@@ -18,4 +18,9 @@ when that change will happen.

 1. The `pauseControllers` field in `master-config.yaml` is deprecated as of Origin 1.0.4 and will

   no longer be supported in Origin 1.1. After that, a warning will be printed on startup if it

-  is set to true.

\ No newline at end of file

+  is set to true.

+

+1. The `/ns/namespace-name/subjectaccessreview` endpoint is deprecated, use `/subjectaccessreview` 

+(with the `namespace` field set) or `/ns/namespace-name/localsubjectaccessreview`.  In 

+Origin 1.y / OSE 3.y, support for `/ns/namespace-name/subjectaccessreview` wil be removed.

+At that time, the openshift docker registry image must be upgraded in order to continue functioning.

new file mode 100644

@@ -0,0 +1 @@

+Local Resource Access Reviews are objects that allow you to determine which users and groups can perform a given action in a given namespace.

\ No newline at end of file

new file mode 100644

@@ -0,0 +1 @@

+Local Subject Access Reviews are objects that allow you to determine whether a given user or group can perform a particular action in a given namespace.  Leaving `user` and `groups` empty allows you determine whether the identity making the request can perform the action.

\ No newline at end of file

@@ -6837,6 +6837,194 @@

     ]

    },

    {

+    "path": "/oapi/v1/namespaces/{namespace}/localresourceaccessreviews",

+    "description": "OpenShift REST API, version v1",

+    "operations": [

+     {

+      "type": "v1.LocalResourceAccessReview",

+      "method": "POST",

+      "summary": "create a LocalResourceAccessReview",

+      "nickname": "createNamespacedLocalResourceAccessReview",

+      "parameters": [

+       {

+        "type": "string",

+        "paramType": "query",

+        "name": "pretty",

+        "description": "If 'true', then the output is pretty printed.",

+        "required": false,

+        "allowMultiple": false

+       },

+       {

+        "type": "v1.LocalResourceAccessReview",

+        "paramType": "body",

+        "name": "body",

+        "description": "",

+        "required": true,

+        "allowMultiple": false

+       },

+       {

+        "type": "string",

+        "paramType": "path",

+        "name": "namespace",

+        "description": "object name and auth scope, such as for teams and projects",

+        "required": true,

+        "allowMultiple": false

+       }

+      ],

+      "responseMessages": [

+       {

+        "code": 200,

+        "message": "OK",

+        "responseModel": "v1.LocalResourceAccessReview"

+       }

+      ],

+      "produces": [

+       "application/json"

+      ],

+      "consumes": [

+       "*/*"

+      ]

+     }

+    ]

+   },

+   {

+    "path": "/oapi/v1/localresourceaccessreviews",

+    "description": "OpenShift REST API, version v1",

+    "operations": [

+     {

+      "type": "v1.LocalResourceAccessReview",

+      "method": "POST",

+      "summary": "create a LocalResourceAccessReview",

+      "nickname": "createLocalResourceAccessReview",

+      "parameters": [

+       {

+        "type": "string",

+        "paramType": "query",

+        "name": "pretty",

+        "description": "If 'true', then the output is pretty printed.",

+        "required": false,

+        "allowMultiple": false

+       },

+       {

+        "type": "v1.LocalResourceAccessReview",

+        "paramType": "body",

+        "name": "body",

+        "description": "",

+        "required": true,

+        "allowMultiple": false

+       }

+      ],

+      "responseMessages": [

+       {

+        "code": 200,

+        "message": "OK",

+        "responseModel": "v1.LocalResourceAccessReview"

+       }

+      ],

+      "produces": [

+       "application/json"

+      ],

+      "consumes": [

+       "*/*"

+      ]

+     }

+    ]

+   },

+   {

+    "path": "/oapi/v1/namespaces/{namespace}/localsubjectaccessreviews",

+    "description": "OpenShift REST API, version v1",

+    "operations": [

+     {

+      "type": "v1.LocalSubjectAccessReview",

+      "method": "POST",

+      "summary": "create a LocalSubjectAccessReview",

+      "nickname": "createNamespacedLocalSubjectAccessReview",

+      "parameters": [

+       {

+        "type": "string",

+        "paramType": "query",

+        "name": "pretty",

+        "description": "If 'true', then the output is pretty printed.",

+        "required": false,

+        "allowMultiple": false

+       },

+       {

+        "type": "v1.LocalSubjectAccessReview",

+        "paramType": "body",

+        "name": "body",

+        "description": "",

+        "required": true,

+        "allowMultiple": false

+       },

+       {

+        "type": "string",

+        "paramType": "path",

+        "name": "namespace",

+        "description": "object name and auth scope, such as for teams and projects",

+        "required": true,

+        "allowMultiple": false

+       }

+      ],

+      "responseMessages": [

+       {

+        "code": 200,

+        "message": "OK",

+        "responseModel": "v1.LocalSubjectAccessReview"

+       }

+      ],

+      "produces": [

+       "application/json"

+      ],

+      "consumes": [

+       "*/*"

+      ]

+     }

+    ]

+   },

+   {

+    "path": "/oapi/v1/localsubjectaccessreviews",

+    "description": "OpenShift REST API, version v1",

+    "operations": [

+     {

+      "type": "v1.LocalSubjectAccessReview",

+      "method": "POST",

+      "summary": "create a LocalSubjectAccessReview",

+      "nickname": "createLocalSubjectAccessReview",

+      "parameters": [

+       {

+        "type": "string",

+        "paramType": "query",

+        "name": "pretty",

+        "description": "If 'true', then the output is pretty printed.",

+        "required": false,

+        "allowMultiple": false

+       },

+       {

+        "type": "v1.LocalSubjectAccessReview",

+        "paramType": "body",

+        "name": "body",

+        "description": "",

+        "required": true,

+        "allowMultiple": false

+       }

+      ],

+      "responseMessages": [

+       {

+        "code": 200,

+        "message": "OK",

+        "responseModel": "v1.LocalSubjectAccessReview"

+       }

+      ],

+      "produces": [

+       "application/json"

+      ],

+      "consumes": [

+       "*/*"

+      ]

+     }

+    ]

+   },

+   {

     "path": "/oapi/v1/netnamespaces",

     "description": "OpenShift REST API, version v1",

     "operations": [

@@ -16111,6 +16299,97 @@

      }

     }

    },

+   "v1.LocalResourceAccessReview": {

+    "id": "v1.LocalResourceAccessReview",

+    "required": [

+     "namespace",

+     "verb",

+     "resource",

+     "resourceName"

+    ],

+    "properties": {

+     "kind": {

+      "type": "string",

+      "description": "kind of object, in CamelCase; cannot be updated; see http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#types-kinds"

+     },

+     "apiVersion": {

+      "type": "string",

+      "description": "version of the schema the object should have; see http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#resources"

+     },

+     "namespace": {

+      "type": "string",

+      "description": "namespace of the action being requested"

+     },

+     "verb": {

+      "type": "string",

+      "description": "one of get, list, watch, create, update, delete"

+     },

+     "resource": {

+      "type": "string",

+      "description": "one of the existing resource types"

+     },

+     "resourceName": {

+      "type": "string",

+      "description": "name of the resource being requested for a get or delete"

+     },

+     "content": {

+      "type": "string",

+      "description": "actual content of the request for create and update"

+     }

+    }

+   },

+   "v1.LocalSubjectAccessReview": {

+    "id": "v1.LocalSubjectAccessReview",

+    "required": [

+     "namespace",

+     "verb",

+     "resource",

+     "resourceName",

+     "user",

+     "groups"

+    ],

+    "properties": {

+     "kind": {

+      "type": "string",

+      "description": "kind of object, in CamelCase; cannot be updated; see http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#types-kinds"

+     },

+     "apiVersion": {

+      "type": "string",

+      "description": "version of the schema the object should have; see http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#resources"

+     },

+     "namespace": {

+      "type": "string",

+      "description": "namespace of the action being requested"

+     },

+     "verb": {

+      "type": "string",

+      "description": "one of get, list, watch, create, update, delete"

+     },

+     "resource": {

+      "type": "string",

+      "description": "one of the existing resource types"

+     },

+     "resourceName": {

+      "type": "string",

+      "description": "name of the resource being requested for a get or delete"

+     },

+     "content": {

+      "type": "string",

+      "description": "actual content of the request for create and update"

+     },

+     "user": {

+      "type": "string",

+      "description": "optional, if both user and groups are empty, the current authenticated user is used"

+     },

+     "groups": {

+      "type": "array",

+      "items": {

+       "type": "string"

+      },

+      "description": "optional, list of groups to which the user belongs"

+     }

+    }

+   },

    "v1.NetNamespaceList": {

     "id": "v1.NetNamespaceList",

     "required": [

@@ -16835,8 +17114,10 @@

    "v1.ResourceAccessReview": {

     "id": "v1.ResourceAccessReview",

     "required": [

+     "namespace",

      "verb",

-     "resource"

+     "resource",

+     "resourceName"

     ],

     "properties": {

      "kind": {

@@ -16847,6 +17128,10 @@

       "type": "string",

       "description": "version of the schema the object should have; see http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#resources"

      },

+     "namespace": {

+      "type": "string",

+      "description": "namespace of the action being requested"

+     },

      "verb": {

       "type": "string",

       "description": "one of get, list, watch, create, update, delete"

@@ -16855,13 +17140,13 @@

       "type": "string",

       "description": "one of the existing resource types"

      },

-     "content": {

+     "resourceName": {

       "type": "string",

-      "description": "actual content of the request for a create or update"

+      "description": "name of the resource being requested for a get or delete"

      },

-     "resourceName": {

+     "content": {

       "type": "string",

-      "description": "name of the resource being requested for a get or delete operation"

+      "description": "actual content of the request for create and update"

      }

     }

    },

@@ -17002,11 +17287,12 @@

    "v1.SubjectAccessReview": {

     "id": "v1.SubjectAccessReview",

     "required": [

+     "namespace",

      "verb",

      "resource",

+     "resourceName",

      "user",

-     "groups",

-     "resourceName"

+     "groups"

     ],

     "properties": {

      "kind": {

@@ -17017,6 +17303,10 @@

       "type": "string",

       "description": "version of the schema the object should have; see http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#resources"

      },

+     "namespace": {

+      "type": "string",

+      "description": "namespace of the action being requested"

+     },

      "verb": {

       "type": "string",

       "description": "one of get, list, watch, create, update, delete"

@@ -17025,6 +17315,14 @@

       "type": "string",

       "description": "one of the existing resource types"

      },

+     "resourceName": {

+      "type": "string",

+      "description": "name of the resource being requested for a get or delete"

+     },

+     "content": {

+      "type": "string",

+      "description": "actual content of the request for create and update"

+     },

      "user": {

       "type": "string",

       "description": "optional, if both user and groups are empty, the current authenticated user is used"

@@ -17035,14 +17333,6 @@

        "type": "string"

       },

       "description": "optional, list of groups to which the user belongs"

-     },

-     "content": {

-      "type": "string",

-      "description": "actual content of the request for create and update"

-     },

-     "resourceName": {

-      "type": "string",

-      "description": "name of the resource being requested for a get or delete"

      }

     }

    },

@@ -18,6 +18,19 @@ import (

 	util "k8s.io/kubernetes/pkg/util"

 )

+func deepCopy_api_AuthorizationAttributes(in api.AuthorizationAttributes, out *api.AuthorizationAttributes, c *conversion.Cloner) error {

+	out.Namespace = in.Namespace

+	out.Verb = in.Verb

+	out.Resource = in.Resource

+	out.ResourceName = in.ResourceName

+	if newVal, err := c.DeepCopy(in.Content); err != nil {

+		return err

+	} else {

+		out.Content = newVal.(runtime.EmbeddedObject)

+	}

+	return nil

+}

+

 func deepCopy_api_ClusterPolicy(in api.ClusterPolicy, out *api.ClusterPolicy, c *conversion.Cloner) error {

 	if newVal, err := c.DeepCopy(in.TypeMeta); err != nil {

 		return err

@@ -257,6 +270,43 @@ func deepCopy_api_IsPersonalSubjectAccessReview(in api.IsPersonalSubjectAccessRe

 	return nil

 }

+func deepCopy_api_LocalResourceAccessReview(in api.LocalResourceAccessReview, out *api.LocalResourceAccessReview, c *conversion.Cloner) error {

+	if newVal, err := c.DeepCopy(in.TypeMeta); err != nil {

+		return err

+	} else {

+		out.TypeMeta = newVal.(pkgapi.TypeMeta)

+	}

+	if err := deepCopy_api_AuthorizationAttributes(in.Action, &out.Action, c); err != nil {

+		return err

+	}

+	return nil

+}

+

+func deepCopy_api_LocalSubjectAccessReview(in api.LocalSubjectAccessReview, out *api.LocalSubjectAccessReview, c *conversion.Cloner) error {

+	if newVal, err := c.DeepCopy(in.TypeMeta); err != nil {

+		return err

+	} else {

+		out.TypeMeta = newVal.(pkgapi.TypeMeta)

+	}

+	if err := deepCopy_api_AuthorizationAttributes(in.Action, &out.Action, c); err != nil {

+		return err

+	}

+	out.User = in.User

+	if in.Groups != nil {

+		out.Groups = make(util.StringSet)

+		for key, val := range in.Groups {

+			if newVal, err := c.DeepCopy(val); err != nil {

+				return err

+			} else {

+				out.Groups[key] = newVal.(util.Empty)

+			}

+		}

+	} else {

+		out.Groups = nil

+	}

+	return nil

+}

+

 func deepCopy_api_Policy(in api.Policy, out *api.Policy, c *conversion.Cloner) error {

 	if newVal, err := c.DeepCopy(in.TypeMeta); err != nil {

 		return err

@@ -435,14 +485,9 @@ func deepCopy_api_ResourceAccessReview(in api.ResourceAccessReview, out *api.Res

 	} else {

 		out.TypeMeta = newVal.(pkgapi.TypeMeta)

 	}

-	out.Verb = in.Verb

-	out.Resource = in.Resource

-	if newVal, err := c.DeepCopy(in.Content); err != nil {

+	if err := deepCopy_api_AuthorizationAttributes(in.Action, &out.Action, c); err != nil {

 		return err

-	} else {

-		out.Content = newVal.(runtime.EmbeddedObject)

 	}

-	out.ResourceName = in.ResourceName

 	return nil

 }

@@ -601,8 +646,9 @@ func deepCopy_api_SubjectAccessReview(in api.SubjectAccessReview, out *api.Subje

 	} else {

 		out.TypeMeta = newVal.(pkgapi.TypeMeta)

 	}

-	out.Verb = in.Verb

-	out.Resource = in.Resource

+	if err := deepCopy_api_AuthorizationAttributes(in.Action, &out.Action, c); err != nil {

+		return err

+	}

 	out.User = in.User

 	if in.Groups != nil {

 		out.Groups = make(util.StringSet)

@@ -616,12 +662,6 @@ func deepCopy_api_SubjectAccessReview(in api.SubjectAccessReview, out *api.Subje

 	} else {

 		out.Groups = nil

 	}

-	if newVal, err := c.DeepCopy(in.Content); err != nil {

-		return err

-	} else {

-		out.Content = newVal.(runtime.EmbeddedObject)

-	}

-	out.ResourceName = in.ResourceName

 	return nil

 }

@@ -2549,6 +2589,7 @@ func deepCopy_api_UserList(in userapi.UserList, out *userapi.UserList, c *conver

 func init() {

 	err := pkgapi.Scheme.AddGeneratedDeepCopyFuncs(

+		deepCopy_api_AuthorizationAttributes,

 		deepCopy_api_ClusterPolicy,

 		deepCopy_api_ClusterPolicyBinding,

 		deepCopy_api_ClusterPolicyBindingList,

@@ -2558,6 +2599,8 @@ func init() {

 		deepCopy_api_ClusterRoleBindingList,

 		deepCopy_api_ClusterRoleList,

 		deepCopy_api_IsPersonalSubjectAccessReview,

+		deepCopy_api_LocalResourceAccessReview,

+		deepCopy_api_LocalSubjectAccessReview,

 		deepCopy_api_Policy,

 		deepCopy_api_PolicyBinding,

 		deepCopy_api_PolicyBindingList,

@@ -200,22 +200,6 @@ func convert_api_PolicyList_To_v1_PolicyList(in *api.PolicyList, out *v1.PolicyL

 	return nil

 }

-func convert_api_ResourceAccessReview_To_v1_ResourceAccessReview(in *api.ResourceAccessReview, out *v1.ResourceAccessReview, s conversion.Scope) error {

-	if defaulting, found := s.DefaultingInterface(reflect.TypeOf(*in)); found {

-		defaulting.(func(*api.ResourceAccessReview))(in)

-	}

-	if err := convert_api_TypeMeta_To_v1_TypeMeta(&in.TypeMeta, &out.TypeMeta, s); err != nil {

-		return err

-	}

-	out.Verb = in.Verb

-	out.Resource = in.Resource

-	if err := s.Convert(&in.Content, &out.Content, 0); err != nil {

-		return err

-	}

-	out.ResourceName = in.ResourceName

-	return nil

-}

-

 func convert_api_Role_To_v1_Role(in *api.Role, out *v1.Role, s conversion.Scope) error {

 	if defaulting, found := s.DefaultingInterface(reflect.TypeOf(*in)); found {

 		defaulting.(func(*api.Role))(in)

@@ -469,22 +453,6 @@ func convert_v1_PolicyList_To_api_PolicyList(in *v1.PolicyList, out *api.PolicyL

 	return nil

 }

-func convert_v1_ResourceAccessReview_To_api_ResourceAccessReview(in *v1.ResourceAccessReview, out *api.ResourceAccessReview, s conversion.Scope) error {

-	if defaulting, found := s.DefaultingInterface(reflect.TypeOf(*in)); found {

-		defaulting.(func(*v1.ResourceAccessReview))(in)

-	}

-	if err := convert_v1_TypeMeta_To_api_TypeMeta(&in.TypeMeta, &out.TypeMeta, s); err != nil {

-		return err

-	}

-	out.Verb = in.Verb

-	out.Resource = in.Resource

-	if err := s.Convert(&in.Content, &out.Content, 0); err != nil {

-		return err

-	}

-	out.ResourceName = in.ResourceName

-	return nil

-}

-

 func convert_v1_Role_To_api_Role(in *v1.Role, out *api.Role, s conversion.Scope) error {

 	if defaulting, found := s.DefaultingInterface(reflect.TypeOf(*in)); found {

 		defaulting.(func(*v1.Role))(in)

@@ -3196,7 +3164,6 @@ func init() {

 		convert_api_ProjectSpec_To_v1_ProjectSpec,

 		convert_api_ProjectStatus_To_v1_ProjectStatus,

 		convert_api_Project_To_v1_Project,

-		convert_api_ResourceAccessReview_To_v1_ResourceAccessReview,

 		convert_api_ResourceRequirements_To_v1_ResourceRequirements,

 		convert_api_RoleBindingList_To_v1_RoleBindingList,

 		convert_api_RoleList_To_v1_RoleList,

@@ -3274,7 +3241,6 @@ func init() {

 		convert_v1_ProjectSpec_To_api_ProjectSpec,

 		convert_v1_ProjectStatus_To_api_ProjectStatus,

 		convert_v1_Project_To_api_Project,

-		convert_v1_ResourceAccessReview_To_api_ResourceAccessReview,

 		convert_v1_ResourceRequirements_To_api_ResourceRequirements,

 		convert_v1_RoleBindingList_To_api_RoleBindingList,

 		convert_v1_RoleList_To_api_RoleList,

@@ -19,6 +19,19 @@ import (

 	util "k8s.io/kubernetes/pkg/util"

 )

+func deepCopy_v1_AuthorizationAttributes(in v1.AuthorizationAttributes, out *v1.AuthorizationAttributes, c *conversion.Cloner) error {

+	out.Namespace = in.Namespace

+	out.Verb = in.Verb

+	out.Resource = in.Resource

+	out.ResourceName = in.ResourceName

+	if newVal, err := c.DeepCopy(in.Content); err != nil {

+		return err

+	} else {

+		out.Content = newVal.(runtime.RawExtension)

+	}

+	return nil

+}

+

 func deepCopy_v1_ClusterPolicy(in v1.ClusterPolicy, out *v1.ClusterPolicy, c *conversion.Cloner) error {

 	if newVal, err := c.DeepCopy(in.TypeMeta); err != nil {

 		return err

@@ -246,6 +259,39 @@ func deepCopy_v1_IsPersonalSubjectAccessReview(in v1.IsPersonalSubjectAccessRevi

 	return nil

 }

+func deepCopy_v1_LocalResourceAccessReview(in v1.LocalResourceAccessReview, out *v1.LocalResourceAccessReview, c *conversion.Cloner) error {

+	if newVal, err := c.DeepCopy(in.TypeMeta); err != nil {

+		return err

+	} else {

+		out.TypeMeta = newVal.(pkgapiv1.TypeMeta)

+	}

+	if err := deepCopy_v1_AuthorizationAttributes(in.AuthorizationAttributes, &out.AuthorizationAttributes, c); err != nil {

+		return err

+	}

+	return nil

+}

+

+func deepCopy_v1_LocalSubjectAccessReview(in v1.LocalSubjectAccessReview, out *v1.LocalSubjectAccessReview, c *conversion.Cloner) error {

+	if newVal, err := c.DeepCopy(in.TypeMeta); err != nil {

+		return err

+	} else {

+		out.TypeMeta = newVal.(pkgapiv1.TypeMeta)

+	}

+	if err := deepCopy_v1_AuthorizationAttributes(in.AuthorizationAttributes, &out.AuthorizationAttributes, c); err != nil {

+		return err

+	}

+	out.User = in.User

+	if in.GroupsSlice != nil {

+		out.GroupsSlice = make([]string, len(in.GroupsSlice))

+		for i := range in.GroupsSlice {

+			out.GroupsSlice[i] = in.GroupsSlice[i]

+		}

+	} else {

+		out.GroupsSlice = nil

+	}

+	return nil

+}

+

 func deepCopy_v1_NamedClusterRole(in v1.NamedClusterRole, out *v1.NamedClusterRole, c *conversion.Cloner) error {

 	out.Name = in.Name

 	if err := deepCopy_v1_ClusterRole(in.Role, &out.Role, c); err != nil {

@@ -436,14 +482,9 @@ func deepCopy_v1_ResourceAccessReview(in v1.ResourceAccessReview, out *v1.Resour

 	} else {

 		out.TypeMeta = newVal.(pkgapiv1.TypeMeta)

 	}

-	out.Verb = in.Verb

-	out.Resource = in.Resource

-	if newVal, err := c.DeepCopy(in.Content); err != nil {

+	if err := deepCopy_v1_AuthorizationAttributes(in.AuthorizationAttributes, &out.AuthorizationAttributes, c); err != nil {

 		return err

-	} else {

-		out.Content = newVal.(runtime.RawExtension)

 	}

-	out.ResourceName = in.ResourceName

 	return nil

 }

@@ -586,8 +627,9 @@ func deepCopy_v1_SubjectAccessReview(in v1.SubjectAccessReview, out *v1.SubjectA

 	} else {

 		out.TypeMeta = newVal.(pkgapiv1.TypeMeta)

 	}

-	out.Verb = in.Verb

-	out.Resource = in.Resource

+	if err := deepCopy_v1_AuthorizationAttributes(in.AuthorizationAttributes, &out.AuthorizationAttributes, c); err != nil {

+		return err

+	}

 	out.User = in.User

 	if in.GroupsSlice != nil {

 		out.GroupsSlice = make([]string, len(in.GroupsSlice))

@@ -597,12 +639,6 @@ func deepCopy_v1_SubjectAccessReview(in v1.SubjectAccessReview, out *v1.SubjectA

 	} else {

 		out.GroupsSlice = nil

 	}

-	if newVal, err := c.DeepCopy(in.Content); err != nil {

-		return err

-	} else {

-		out.Content = newVal.(runtime.RawExtension)

-	}

-	out.ResourceName = in.ResourceName

 	return nil

 }

@@ -2426,6 +2462,7 @@ func deepCopy_v1_UserList(in userapiv1.UserList, out *userapiv1.UserList, c *con

 func init() {

 	err := api.Scheme.AddGeneratedDeepCopyFuncs(

+		deepCopy_v1_AuthorizationAttributes,

 		deepCopy_v1_ClusterPolicy,

 		deepCopy_v1_ClusterPolicyBinding,

 		deepCopy_v1_ClusterPolicyBindingList,

@@ -2435,6 +2472,8 @@ func init() {

 		deepCopy_v1_ClusterRoleBindingList,

 		deepCopy_v1_ClusterRoleList,

 		deepCopy_v1_IsPersonalSubjectAccessReview,

+		deepCopy_v1_LocalResourceAccessReview,

+		deepCopy_v1_LocalSubjectAccessReview,

 		deepCopy_v1_NamedClusterRole,

 		deepCopy_v1_NamedClusterRoleBinding,

 		deepCopy_v1_NamedRole,

@@ -219,22 +219,6 @@ func convert_api_PolicyList_To_v1beta3_PolicyList(in *api.PolicyList, out *v1bet

 	return nil

 }

-func convert_api_ResourceAccessReview_To_v1beta3_ResourceAccessReview(in *api.ResourceAccessReview, out *v1beta3.ResourceAccessReview, s conversion.Scope) error {

-	if defaulting, found := s.DefaultingInterface(reflect.TypeOf(*in)); found {

-		defaulting.(func(*api.ResourceAccessReview))(in)

-	}

-	if err := convert_api_TypeMeta_To_v1beta3_TypeMeta(&in.TypeMeta, &out.TypeMeta, s); err != nil {

-		return err

-	}

-	out.Verb = in.Verb

-	out.Resource = in.Resource

-	if err := s.Convert(&in.Content, &out.Content, 0); err != nil {

-		return err

-	}

-	out.ResourceName = in.ResourceName

-	return nil

-}

-

 func convert_api_Role_To_v1beta3_Role(in *api.Role, out *v1beta3.Role, s conversion.Scope) error {

 	if defaulting, found := s.DefaultingInterface(reflect.TypeOf(*in)); found {

 		defaulting.(func(*api.Role))(in)

@@ -507,22 +491,6 @@ func convert_v1beta3_PolicyList_To_api_PolicyList(in *v1beta3.PolicyList, out *a

 	return nil

 }

-func convert_v1beta3_ResourceAccessReview_To_api_ResourceAccessReview(in *v1beta3.ResourceAccessReview, out *api.ResourceAccessReview, s conversion.Scope) error {

-	if defaulting, found := s.DefaultingInterface(reflect.TypeOf(*in)); found {

-		defaulting.(func(*v1beta3.ResourceAccessReview))(in)

-	}

-	if err := convert_v1beta3_TypeMeta_To_api_TypeMeta(&in.TypeMeta, &out.TypeMeta, s); err != nil {

-		return err

-	}

-	out.Verb = in.Verb

-	out.Resource = in.Resource

-	if err := s.Convert(&in.Content, &out.Content, 0); err != nil {

-		return err

-	}

-	out.ResourceName = in.ResourceName

-	return nil

-}

-

 func convert_v1beta3_Role_To_api_Role(in *v1beta3.Role, out *api.Role, s conversion.Scope) error {

 	if defaulting, found := s.DefaultingInterface(reflect.TypeOf(*in)); found {

 		defaulting.(func(*v1beta3.Role))(in)

@@ -3130,7 +3098,6 @@ func init() {

 		convert_api_ProjectSpec_To_v1beta3_ProjectSpec,

 		convert_api_ProjectStatus_To_v1beta3_ProjectStatus,

 		convert_api_Project_To_v1beta3_Project,

-		convert_api_ResourceAccessReview_To_v1beta3_ResourceAccessReview,

 		convert_api_ResourceRequirements_To_v1beta3_ResourceRequirements,

 		convert_api_RoleBindingList_To_v1beta3_RoleBindingList,

 		convert_api_RoleList_To_v1beta3_RoleList,

@@ -3206,7 +3173,6 @@ func init() {

 		convert_v1beta3_ProjectSpec_To_api_ProjectSpec,

 		convert_v1beta3_ProjectStatus_To_api_ProjectStatus,

 		convert_v1beta3_Project_To_api_Project,

-		convert_v1beta3_ResourceAccessReview_To_api_ResourceAccessReview,

 		convert_v1beta3_ResourceRequirements_To_api_ResourceRequirements,

 		convert_v1beta3_RoleBindingList_To_api_RoleBindingList,

 		convert_v1beta3_RoleList_To_api_RoleList,

@@ -19,6 +19,19 @@ import (

 	util "k8s.io/kubernetes/pkg/util"

 )

+func deepCopy_v1beta3_AuthorizationAttributes(in v1beta3.AuthorizationAttributes, out *v1beta3.AuthorizationAttributes, c *conversion.Cloner) error {

+	out.Namespace = in.Namespace

+	out.Verb = in.Verb

+	out.Resource = in.Resource

+	out.ResourceName = in.ResourceName

+	if newVal, err := c.DeepCopy(in.Content); err != nil {

+		return err

+	} else {

+		out.Content = newVal.(runtime.RawExtension)

+	}

+	return nil

+}

+

 func deepCopy_v1beta3_ClusterPolicy(in v1beta3.ClusterPolicy, out *v1beta3.ClusterPolicy, c *conversion.Cloner) error {

 	if newVal, err := c.DeepCopy(in.TypeMeta); err != nil {

 		return err

@@ -246,6 +259,39 @@ func deepCopy_v1beta3_IsPersonalSubjectAccessReview(in v1beta3.IsPersonalSubject

 	return nil

 }

+func deepCopy_v1beta3_LocalResourceAccessReview(in v1beta3.LocalResourceAccessReview, out *v1beta3.LocalResourceAccessReview, c *conversion.Cloner) error {

+	if newVal, err := c.DeepCopy(in.TypeMeta); err != nil {

+		return err

+	} else {

+		out.TypeMeta = newVal.(pkgapiv1beta3.TypeMeta)

+	}

+	if err := deepCopy_v1beta3_AuthorizationAttributes(in.AuthorizationAttributes, &out.AuthorizationAttributes, c); err != nil {

+		return err

+	}

+	return nil

+}

+

+func deepCopy_v1beta3_LocalSubjectAccessReview(in v1beta3.LocalSubjectAccessReview, out *v1beta3.LocalSubjectAccessReview, c *conversion.Cloner) error {

+	if newVal, err := c.DeepCopy(in.TypeMeta); err != nil {

+		return err

+	} else {

+		out.TypeMeta = newVal.(pkgapiv1beta3.TypeMeta)

+	}

+	if err := deepCopy_v1beta3_AuthorizationAttributes(in.AuthorizationAttributes, &out.AuthorizationAttributes, c); err != nil {

+		return err

+	}

+	out.User = in.User

+	if in.GroupsSlice != nil {

+		out.GroupsSlice = make([]string, len(in.GroupsSlice))

+		for i := range in.GroupsSlice {

+			out.GroupsSlice[i] = in.GroupsSlice[i]

+		}

+	} else {

+		out.GroupsSlice = nil

+	}

+	return nil

+}

+

 func deepCopy_v1beta3_NamedClusterRole(in v1beta3.NamedClusterRole, out *v1beta3.NamedClusterRole, c *conversion.Cloner) error {

 	out.Name = in.Name

 	if err := deepCopy_v1beta3_ClusterRole(in.Role, &out.Role, c); err != nil {

@@ -444,14 +490,9 @@ func deepCopy_v1beta3_ResourceAccessReview(in v1beta3.ResourceAccessReview, out

 	} else {

 		out.TypeMeta = newVal.(pkgapiv1beta3.TypeMeta)

 	}

-	out.Verb = in.Verb

-	out.Resource = in.Resource

-	if newVal, err := c.DeepCopy(in.Content); err != nil {

+	if err := deepCopy_v1beta3_AuthorizationAttributes(in.AuthorizationAttributes, &out.AuthorizationAttributes, c); err != nil {

 		return err

-	} else {

-		out.Content = newVal.(runtime.RawExtension)

 	}

-	out.ResourceName = in.ResourceName

 	return nil

 }

@@ -594,8 +635,9 @@ func deepCopy_v1beta3_SubjectAccessReview(in v1beta3.SubjectAccessReview, out *v

 	} else {

 		out.TypeMeta = newVal.(pkgapiv1beta3.TypeMeta)

 	}

-	out.Verb = in.Verb

-	out.Resource = in.Resource

+	if err := deepCopy_v1beta3_AuthorizationAttributes(in.AuthorizationAttributes, &out.AuthorizationAttributes, c); err != nil {

+		return err

+	}

 	out.User = in.User