@@ -420,6 +420,27 @@ message SubjectAccessReviewResponse {

   optional string evaluationError = 4;

 }

+// SubjectRulesReview is a resource you can create to determine which actions another user can perform in a namespace

+message SubjectRulesReview {

+  // Spec adds information about how to conduct the check

+  optional SubjectRulesReviewSpec spec = 1;

+

+  // Status is completed by the server to tell which permissions you have

+  optional SubjectRulesReviewStatus status = 2;

+}

+

+// SubjectRulesReviewSpec adds information about how to conduct the check

+message SubjectRulesReviewSpec {

+  // User is optional.  At least one of User and Groups must be specified.

+  optional string user = 1;

+

+  // Groups is optional.  Groups is the list of groups to which the User belongs.  At least one of User and Groups must be specified.

+  repeated string groups = 2;

+

+  // Scopes to use for the evaluation.  Empty means "use the unscoped (full) permissions of the user/groups".

+  optional OptionalScopes scopes = 3;

+}

+

 // SubjectRulesReviewStatus is contains the result of a rules check

 message SubjectRulesReviewStatus {

   // Rules is the list of rules (no particular sort) that are allowed for the subject

@@ -19299,7 +19299,7 @@

       "type": "v1.SubjectRulesReview",

       "method": "POST",

       "summary": "create a SubjectRulesReview",

-      "nickname": "createNamespacedSubjectRulesReview",

+      "nickname": "createSubjectRulesReviewForAllNamespaces",

       "parameters": [

        {

         "type": "string",

@@ -35873,6 +35873,56 @@

      }

     ]

    },

+   "/oapi/v1/namespaces/{namespace}/subjectrulesreviews": {

+    "post": {

+     "description": "create a SubjectRulesReview",

+     "consumes": [

+      "*/*"

+     ],

+     "produces": [

+      "application/json",

+      "application/yaml",

+      "application/vnd.kubernetes.protobuf"

+     ],

+     "schemes": [

+      "https"

+     ],

+     "operationId": "createNamespacedSubjectRulesReview",

+     "responses": {

+      "200": {

+       "description": "OK",

+       "schema": {

+        "$ref": "#/definitions/v1.SubjectRulesReview"

+       }

+      }

+     }

+    },

+    "parameters": [

+     {

+      "name": "body",

+      "in": "body",

+      "required": true,

+      "schema": {

+       "$ref": "#/definitions/v1.SubjectRulesReview"

+      }

+     },

+     {

+      "uniqueItems": true,

+      "type": "string",

+      "description": "object name and auth scope, such as for teams and projects",

+      "name": "namespace",

+      "in": "path",

+      "required": true

+     },

+     {

+      "uniqueItems": true,

+      "type": "string",

+      "description": "If 'true', then the output is pretty printed.",

+      "name": "pretty",

+      "in": "query"

+     }

+    ]

+   },

    "/oapi/v1/namespaces/{namespace}/templates": {

     "get": {

      "description": "list or watch objects of kind Template",

@@ -38980,6 +39030,48 @@

      }

     ]

    },

+   "/oapi/v1/subjectrulesreviews": {

+    "post": {

+     "description": "create a SubjectRulesReview",

+     "consumes": [

+      "*/*"

+     ],

+     "produces": [

+      "application/json",

+      "application/yaml",

+      "application/vnd.kubernetes.protobuf"

+     ],

+     "schemes": [

+      "https"

+     ],

+     "operationId": "createSubjectRulesReviewForAllNamespaces",

+     "responses": {

+      "200": {

+       "description": "OK",

+       "schema": {

+        "$ref": "#/definitions/v1.SubjectRulesReview"

+       }

+      }

+     }

+    },

+    "parameters": [

+     {

+      "name": "body",

+      "in": "body",

+      "required": true,

+      "schema": {

+       "$ref": "#/definitions/v1.SubjectRulesReview"

+      }

+     },

+     {

+      "uniqueItems": true,

+      "type": "string",

+      "description": "If 'true', then the output is pretty printed.",

+      "name": "pretty",

+      "in": "query"

+     }

+    ]

+   },

    "/oapi/v1/templates": {

     "get": {

      "description": "list or watch objects of kind Template",

@@ -52018,6 +52110,56 @@

      }

     }

    },

+   "v1.SubjectRulesReview": {

+    "description": "SubjectRulesReview is a resource you can create to determine which actions another user can perform in a namespace",

+    "required": [

+     "spec"

+    ],

+    "properties": {

+     "apiVersion": {

+      "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#resources",

+      "type": "string"

+     },

+     "kind": {

+      "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: http://releases.k8s.io/release-1.4/docs/devel/api-conventions.md#types-kinds",

+      "type": "string"

+     },

+     "spec": {

+      "$ref": "#/definitions/v1.SubjectRulesReviewSpec"

+     },

+     "status": {

+      "$ref": "#/definitions/v1.SubjectRulesReviewStatus"

+     }

+    }

+   },

+   "v1.SubjectRulesReviewSpec": {

+    "description": "SubjectRulesReviewSpec adds information about how to conduct the check",

+    "required": [

+     "user",

+     "groups",

+     "scopes"

+    ],

+    "properties": {

+     "groups": {

+      "description": "Groups is optional.  Groups is the list of groups to which the User belongs.  At least one of User and Groups must be specified.",

+      "type": "array",

+      "items": {

+       "type": "string"

+      }

+     },

+     "scopes": {

+      "description": "Scopes to use for the evaluation.  Empty means \"use the unscoped (full) permissions of the user/groups\".",

+      "type": "array",

+      "items": {

+       "type": "string"

+      }

+     },

+     "user": {

+      "description": "User is optional.  At least one of User and Groups must be specified.",

+      "type": "string"

+     }

+    }

+   },

    "v1.SubjectRulesReviewStatus": {

     "description": "SubjectRulesReviewStatus is contains the result of a rules check",

     "required": [

new file mode 100644

@@ -0,0 +1,7620 @@

+// Code generated by protoc-gen-gogo.

+// source: github.com/openshift/origin/pkg/authorization/api/v1/generated.proto

+// DO NOT EDIT!

+

+/*

+	Package v1 is a generated protocol buffer package.

+

+	It is generated from these files:

+		github.com/openshift/origin/pkg/authorization/api/v1/generated.proto

+

+	It has these top-level messages:

+		Action

+		ClusterPolicy

+		ClusterPolicyBinding

+		ClusterPolicyBindingList

+		ClusterPolicyList

+		ClusterRole

+		ClusterRoleBinding

+		ClusterRoleBindingList

+		ClusterRoleList

+		IsPersonalSubjectAccessReview

+		LocalResourceAccessReview

+		LocalSubjectAccessReview

+		NamedClusterRole

+		NamedClusterRoleBinding

+		NamedRole

+		NamedRoleBinding

+		OptionalNames

+		OptionalScopes

+		Policy

+		PolicyBinding

+		PolicyBindingList

+		PolicyList

+		PolicyRule

+		ResourceAccessReview

+		ResourceAccessReviewResponse

+		Role

+		RoleBinding

+		RoleBindingList

+		RoleList

+		SelfSubjectRulesReview

+		SelfSubjectRulesReviewSpec

+		SubjectAccessReview

+		SubjectAccessReviewResponse

+		SubjectRulesReview

+		SubjectRulesReviewSpec

+		SubjectRulesReviewStatus

+*/

+package v1

+

+import proto "github.com/gogo/protobuf/proto"

+import fmt "fmt"

+import math "math"

+

+import k8s_io_kubernetes_pkg_api_v1 "k8s.io/kubernetes/pkg/api/v1"

+

+import strings "strings"

+import reflect "reflect"

+

+import io "io"

+

+// Reference imports to suppress errors if they are not otherwise used.

+var _ = proto.Marshal

+var _ = fmt.Errorf

+var _ = math.Inf

+

+// This is a compile-time assertion to ensure that this generated file

+// is compatible with the proto package it is being compiled against.

+const _ = proto.GoGoProtoPackageIsVersion1

+

+func (m *Action) Reset()                    { *m = Action{} }

+func (*Action) ProtoMessage()               {}

+func (*Action) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{0} }

+

+func (m *ClusterPolicy) Reset()                    { *m = ClusterPolicy{} }

+func (*ClusterPolicy) ProtoMessage()               {}

+func (*ClusterPolicy) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{1} }

+

+func (m *ClusterPolicyBinding) Reset()                    { *m = ClusterPolicyBinding{} }

+func (*ClusterPolicyBinding) ProtoMessage()               {}

+func (*ClusterPolicyBinding) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{2} }

+

+func (m *ClusterPolicyBindingList) Reset()      { *m = ClusterPolicyBindingList{} }

+func (*ClusterPolicyBindingList) ProtoMessage() {}

+func (*ClusterPolicyBindingList) Descriptor() ([]byte, []int) {

+	return fileDescriptorGenerated, []int{3}

+}

+

+func (m *ClusterPolicyList) Reset()                    { *m = ClusterPolicyList{} }

+func (*ClusterPolicyList) ProtoMessage()               {}

+func (*ClusterPolicyList) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{4} }

+

+func (m *ClusterRole) Reset()                    { *m = ClusterRole{} }

+func (*ClusterRole) ProtoMessage()               {}

+func (*ClusterRole) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{5} }

+

+func (m *ClusterRoleBinding) Reset()                    { *m = ClusterRoleBinding{} }

+func (*ClusterRoleBinding) ProtoMessage()               {}

+func (*ClusterRoleBinding) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{6} }

+

+func (m *ClusterRoleBindingList) Reset()                    { *m = ClusterRoleBindingList{} }

+func (*ClusterRoleBindingList) ProtoMessage()               {}

+func (*ClusterRoleBindingList) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{7} }

+

+func (m *ClusterRoleList) Reset()                    { *m = ClusterRoleList{} }

+func (*ClusterRoleList) ProtoMessage()               {}

+func (*ClusterRoleList) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{8} }

+

+func (m *IsPersonalSubjectAccessReview) Reset()      { *m = IsPersonalSubjectAccessReview{} }

+func (*IsPersonalSubjectAccessReview) ProtoMessage() {}

+func (*IsPersonalSubjectAccessReview) Descriptor() ([]byte, []int) {

+	return fileDescriptorGenerated, []int{9}

+}

+

+func (m *LocalResourceAccessReview) Reset()      { *m = LocalResourceAccessReview{} }

+func (*LocalResourceAccessReview) ProtoMessage() {}

+func (*LocalResourceAccessReview) Descriptor() ([]byte, []int) {

+	return fileDescriptorGenerated, []int{10}

+}

+

+func (m *LocalSubjectAccessReview) Reset()      { *m = LocalSubjectAccessReview{} }

+func (*LocalSubjectAccessReview) ProtoMessage() {}

+func (*LocalSubjectAccessReview) Descriptor() ([]byte, []int) {

+	return fileDescriptorGenerated, []int{11}

+}

+

+func (m *NamedClusterRole) Reset()                    { *m = NamedClusterRole{} }

+func (*NamedClusterRole) ProtoMessage()               {}

+func (*NamedClusterRole) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{12} }

+

+func (m *NamedClusterRoleBinding) Reset()      { *m = NamedClusterRoleBinding{} }

+func (*NamedClusterRoleBinding) ProtoMessage() {}

+func (*NamedClusterRoleBinding) Descriptor() ([]byte, []int) {

+	return fileDescriptorGenerated, []int{13}

+}

+

+func (m *NamedRole) Reset()                    { *m = NamedRole{} }

+func (*NamedRole) ProtoMessage()               {}

+func (*NamedRole) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{14} }

+

+func (m *NamedRoleBinding) Reset()                    { *m = NamedRoleBinding{} }

+func (*NamedRoleBinding) ProtoMessage()               {}

+func (*NamedRoleBinding) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{15} }

+

+func (m *OptionalNames) Reset()                    { *m = OptionalNames{} }

+func (*OptionalNames) ProtoMessage()               {}

+func (*OptionalNames) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{16} }

+

+func (m *OptionalScopes) Reset()                    { *m = OptionalScopes{} }

+func (*OptionalScopes) ProtoMessage()               {}

+func (*OptionalScopes) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{17} }

+

+func (m *Policy) Reset()                    { *m = Policy{} }

+func (*Policy) ProtoMessage()               {}

+func (*Policy) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{18} }

+

+func (m *PolicyBinding) Reset()                    { *m = PolicyBinding{} }

+func (*PolicyBinding) ProtoMessage()               {}

+func (*PolicyBinding) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{19} }

+

+func (m *PolicyBindingList) Reset()                    { *m = PolicyBindingList{} }

+func (*PolicyBindingList) ProtoMessage()               {}

+func (*PolicyBindingList) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{20} }

+

+func (m *PolicyList) Reset()                    { *m = PolicyList{} }

+func (*PolicyList) ProtoMessage()               {}

+func (*PolicyList) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{21} }

+

+func (m *PolicyRule) Reset()                    { *m = PolicyRule{} }

+func (*PolicyRule) ProtoMessage()               {}

+func (*PolicyRule) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{22} }

+

+func (m *ResourceAccessReview) Reset()                    { *m = ResourceAccessReview{} }

+func (*ResourceAccessReview) ProtoMessage()               {}

+func (*ResourceAccessReview) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{23} }

+

+func (m *ResourceAccessReviewResponse) Reset()      { *m = ResourceAccessReviewResponse{} }

+func (*ResourceAccessReviewResponse) ProtoMessage() {}

+func (*ResourceAccessReviewResponse) Descriptor() ([]byte, []int) {

+	return fileDescriptorGenerated, []int{24}

+}

+

+func (m *Role) Reset()                    { *m = Role{} }

+func (*Role) ProtoMessage()               {}

+func (*Role) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{25} }

+

+func (m *RoleBinding) Reset()                    { *m = RoleBinding{} }

+func (*RoleBinding) ProtoMessage()               {}

+func (*RoleBinding) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{26} }

+

+func (m *RoleBindingList) Reset()                    { *m = RoleBindingList{} }

+func (*RoleBindingList) ProtoMessage()               {}

+func (*RoleBindingList) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{27} }

+

+func (m *RoleList) Reset()                    { *m = RoleList{} }

+func (*RoleList) ProtoMessage()               {}

+func (*RoleList) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{28} }

+

+func (m *SelfSubjectRulesReview) Reset()                    { *m = SelfSubjectRulesReview{} }

+func (*SelfSubjectRulesReview) ProtoMessage()               {}

+func (*SelfSubjectRulesReview) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{29} }

+

+func (m *SelfSubjectRulesReviewSpec) Reset()      { *m = SelfSubjectRulesReviewSpec{} }

+func (*SelfSubjectRulesReviewSpec) ProtoMessage() {}

+func (*SelfSubjectRulesReviewSpec) Descriptor() ([]byte, []int) {

+	return fileDescriptorGenerated, []int{30}

+}

+

+func (m *SubjectAccessReview) Reset()                    { *m = SubjectAccessReview{} }

+func (*SubjectAccessReview) ProtoMessage()               {}

+func (*SubjectAccessReview) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{31} }

+

+func (m *SubjectAccessReviewResponse) Reset()      { *m = SubjectAccessReviewResponse{} }

+func (*SubjectAccessReviewResponse) ProtoMessage() {}

+func (*SubjectAccessReviewResponse) Descriptor() ([]byte, []int) {

+	return fileDescriptorGenerated, []int{32}

+}

+

+func (m *SubjectRulesReview) Reset()                    { *m = SubjectRulesReview{} }

+func (*SubjectRulesReview) ProtoMessage()               {}

+func (*SubjectRulesReview) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{33} }

+

+func (m *SubjectRulesReviewSpec) Reset()                    { *m = SubjectRulesReviewSpec{} }

+func (*SubjectRulesReviewSpec) ProtoMessage()               {}

+func (*SubjectRulesReviewSpec) Descriptor() ([]byte, []int) { return fileDescriptorGenerated, []int{34} }

+

+func (m *SubjectRulesReviewStatus) Reset()      { *m = SubjectRulesReviewStatus{} }

+func (*SubjectRulesReviewStatus) ProtoMessage() {}

+func (*SubjectRulesReviewStatus) Descriptor() ([]byte, []int) {

+	return fileDescriptorGenerated, []int{35}

+}

+

+func init() {

+	proto.RegisterType((*Action)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.Action")

+	proto.RegisterType((*ClusterPolicy)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.ClusterPolicy")

+	proto.RegisterType((*ClusterPolicyBinding)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.ClusterPolicyBinding")

+	proto.RegisterType((*ClusterPolicyBindingList)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.ClusterPolicyBindingList")

+	proto.RegisterType((*ClusterPolicyList)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.ClusterPolicyList")

+	proto.RegisterType((*ClusterRole)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.ClusterRole")

+	proto.RegisterType((*ClusterRoleBinding)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.ClusterRoleBinding")

+	proto.RegisterType((*ClusterRoleBindingList)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.ClusterRoleBindingList")

+	proto.RegisterType((*ClusterRoleList)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.ClusterRoleList")

+	proto.RegisterType((*IsPersonalSubjectAccessReview)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.IsPersonalSubjectAccessReview")

+	proto.RegisterType((*LocalResourceAccessReview)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.LocalResourceAccessReview")

+	proto.RegisterType((*LocalSubjectAccessReview)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.LocalSubjectAccessReview")

+	proto.RegisterType((*NamedClusterRole)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.NamedClusterRole")

+	proto.RegisterType((*NamedClusterRoleBinding)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.NamedClusterRoleBinding")

+	proto.RegisterType((*NamedRole)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.NamedRole")

+	proto.RegisterType((*NamedRoleBinding)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.NamedRoleBinding")

+	proto.RegisterType((*OptionalNames)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.OptionalNames")

+	proto.RegisterType((*OptionalScopes)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.OptionalScopes")

+	proto.RegisterType((*Policy)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.Policy")

+	proto.RegisterType((*PolicyBinding)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.PolicyBinding")

+	proto.RegisterType((*PolicyBindingList)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.PolicyBindingList")

+	proto.RegisterType((*PolicyList)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.PolicyList")

+	proto.RegisterType((*PolicyRule)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.PolicyRule")

+	proto.RegisterType((*ResourceAccessReview)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.ResourceAccessReview")

+	proto.RegisterType((*ResourceAccessReviewResponse)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.ResourceAccessReviewResponse")

+	proto.RegisterType((*Role)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.Role")

+	proto.RegisterType((*RoleBinding)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.RoleBinding")

+	proto.RegisterType((*RoleBindingList)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.RoleBindingList")

+	proto.RegisterType((*RoleList)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.RoleList")

+	proto.RegisterType((*SelfSubjectRulesReview)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.SelfSubjectRulesReview")

+	proto.RegisterType((*SelfSubjectRulesReviewSpec)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.SelfSubjectRulesReviewSpec")

+	proto.RegisterType((*SubjectAccessReview)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.SubjectAccessReview")

+	proto.RegisterType((*SubjectAccessReviewResponse)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.SubjectAccessReviewResponse")

+	proto.RegisterType((*SubjectRulesReview)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.SubjectRulesReview")

+	proto.RegisterType((*SubjectRulesReviewSpec)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.SubjectRulesReviewSpec")

+	proto.RegisterType((*SubjectRulesReviewStatus)(nil), "github.com.openshift.origin.pkg.authorization.api.v1.SubjectRulesReviewStatus")

+}

+func (m *Action) Marshal() (data []byte, err error) {

+	size := m.Size()

+	data = make([]byte, size)

+	n, err := m.MarshalTo(data)

+	if err != nil {

+		return nil, err

+	}

+	return data[:n], nil

+}

+

+func (m *Action) MarshalTo(data []byte) (int, error) {

+	var i int

+	_ = i

+	var l int

+	_ = l

+	data[i] = 0xa

+	i++

+	i = encodeVarintGenerated(data, i, uint64(len(m.Namespace)))

+	i += copy(data[i:], m.Namespace)

+	data[i] = 0x12

+	i++

+	i = encodeVarintGenerated(data, i, uint64(len(m.Verb)))

+	i += copy(data[i:], m.Verb)

+	data[i] = 0x1a

+	i++

+	i = encodeVarintGenerated(data, i, uint64(len(m.Group)))

+	i += copy(data[i:], m.Group)

+	data[i] = 0x22

+	i++

+	i = encodeVarintGenerated(data, i, uint64(len(m.Version)))

+	i += copy(data[i:], m.Version)

+	data[i] = 0x2a

+	i++

+	i = encodeVarintGenerated(data, i, uint64(len(m.Resource)))

+	i += copy(data[i:], m.Resource)

+	data[i] = 0x32

+	i++

+	i = encodeVarintGenerated(data, i, uint64(len(m.ResourceName)))

+	i += copy(data[i:], m.ResourceName)

+	data[i] = 0x3a

+	i++

+	i = encodeVarintGenerated(data, i, uint64(m.Content.Size()))

+	n1, err := m.Content.MarshalTo(data[i:])

+	if err != nil {

+		return 0, err

+	}

+	i += n1

+	return i, nil

+}

+

+func (m *ClusterPolicy) Marshal() (data []byte, err error) {

+	size := m.Size()

+	data = make([]byte, size)

+	n, err := m.MarshalTo(data)

+	if err != nil {

+		return nil, err

+	}

+	return data[:n], nil

+}

+

+func (m *ClusterPolicy) MarshalTo(data []byte) (int, error) {

+	var i int

+	_ = i

+	var l int

+	_ = l

+	data[i] = 0xa

+	i++

+	i = encodeVarintGenerated(data, i, uint64(m.ObjectMeta.Size()))

+	n2, err := m.ObjectMeta.MarshalTo(data[i:])

+	if err != nil {

+		return 0, err

+	}

+	i += n2

+	data[i] = 0x12

+	i++

+	i = encodeVarintGenerated(data, i, uint64(m.LastModified.Size()))

+	n3, err := m.LastModified.MarshalTo(data[i:])

+	if err != nil {

+		return 0, err

+	}

+	i += n3

+	if len(m.Roles) > 0 {

+		for _, msg := range m.Roles {

+			data[i] = 0x1a

+			i++

+			i = encodeVarintGenerated(data, i, uint64(msg.Size()))

+			n, err := msg.MarshalTo(data[i:])

+			if err != nil {

+				return 0, err

+			}

+			i += n

+		}

+	}

+	return i, nil

+}

+

+func (m *ClusterPolicyBinding) Marshal() (data []byte, err error) {

+	size := m.Size()

+	data = make([]byte, size)

+	n, err := m.MarshalTo(data)

+	if err != nil {

+		return nil, err

+	}

+	return data[:n], nil

+}

+

+func (m *ClusterPolicyBinding) MarshalTo(data []byte) (int, error) {

+	var i int

+	_ = i

+	var l int

+	_ = l

+	data[i] = 0xa

+	i++

+	i = encodeVarintGenerated(data, i, uint64(m.ObjectMeta.Size()))

+	n4, err := m.ObjectMeta.MarshalTo(data[i:])

+	if err != nil {

+		return 0, err

+	}

+	i += n4

+	data[i] = 0x12

+	i++

+	i = encodeVarintGenerated(data, i, uint64(m.LastModified.Size()))

+	n5, err := m.LastModified.MarshalTo(data[i:])

+	if err != nil {

+		return 0, err

+	}

+	i += n5

+	data[i] = 0x1a

+	i++

+	i = encodeVarintGenerated(data, i, uint64(m.PolicyRef.Size()))

+	n6, err := m.PolicyRef.MarshalTo(data[i:])

+	if err != nil {

+		return 0, err

+	}

+	i += n6

+	if len(m.RoleBindings) > 0 {

+		for _, msg := range m.RoleBindings {

+			data[i] = 0x22

+			i++

+			i = encodeVarintGenerated(data, i, uint64(msg.Size()))

+			n, err := msg.MarshalTo(data[i:])

+			if err != nil {

+				return 0, err

+			}

+			i += n

+		}

+	}

+	return i, nil

+}

+

+func (m *ClusterPolicyBindingList) Marshal() (data []byte, err error) {

+	size := m.Size()

+	data = make([]byte, size)

+	n, err := m.MarshalTo(data)

+	if err != nil {

+		return nil, err

+	}

+	return data[:n], nil

+}

+

+func (m *ClusterPolicyBindingList) MarshalTo(data []byte) (int, error) {

+	var i int

+	_ = i

+	var l int

+	_ = l

+	data[i] = 0xa

+	i++

+	i = encodeVarintGenerated(data, i, uint64(m.ListMeta.Size()))

+	n7, err := m.ListMeta.MarshalTo(data[i:])

+	if err != nil {

+		return 0, err

+	}

+	i += n7

+	if len(m.Items) > 0 {

+		for _, msg := range m.Items {

+			data[i] = 0x12

+			i++

+			i = encodeVarintGenerated(data, i, uint64(msg.Size()))

+			n, err := msg.MarshalTo(data[i:])

+			if err != nil {

+				return 0, err

+			}

+			i += n

+		}

+	}

+	return i, nil

+}

+

+func (m *ClusterPolicyList) Marshal() (data []byte, err error) {

+	size := m.Size()

+	data = make([]byte, size)

+	n, err := m.MarshalTo(data)

+	if err != nil {

+		return nil, err

+	}

+	return data[:n], nil

+}

+

+func (m *ClusterPolicyList) MarshalTo(data []byte) (int, error) {

+	var i int

+	_ = i

+	var l int

+	_ = l

+	data[i] = 0xa

+	i++

+	i = encodeVarintGenerated(data, i, uint64(m.ListMeta.Size()))

+	n8, err := m.ListMeta.MarshalTo(data[i:])

+	if err != nil {

+		return 0, err

+	}

+	i += n8

+	if len(m.Items) > 0 {

+		for _, msg := range m.Items {

+			data[i] = 0x12

+			i++

+			i = encodeVarintGenerated(data, i, uint64(msg.Size()))

+			n, err := msg.MarshalTo(data[i:])

+			if err != nil {

+				return 0, err

+			}

+			i += n

+		}

+	}

+	return i, nil

+}

+

+func (m *ClusterRole) Marshal() (data []byte, err error) {

+	size := m.Size()

+	data = make([]byte, size)

+	n, err := m.MarshalTo(data)

+	if err != nil {

+		return nil, err

+	}

+	return data[:n], nil

+}

+

+func (m *ClusterRole) MarshalTo(data []byte) (int, error) {

+	var i int

+	_ = i

+	var l int

+	_ = l

+	data[i] = 0xa

+	i++

+	i = encodeVarintGenerated(data, i, uint64(m.ObjectMeta.Size()))

+	n9, err := m.ObjectMeta.MarshalTo(data[i:])

+	if err != nil {

+		return 0, err

+	}

+	i += n9

+	if len(m.Rules) > 0 {

+		for _, msg := range m.Rules {

+			data[i] = 0x12

+			i++

+			i = encodeVarintGenerated(data, i, uint64(msg.Size()))

+			n, err := msg.MarshalTo(data[i:])

+			if err != nil {

+				return 0, err

+			}

+			i += n

+		}

+	}

+	return i, nil

+}

+

+func (m *ClusterRoleBinding) Marshal() (data []byte, err error) {

+	size := m.Size()

+	data = make([]byte, size)

+	n, err := m.MarshalTo(data)

+	if err != nil {

+		return nil, err

+	}

+	return data[:n], nil

+}

+

+func (m *ClusterRoleBinding) MarshalTo(data []byte) (int, error) {

+	var i int

+	_ = i

+	var l int

+	_ = l

+	data[i] = 0xa

+	i++

+	i = encodeVarintGenerated(data, i, uint64(m.ObjectMeta.Size()))

+	n10, err := m.ObjectMeta.MarshalTo(data[i:])

+	if err != nil {

+		return 0, err

+	}

+	i += n10

+	if m.UserNames != nil {

+		data[i] = 0x12

+		i++

+		i = encodeVarintGenerated(data, i, uint64(m.UserNames.Size()))

+		n11, err := m.UserNames.MarshalTo(data[i:])

+		if err != nil {

+			return 0, err

+		}

+		i += n11

+	}

+	if m.GroupNames != nil {

+		data[i] = 0x1a

+		i++

+		i = encodeVarintGenerated(data, i, uint64(m.GroupNames.Size()))

+		n12, err := m.GroupNames.MarshalTo(data[i:])

+		if err != nil {

+			return 0, err

+		}

+		i += n12

+	}

+	if len(m.Subjects) > 0 {

+		for _, msg := range m.Subjects {

+			data[i] = 0x22

+			i++

+			i = encodeVarintGenerated(data, i, uint64(msg.Size()))

+			n, err := msg.MarshalTo(data[i:])

+			if err != nil {

+				return 0, err

+			}

+			i += n

+		}

+	}

+	data[i] = 0x2a

+	i++

+	i = encodeVarintGenerated(data, i, uint64(m.RoleRef.Size()))

+	n13, err := m.RoleRef.MarshalTo(data[i:])

+	if err != nil {

+		return 0, err

+	}

+	i += n13

+	return i, nil

+}

+

+func (m *ClusterRoleBindingList) Marshal() (data []byte, err error) {

+	size := m.Size()

+	data = make([]byte, size)

+	n, err := m.MarshalTo(data)

+	if err != nil {

+		return nil, err

+	}

+	return data[:n], nil

+}

+

+func (m *ClusterRoleBindingList) MarshalTo(data []byte) (int, error) {

+	var i int

+	_ = i

+	var l int

+	_ = l

+	data[i] = 0xa

+	i++

+	i = encodeVarintGenerated(data, i, uint64(m.ListMeta.Size()))

+	n14, err := m.ListMeta.MarshalTo(data[i:])

+	if err != nil {

+		return 0, err

+	}

+	i += n14

+	if len(m.Items) > 0 {

+		for _, msg := range m.Items {

+			data[i] = 0x12

+			i++

+			i = encodeVarintGenerated(data, i, uint64(msg.Size()))

+			n, err := msg.MarshalTo(data[i:])

+			if err != nil {

+				return 0, err

+			}

+			i += n

+		}

+	}

+	return i, nil

+}

+

+func (m *ClusterRoleList) Marshal() (data []byte, err error) {

+	size := m.Size()

+	data = make([]byte, size)

+	n, err := m.MarshalTo(data)

+	if err != nil {

+		return nil, err

+	}

+	return data[:n], nil

+}

+

+func (m *ClusterRoleList) MarshalTo(data []byte) (int, error) {

+	var i int

+	_ = i

+	var l int

+	_ = l

+	data[i] = 0xa

+	i++

+	i = encodeVarintGenerated(data, i, uint64(m.ListMeta.Size()))

+	n15, err := m.ListMeta.MarshalTo(data[i:])

+	if err != nil {

+		return 0, err

+	}

+	i += n15

+	if len(m.Items) > 0 {

+		for _, msg := range m.Items {

+			data[i] = 0x12

+			i++

+			i = encodeVarintGenerated(data, i, uint64(msg.Size()))

+			n, err := msg.MarshalTo(data[i:])

+			if err != nil {

+				return 0, err

+			}

+			i += n

+		}

+	}

+	return i, nil

+}

+

+func (m *IsPersonalSubjectAccessReview) Marshal() (data []byte, err error) {

+	size := m.Size()