue
  creationTimestamp: "2008-01-01T01:01:01Z"
  deletionGracePeriodSeconds: 10

aggregationRule:
  clusterRoleSelectors:
  - matchExpressions:
    - key: keyValue
      operator: operatorValue
      values:
      - valuesValue
    matchLabels:
      matchLabelsKey: matchLabelsValue
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  annotations:
    annotationsKey: annotationsValue
  creationTimestamp: "2008-01-01T01:01:01Z"
  deletionGracePeriodSeconds: 10

aggregationRule:
  clusterRoleSelectors:
  - matchExpressions:
    - key: keyValue
      operator: operatorValue
      values:
      - valuesValue
    matchLabels:
      matchLabelsKey: matchLabelsValue
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    annotationsKey: annotationsValue
  creationTimestamp: "2008-01-01T01:01:01Z"
  deletionGracePeriodSeconds: 10

      "resources": [
        "resourcesValue"
      ],
      "resourceNames": [
        "resourceNamesValue"
      ],
      "nonResourceURLs": [
        "nonResourceURLsValue"
      ]
    }
  ],
  "aggregationRule": {
    "clusterRoleSelectors": [
      {
        "matchLabels": {
          "matchLabelsKey": "matchLabelsValue"
        },
        "matchExpressions": [
          {
            "key": "keyValue",

      "resources": [
        "resourcesValue"
      ],
      "resourceNames": [
        "resourceNamesValue"
      ],
      "nonResourceURLs": [
        "nonResourceURLsValue"
      ]
    }
  ],
  "aggregationRule": {
    "clusterRoleSelectors": [
      {
        "matchLabels": {
          "matchLabelsKey": "matchLabelsValue"
        },
        "matchExpressions": [
          {
            "key": "keyValue",

				).RuleOrDie(),
			},
		},
		{
			// a role for a namespace level admin.  It is `edit` plus the power to grant permissions to other users.
			ObjectMeta: metav1.ObjectMeta{Name: "admin"},
			AggregationRule: &rbacv1.AggregationRule{
				ClusterRoleSelectors: []metav1.LabelSelector{
					{MatchLabels: map[string]string{"rbac.authorization.k8s.io/aggregate-to-admin": "true"}},
				},
			},
		},
		{