diff --git a/cmd/cue/cmd/get_go.go b/cmd/cue/cmd/get_go.go
index be8ea78..7891980 100644
--- a/cmd/cue/cmd/get_go.go
+++ b/cmd/cue/cmd/get_go.go
@@ -30,6 +30,7 @@
 	"sort"
 	"strconv"
 	"strings"
+	"unicode"
 
 	"github.com/spf13/cobra"
 	"golang.org/x/tools/go/packages"
@@ -90,7 +91,7 @@
 
 	  translates to the CUE struct
 
-		 MyStruct: Common & {
+		 #MyStruct: Common & {
 			 Field: string
 		 }
 
@@ -139,7 +140,7 @@
 	package foo
 
 	// IP4String defines a valid IP4 address.
-	IP4String: =~#"^\#(byte)\.\#(byte)\.\#(byte)\.\#(byte)$"#
+	#IP4String: =~#"^\#(byte)\.\#(byte)\.\#(byte)\.\#(byte)$"#
 
 	// byte defines string allowing integer values of 0-255.
 	byte = #"([01]?\d?\d|2[0-4]\d|25[0-5])"#
@@ -178,7 +179,7 @@
 
 	package foo
 
-	Switch: int // enumSwitch
+	#Switch: int // enumSwitch
 
 	enumSwitch: Off | On
 
@@ -195,7 +196,7 @@
 
 	// limit the valid values for Switch to those existing as constants with
 	// the same type.
-	Switch: enumSwitch
+	#Switch: enumSwitch
 
 This tells CUE that only the values enumerated by enumSwitch are valid
 values for Switch. Note that there are now two definitions of Switch.
@@ -446,7 +447,7 @@
 		}
 		sort.Strings(pkgs)
 
-		pkg := &cueast.Package{Name: e.ident(p.Name)}
+		pkg := &cueast.Package{Name: e.ident(p.Name, false)}
 		addDoc(f.Doc, pkg)
 
 		f := &cueast.File{Decls: []cueast.Decl{
@@ -464,7 +465,7 @@
 				info := e.pkgNames[s]
 				spec := cueast.NewImport(nil, info.id)
 				if p.Imports[s].Name != info.name {
-					spec.Name = e.ident(info.name)
+					spec.Name = e.ident(info.name, false)
 				}
 				imports.Specs = append(imports.Specs, spec)
 			}
@@ -562,14 +563,20 @@
 	return cueast.NewString(name)
 }
 
-func (e *extractor) ident(name string) *cueast.Ident {
+func (e *extractor) ident(name string, isDef bool) *cueast.Ident {
+	if isDef {
+		r := []rune(name)[0]
+		name = "#" + name
+		if !unicode.Is(unicode.Lu, r) {
+			name = "_" + name
+		}
+	}
 	return cueast.NewIdent(name)
 }
 
 func (e *extractor) def(doc *ast.CommentGroup, name string, value cueast.Expr, newline bool) *cueast.Field {
 	f := &cueast.Field{
-		Label: e.ident(name), // Go identifiers are always valid CUE identifiers.
-		Token: cuetoken.ISA,
+		Label: e.ident(name, true), // Go identifiers are always valid CUE identifiers.
 		Value: value,
 	}
 	addDoc(doc, f)
@@ -619,17 +626,24 @@
 			}
 
 			if len(enums) > 0 {
-				enumName := "enum" + name
-				a[len(a)-1].AddComment(internal.NewComment(false, enumName))
+				enumName := "#enum" + name
+				cueast.AddComment(a[len(a)-1], internal.NewComment(false, enumName))
 
-				var x cueast.Expr = e.ident(enums[0])
+				// Constants are mapped as definitions.
+				var x cueast.Expr = e.ident(enums[0], true)
 				cueast.SetRelPos(x, cuetoken.Newline)
 				for _, v := range enums[1:] {
-					y := e.ident(v)
+					y := e.ident(v, true)
 					cueast.SetRelPos(y, cuetoken.Newline)
 					x = cueast.NewBinExpr(cuetoken.OR, x, y)
 				}
-				a = append(a, e.def(nil, enumName, x, true))
+				// a = append(a, e.def(nil, enumName, x, true))
+				f := &cueast.Field{
+					Label: cueast.NewIdent(enumName),
+					Value: x,
+				}
+				a = append(a, f)
+				cueast.SetRelPos(f, cuetoken.NewSection)
 			}
 		}
 
@@ -703,7 +717,7 @@
 		if types.Implements(typ, i) || types.Implements(ptr, i) {
 			t := shortTypeName(typ)
 			e.logf("    %v implements %s; setting type to _", t, x)
-			return e.ident("_")
+			return e.ident("_", false)
 		}
 	}
 	for _, x := range toString {
@@ -711,7 +725,7 @@
 		if types.Implements(typ, i) || types.Implements(ptr, i) {
 			t := shortTypeName(typ)
 			e.logf("    %v implements %s; setting type to string", t, x)
-			return e.ident("string")
+			return e.ident("string", false)
 		}
 	}
 	return nil
@@ -862,11 +876,11 @@
 	typ := e.makeType(expr)
 	var label cueast.Label
 	if kind == cuetoken.ISA {
-		label = e.ident(name)
+		label = e.ident(name, true)
 	} else {
 		label = e.strLabel(name)
 	}
-	f = &cueast.Field{Label: label, Token: kind, Value: typ}
+	f = &cueast.Field{Label: label, Value: typ}
 	if doc := makeDoc(doc, newline); doc != nil {
 		f.AddComment(doc)
 		cueast.SetRelPos(doc, cuetoken.NewSection)
@@ -884,7 +898,7 @@
 	if x, ok := expr.(*types.Named); ok {
 		obj := x.Obj()
 		if obj.Pkg() == nil {
-			return e.ident("_")
+			return e.ident("_", false)
 		}
 		// Check for builtin packages.
 		// TODO: replace these literal types with a reference to the fixed
@@ -892,11 +906,12 @@
 		switch obj.Type().String() {
 		case "time.Time":
 			e.usedInFile["time"] = true
-			ref := e.ident(e.pkgNames[obj.Pkg().Path()].name)
+			ref := e.ident(e.pkgNames[obj.Pkg().Path()].name, false)
+			ref.Node = cueast.NewImport(nil, "time")
 			return cueast.NewSel(ref, obj.Name())
 
 		case "math/big.Int":
-			return e.ident("int")
+			return e.ident("int", false)
 
 		default:
 			if !strings.ContainsAny(obj.Pkg().Path(), ".") {
@@ -908,10 +923,16 @@
 				}
 			}
 		}
-		result = e.ident(obj.Name())
+
+		result = e.ident(obj.Name(), true)
 		if pkg := obj.Pkg(); pkg != nil {
 			if info := e.pkgNames[pkg.Path()]; info.name != "" {
-				result = cueast.NewSel(e.ident(info.name), obj.Name())
+				p := e.ident(info.name, false)
+				// TODO: set package name et. at.
+				p.Node = cueast.NewImport(nil, pkg.Path())
+				// makeType is always called to describe a type, so whatever
+				// this is referring to, it must be a definition.
+				result = cueast.NewSel(p, "#"+obj.Name())
 				e.usedPkg(pkg.Path())
 			}
 		}
@@ -921,7 +942,7 @@
 	switch x := expr.(type) {
 	case *types.Pointer:
 		return &cueast.BinaryExpr{
-			X:  e.ident("null"),
+			X:  e.ident("null", false),
 			Op: cuetoken.OR,
 			Y:  e.makeType(x.Elem()),
 		}
@@ -938,7 +959,7 @@
 		// TODO: should this be x.Elem().Underlying().String()? One could
 		// argue either way.
 		if x.Elem().String() == "byte" {
-			return e.ident("bytes")
+			return e.ident("bytes", false)
 		}
 		return cueast.NewList(&cueast.Ellipsis{Type: e.makeType(x.Elem())})
 
@@ -949,7 +970,7 @@
 			//     fmt.Fprint(e.w, fmt.Sprintf("=~ '^\C{%d}$'", x.Len())),
 			// but regexp does not support that.
 			// But translate to bytes, instead of [...byte] to be consistent.
-			return e.ident("bytes")
+			return e.ident("bytes", false)
 		} else {
 			return &cueast.BinaryExpr{
 				X: &cueast.BasicLit{
@@ -967,7 +988,7 @@
 		}
 
 		f := &cueast.Field{
-			Label: cueast.NewList(e.ident("string")),
+			Label: cueast.NewList(e.ident("string", false)),
 			Value: e.makeType(x.Elem()),
 		}
 		cueast.SetRelPos(f, cuetoken.Blank)
@@ -978,10 +999,10 @@
 		}
 
 	case *types.Basic:
-		return e.ident(x.String())
+		return e.ident(x.String(), false)
 
 	case *types.Interface:
-		return e.ident("_")
+		return e.ident("_", false)
 
 	default:
 		// record error
@@ -1062,13 +1083,17 @@
 		}
 		typeName = strings.Replace(typeName, e.pkg.Types.Path()+".", "", -1)
 
+		cueStr := strings.Replace(cueType, "_#", "", -1)
+		cueStr = strings.Replace(cueStr, "#", "", -1)
+
 		// TODO: remove fields in @go attr that are the same as printed?
-		if name != f.Name() || typeName != cueType {
+		if name != f.Name() || typeName != cueStr {
 			buf := &strings.Builder{}
 			if name != f.Name() {
 				buf.WriteString(f.Name())
 			}
-			if typeName != cueType {
+
+			if typeName != cueStr {
 				if strings.ContainsAny(typeName, `#"',()=`) {
 					typeName = strconv.Quote(typeName)
 				}
diff --git a/cmd/cue/cmd/testdata/pkg/cuelang.org/go/cmd/cue/cmd/testdata/code/go/pkg1/file1_go_gen.cue b/cmd/cue/cmd/testdata/pkg/cuelang.org/go/cmd/cue/cmd/testdata/code/go/pkg1/file1_go_gen.cue
index abf6b27..3e1cdd5 100644
--- a/cmd/cue/cmd/testdata/pkg/cuelang.org/go/cmd/cue/cmd/testdata/code/go/pkg1/file1_go_gen.cue
+++ b/cmd/cue/cmd/testdata/pkg/cuelang.org/go/cmd/cue/cmd/testdata/code/go/pkg1/file1_go_gen.cue
@@ -11,69 +11,69 @@
 )
 
 // Foozer foozes a jaman.
-Foozer :: {
+#Foozer: {
 	Int:    int
 	String: string
 
-	Inline
-	"NoInline":    NoInline
-	"CustomJSON":  CustomJSON
-	"CustomYAML"?: null | CustomYAML @go(,*CustomYAML)
-	AnyJSON:       _                 @go(,json.Marshaler)
-	AnyText:       string            @go(,encoding.TextMarshaler)
-	bar?:          int               @go(Bar)
+	#Inline
+	NoInline:    #NoInline
+	CustomJSON:  #CustomJSON
+	CustomYAML?: null | #CustomYAML @go(,*CustomYAML)
+	AnyJSON:     _                  @go(,json.Marshaler)
+	AnyText:     string             @go(,encoding.TextMarshaler)
+	bar?:        int                @go(Bar)
 
 	// Time is mapped to CUE's internal type.
 	Time:   time.Time
-	Barzer: p2.Barzer
-	Map: {[string]: null | CustomJSON} @go(,map[string]*CustomJSON)
+	Barzer: p2.#Barzer
+	Map: {[string]: null | #CustomJSON} @go(,map[string]*CustomJSON)
 	Slice1: [...int] @go(,[]int)
 	Slice2: [...] @go(,[]interface{})
 	Slice3?: null | [...] @go(,*[]json.Unmarshaler)
 	Array1:  5 * [int]    @go(,[5]int)
 	Array2:  5 * [_]      @go(,[5]interface{})
 	Array3?: null | 5*[_] @go(,*[5]json.Marshaler)
-	Intf:    Interface    @protobuf(2,varint,name=intf)
+	Intf:    #Interface   @protobuf(2,varint,name=intf)
 	Intf2:   _            @go(,interface{})
 	Intf3: {
-		"Interface": Interface
+		Interface: #Interface
 	} @go(,struct{Interface})
 	Intf4: _ @go(,"interface{Foo()}")
 
 	// Even though this struct as a type implements MarshalJSON, it is known
 	// that it is really only implemented by the embedded field.
 	Embed: {
-		"CustomJSON": CustomJSON
+		CustomJSON: #CustomJSON
 	} @go(,struct{CustomJSON})
 }
 
 // Level gives an indication of the extent of stuff.
-Level :: int // enumLevel
+#Level: int // #enumLevel
 
-enumLevel ::
-	Unknown |
-	Low |
-	Medium |
-	High
+#enumLevel:
+	#Unknown |
+	#Low |
+	#Medium |
+	#High
 
 // Block comment.
 //  Indented.
 //
 // Empty line before.
-Unknown :: Level & 0
-Low ::     Level & 1
+#Unknown: #Level & 0
+#Low:     #Level & 1
 
 // Medium is neither High nor Low
-Medium :: Level & 2
-High ::   Level & 3
+#Medium: #Level & 2
+#High:   #Level & 3
 
-CustomJSON :: _
+#CustomJSON: _
 
-CustomYAML :: {
+#CustomYAML: {
 }
 
-Inline :: Kind: string
+#Inline: Kind: string
 
-NoInline :: Kind: string
+#NoInline: Kind: string
 
-Interface :: _
+#Interface: _
diff --git a/cmd/cue/cmd/testdata/pkg/cuelang.org/go/cmd/cue/cmd/testdata/code/go/pkg2/pkg2_go_gen.cue b/cmd/cue/cmd/testdata/pkg/cuelang.org/go/cmd/cue/cmd/testdata/code/go/pkg2/pkg2_go_gen.cue
index 79c99f6..bf05261 100644
--- a/cmd/cue/cmd/testdata/pkg/cuelang.org/go/cmd/cue/cmd/testdata/code/go/pkg2/pkg2_go_gen.cue
+++ b/cmd/cue/cmd/testdata/pkg/cuelang.org/go/cmd/cue/cmd/testdata/code/go/pkg2/pkg2_go_gen.cue
@@ -8,7 +8,7 @@
 import t "time"
 
 // A Barzer barzes.
-Barzer :: {
+#Barzer: {
 	a:     int @go(A) @protobuf(2,varint,)
 	T:     t.Time
 	B?:    null | int    @go(,*big.Int)
@@ -20,8 +20,8 @@
 	Err:   _    @go(,error)
 }
 
-Perm :: 0o755
+#Perm: 0o755
 
-Few :: 3
+#Few: 3
 
-Couple :: int & 2
+#Couple: int & 2
diff --git a/doc/tutorial/basics/0_intro/43_schema.txt b/doc/tutorial/basics/0_intro/43_schema.txt
index 0293122..1d3ac88 100644
--- a/doc/tutorial/basics/0_intro/43_schema.txt
+++ b/doc/tutorial/basics/0_intro/43_schema.txt
@@ -6,8 +6,9 @@
 description = ""
 
 -- text.md --
-In CUE, schema are typically written as Definitions,
-using a `::` instead of `:`.
+In CUE, schemas are typically written as Definitions.
+A definition is a field which identifier starts with
+a `#` or `_#`.
 This tells CUE that they are to be used for validation and should
 not be output as data; it is okay for them to remain unspecified.
 
@@ -16,14 +17,14 @@
 Including a `...` in struct keeps it open.
 
 -- schema.cue --
-Conn :: {
+#Conn: {
     address:  string
     port:     int
     protocol: string
     // ...    // uncomment this to allow any field
 }
 
-lossy: Conn & {
+lossy: #Conn & {
     address:  "1.2.3.4"
     port:     8888
     protocol: "udp"
diff --git a/doc/tutorial/basics/0_intro/47_validation.txt b/doc/tutorial/basics/0_intro/47_validation.txt
index f2a89a2..b7cbeb0 100644
--- a/doc/tutorial/basics/0_intro/47_validation.txt
+++ b/doc/tutorial/basics/0_intro/47_validation.txt
@@ -10,11 +10,11 @@
 They can be applied to CUE data, or directly to YAML or JSON.
 
 -- schema.cue --
-Language :: {
+#Language: {
 	tag:  string
 	name: =~"^\\p{Lu}" // Must start with an uppercase letter.
 }
-languages: [...Language]
+languages: [...#Language]
 
 -- data.yaml --
 languages:
diff --git a/doc/tutorial/basics/2_types/55_defs.txt b/doc/tutorial/basics/2_types/55_defs.txt
index 6817ba5..45ef02d 100644
--- a/doc/tutorial/basics/2_types/55_defs.txt
+++ b/doc/tutorial/basics/2_types/55_defs.txt
@@ -6,7 +6,8 @@
 description = ""
 
 -- text.md --
-A definition, denoted with `::` instead of `:`, defines values that
+A definition, indicated by an identifier starting with `#` or `_#`,
+defines values that
 are not output when converting a configuration to a concrete value.
 They are used to define schemata against which concrete values can
 be validated.
@@ -14,16 +15,16 @@
 Structs defined by definitions are implicitly closed.
 
 -- defs.cue --
-msg: "Hello \(Name)!"
+msg: "Hello \(#Name)!"
 
-Name :: "world"
+#Name: "world"
 
-A :: {
+#A: {
     field: int
 }
 
-a:   A & { field: 3 }
-err: A & { feild: 3 }
+a:   #A & { field: 3 }
+err: #A & { feild: 3 }
 
 -- expect-stdout-cue --
 msg: "Hello world!"
diff --git a/doc/tutorial/basics/2_types/56_optional.txt b/doc/tutorial/basics/2_types/56_optional.txt
index bc5f342..78c4448 100644
--- a/doc/tutorial/basics/2_types/56_optional.txt
+++ b/doc/tutorial/basics/2_types/56_optional.txt
@@ -19,12 +19,12 @@
 This just means that field may not be specified.
 
 -- structs.cue --
-a :: {
+#a: {
     foo?: int
     bar?: string
     baz?: string
 }
-b: a & {
+b: #a & {
     foo:  3
     baz?: 2  // baz?: _|_
 }
diff --git a/doc/tutorial/basics/2_types/60_disjunctions.txt b/doc/tutorial/basics/2_types/60_disjunctions.txt
index 2c1b1f9..47a861c 100644
--- a/doc/tutorial/basics/2_types/60_disjunctions.txt
+++ b/doc/tutorial/basics/2_types/60_disjunctions.txt
@@ -14,20 +14,20 @@
 to define anything else than these two values.
 
 -- disjunctions.cue --
-Conn :: {
+#Conn: {
     address:  string
     port:     int
     protocol: "tcp" | "udp"
 }
 
-lossy: Conn & {
+lossy: #Conn & {
     address:  "1.2.3.4"
     port:     8888
     protocol: "udp"
 }
 
 -- expect-stdout-cue --
-Conn :: {
+#Conn: {
     address:  string
     port:     int
     protocol: "tcp" | "udp"
diff --git a/doc/tutorial/basics/2_types/70_bounds.txt b/doc/tutorial/basics/2_types/70_bounds.txt
index e179026..b3db502 100644
--- a/doc/tutorial/basics/2_types/70_bounds.txt
+++ b/doc/tutorial/basics/2_types/70_bounds.txt
@@ -15,22 +15,22 @@
 whereas `<0` allows all negative numbers (int or float).
 
 -- bounds.cue --
-rn :: >=3 & <8        // type int | float
-ri :: >=3 & <8 & int  // type int
-rf :: >=3 & <=8.0     // type float
-rs :: >="a" & <"mo"
+#rn: >=3 & <8        // type int | float
+#ri: >=3 & <8 & int  // type int
+#rf: >=3 & <=8.0     // type float
+#rs: >="a" & <"mo"
 
-a: rn & 3.5
-b: ri & 3.5
-c: rf & 3
-d: rs & "ma"
-e: rs & "mu"
+a: #rn & 3.5
+b: #ri & 3.5
+c: #rf & 3
+d: #rs & "ma"
+e: #rs & "mu"
 
-r1: rn & >=5 & <10
+r1: #rn & >=5 & <10
 
 -- expect-stdout-cue --
 a:  3.5
-b:  _|_ // conflicting values ri and 3.5 (mismatched types int and float)
+b:  _|_ // conflicting values #ri and 3.5 (mismatched types int and float)
 c:  3
 d:  "ma"
 e:  _|_ // invalid value "mu" (out of bound <"mo")
diff --git a/doc/tutorial/basics/2_types/75_bounddef.txt b/doc/tutorial/basics/2_types/75_bounddef.txt
index 9869fea..a08d228 100644
--- a/doc/tutorial/basics/2_types/75_bounddef.txt
+++ b/doc/tutorial/basics/2_types/75_bounddef.txt
@@ -29,13 +29,13 @@
 ```
 
 -- bound.cue --
-positive :: uint
-byte ::     uint8
-word ::     int32
+#positive: uint
+#byte:     uint8
+#word:     int32
 
-a: positive & -1
-b: byte & 128
-c: word & 2_000_000_000
+a: #positive & -1
+b: #byte & 128
+c: #word & 2_000_000_000
 
 -- expect-stdout-cue --
 a: _|_ // invalid value -1 (out of bound int & >=0)
diff --git a/doc/tutorial/basics/4_references/50_emit.txt b/doc/tutorial/basics/4_references/50_emit.txt
index c64887b..4c26a61 100644
--- a/doc/tutorial/basics/4_references/50_emit.txt
+++ b/doc/tutorial/basics/4_references/50_emit.txt
@@ -14,9 +14,9 @@
 of defining structs light.
 
 -- emit.cue --
-"Hello \(who)!"
+"Hello \(#who)!"
 
-who :: "world"
+#who: "world"
 
 -- expect-stdout-cue --
 "Hello world!"
diff --git a/doc/tutorial/basics/4_references/99_hidden.txt b/doc/tutorial/basics/4_references/99_hidden.txt
index aabdc29..f9c3d01 100644
--- a/doc/tutorial/basics/4_references/99_hidden.txt
+++ b/doc/tutorial/basics/4_references/99_hidden.txt
@@ -4,7 +4,6 @@
 -- frontmatter.toml --
 title = "Hidden Fields"
 description = ""
-draft = true
 
 -- text.md --
 A non-quoted field name that starts with an underscore (`_`) is not
@@ -19,6 +18,7 @@
 "_foo": 2
 _foo:   3
 foo:    4
+_#foo:  5
 
 -- expect-stdout-cue --
 {
diff --git a/doc/tutorial/basics/6_expressions/20_interpolation.txt b/doc/tutorial/basics/6_expressions/20_interpolation.txt
index 8c13cce..d0758d3 100644
--- a/doc/tutorial/basics/6_expressions/20_interpolation.txt
+++ b/doc/tutorial/basics/6_expressions/20_interpolation.txt
@@ -12,10 +12,10 @@
 Interpolation may also be used in multiline string and byte literals.
 
 -- interpolation.cue --
-"You are \( cost - budget ) dollars over budget!"
+"You are \( #cost - #budget ) dollars over budget!"
 
-cost ::   102
-budget :: 88
+#cost:   102
+#budget: 88
 
 -- expect-stdout-cue --
 "You are 14 dollars over budget!"
diff --git a/doc/tutorial/basics/6_expressions/40_listcomp.txt b/doc/tutorial/basics/6_expressions/40_listcomp.txt
index dbc5132..526a29a 100644
--- a/doc/tutorial/basics/6_expressions/40_listcomp.txt
+++ b/doc/tutorial/basics/6_expressions/40_listcomp.txt
@@ -11,9 +11,9 @@
 The example shows the use of `for` loops and `if` guards.
 
 -- listcomp.cue --
-[ for x in items if x rem 2 == 0 { x*x } ]
+[ for x in #items if x rem 2 == 0 { x*x } ]
 
-items :: [ 1, 2, 3, 4, 5, 6, 7, 8, 9 ]
+#items: [ 1, 2, 3, 4, 5, 6, 7, 8, 9 ]
 
 -- expect-stdout-cue --
 [4, 16, 36, 64]
diff --git a/doc/tutorial/basics/6_expressions/50_fieldcomp.txt b/doc/tutorial/basics/6_expressions/50_fieldcomp.txt
index 6470cb9..5599ec8 100644
--- a/doc/tutorial/basics/6_expressions/50_fieldcomp.txt
+++ b/doc/tutorial/basics/6_expressions/50_fieldcomp.txt
@@ -14,9 +14,9 @@
 -- fieldcomp.cue --
 import "strings"
 
-a:: [ "Barcelona", "Shanghai", "Munich" ]
+#a: [ "Barcelona", "Shanghai", "Munich" ]
 
-for k, v in a {
+for k, v in #a {
     "\( strings.ToLower(v) )": {
         pos:     k + 1
         name:    v
diff --git a/doc/tutorial/kubernetes/README.md b/doc/tutorial/kubernetes/README.md
index 28178fa..660e95f 100644
--- a/doc/tutorial/kubernetes/README.md
+++ b/doc/tutorial/kubernetes/README.md
@@ -356,25 +356,25 @@
 <!--
 ```
 $ cue add */kube.cue -p kube --list <<EOF
-Component :: "{{.DisplayPath}}"
+#Component: "{{.DisplayPath}}"
 EOF
 ```
 -->
 
 ```
 # set the component label to our new top-level field
-$ sed -i.bak 's/component:.*string/component: Component/' kube.cue && rm kube.cue.bak
+$ sed -i.bak 's/component:.*string/component: #Component/' kube.cue && rm kube.cue.bak
 
 # add the new top-level field to our previous template definitions
 $ cat <<EOF >> kube.cue
 
-Component :: string
+#Component: string
 EOF
 
 # add a file with the component label to each directory
 $ ls -d */ | sed 's/.$//' | xargs -I DIR sh -c 'cd DIR; echo "package kube
 
-Component :: \"DIR\"
+#Component: \"DIR\"
 " > kube.cue; cd ..'
 
 # format the files
@@ -429,40 +429,40 @@
 daemonSet: [ID=_]: _spec & {
     apiVersion: "apps/v1"
     kind:       "DaemonSet"
-    Name ::     ID
+    _name:      ID
 }
 
 statefulSet: [ID=_]: _spec & {
     apiVersion: "apps/v1"
     kind:       "StatefulSet"
-    Name ::     ID
+    _name:      ID
 }
 
 deployment: [ID=_]: _spec & {
     apiVersion: "apps/v1"
     kind:       "Deployment"
-    Name ::     ID
+    _name:      ID
     spec: replicas: *1 | int
 }
 
 configMap: [ID=_]: {
     metadata: name: ID
-    metadata: labels: component: Component
+    metadata: labels: component: #Component
 }
 
 _spec: {
-    Name :: string
+    _name: string
 
-    metadata: name: Name
-    metadata: labels: component: Component
+    metadata: name: _name
+    metadata: labels: component: #Component
     spec: selector: {}
     spec: template: {
         metadata: labels: {
-            app:       Name
-            component: Component
+            app:       _name
+            component: #Component
             domain:    "prod"
         }
-        spec: containers: [{name: Name}]
+        spec: containers: [{name: _name}]
     }
 }
 EOF
@@ -470,7 +470,7 @@
 ```
 
 The common configuration has been factored out into `_spec`.
-We introduced `Name` to aid both specifying and referring
+We introduced `_name` to aid both specifying and referring
 to the name of an object.
 For completeness, we added `configMap` as a top-level entry.
 
@@ -710,10 +710,10 @@
 $ cat <<EOF >> kitchen/kube.cue
 
 deployment: [ID=_]: spec: template: spec: {
-    hasDisks :: *true | bool
+    _hasDisks: *true | bool
 
     // field comprehension using just "if"
-    if hasDisks {
+    if _hasDisks {
         volumes: [{
             name: *"\(ID)-disk" | string
             gcePersistentDisk: pdName: *"\(ID)-disk" | string
@@ -740,7 +740,7 @@
 $ cat <<EOF >> kitchen/souschef/kube.cue
 
 deployment: souschef: spec: template: spec: {
-    hasDisks :: false
+    _hasDisks: false
 }
 
 EOF
@@ -933,7 +933,7 @@
 different subdirectories may have different specializations.
 A merge pre-expands templates of each instance and then merges their root
 values.
-The result may contain conflicts, such as our top-level `Component` field,
+The result may contain conflicts, such as our top-level `#Component` field,
 but our per-type maps of Kubernetes objects should be free of conflict
 (if there is, we have a problem with Kubernetes down the line).
 A merge thus gives us a unified view of all objects.
@@ -1079,10 +1079,10 @@
   apps_v1 "k8s.io/api/apps/v1"
 )
 
-service: [string]:     v1.Service
-deployment: [string]:  apps_v1.Deployment
-daemonSet: [string]:   apps_v1.DaemonSet
-statefulSet: [string]: apps_v1.StatefulSet
+service: [string]:     v1.#Service
+deployment: [string]:  apps_v1.#Deployment
+daemonSet: [string]:   apps_v1.#DaemonSet
+statefulSet: [string]: apps_v1.#StatefulSet
 EOF
 ```
 
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/apps/v1/register_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/apps/v1/register_go_gen.cue
index 3239f51..c2497a5 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/apps/v1/register_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/apps/v1/register_go_gen.cue
@@ -4,4 +4,4 @@
 
 package v1
 
-GroupName :: "apps"
+#GroupName: "apps"
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/apps/v1/types_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/apps/v1/types_go_gen.cue
index 6fcaa84..1ff8b0d 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/apps/v1/types_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/apps/v1/types_go_gen.cue
@@ -11,11 +11,11 @@
 	"k8s.io/apimachinery/pkg/util/intstr"
 )
 
-ControllerRevisionHashLabelKey :: "controller-revision-hash"
-StatefulSetRevisionLabel ::       "controller-revision-hash"
-DeprecatedRollbackTo ::           "deprecated.deployment.rollback.to"
-DeprecatedTemplateGeneration ::   "deprecated.daemonset.template.generation"
-StatefulSetPodNameLabel ::        "statefulset.kubernetes.io/pod-name"
+#ControllerRevisionHashLabelKey: "controller-revision-hash"
+#StatefulSetRevisionLabel:       "controller-revision-hash"
+#DeprecatedRollbackTo:           "deprecated.deployment.rollback.to"
+#DeprecatedTemplateGeneration:   "deprecated.daemonset.template.generation"
+#StatefulSetPodNameLabel:        "statefulset.kubernetes.io/pod-name"
 
 // StatefulSet represents a set of pods with consistent identities.
 // Identities are defined as:
@@ -23,78 +23,78 @@
 //  - Storage: As many VolumeClaims as requested.
 // The StatefulSet guarantees that a given network identity will always
 // map to the same storage identity.
-StatefulSet :: {
-	metav1.TypeMeta
+#StatefulSet: {
+	metav1.#TypeMeta
 
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// Spec defines the desired identities of pods in this set.
 	// +optional
-	spec?: StatefulSetSpec @go(Spec) @protobuf(2,bytes,opt)
+	spec?: #StatefulSetSpec @go(Spec) @protobuf(2,bytes,opt)
 
 	// Status is the current status of Pods in this StatefulSet. This data
 	// may be out of date by some window of time.
 	// +optional
-	status?: StatefulSetStatus @go(Status) @protobuf(3,bytes,opt)
+	status?: #StatefulSetStatus @go(Status) @protobuf(3,bytes,opt)
 }
 
 // PodManagementPolicyType defines the policy for creating pods under a stateful set.
-PodManagementPolicyType :: string // enumPodManagementPolicyType
+#PodManagementPolicyType: string // #enumPodManagementPolicyType
 
-enumPodManagementPolicyType ::
-	OrderedReadyPodManagement |
-	ParallelPodManagement
+#enumPodManagementPolicyType:
+	#OrderedReadyPodManagement |
+	#ParallelPodManagement
 
 // OrderedReadyPodManagement will create pods in strictly increasing order on
 // scale up and strictly decreasing order on scale down, progressing only when
 // the previous pod is ready or terminated. At most one pod will be changed
 // at any time.
-OrderedReadyPodManagement :: PodManagementPolicyType & "OrderedReady"
+#OrderedReadyPodManagement: #PodManagementPolicyType & "OrderedReady"
 
 // ParallelPodManagement will create and delete pods as soon as the stateful set
 // replica count is changed, and will not wait for pods to be ready or complete
 // termination.
-ParallelPodManagement :: PodManagementPolicyType & "Parallel"
+#ParallelPodManagement: #PodManagementPolicyType & "Parallel"
 
 // StatefulSetUpdateStrategy indicates the strategy that the StatefulSet
 // controller will use to perform updates. It includes any additional parameters
 // necessary to perform the update for the indicated strategy.
-StatefulSetUpdateStrategy :: {
+#StatefulSetUpdateStrategy: {
 	// Type indicates the type of the StatefulSetUpdateStrategy.
 	// Default is RollingUpdate.
 	// +optional
-	type?: StatefulSetUpdateStrategyType @go(Type) @protobuf(1,bytes,opt,casttype=StatefulSetStrategyType)
+	type?: #StatefulSetUpdateStrategyType @go(Type) @protobuf(1,bytes,opt,casttype=StatefulSetStrategyType)
 
 	// RollingUpdate is used to communicate parameters when Type is RollingUpdateStatefulSetStrategyType.
 	// +optional
-	rollingUpdate?: null | RollingUpdateStatefulSetStrategy @go(RollingUpdate,*RollingUpdateStatefulSetStrategy) @protobuf(2,bytes,opt)
+	rollingUpdate?: null | #RollingUpdateStatefulSetStrategy @go(RollingUpdate,*RollingUpdateStatefulSetStrategy) @protobuf(2,bytes,opt)
 }
 
 // StatefulSetUpdateStrategyType is a string enumeration type that enumerates
 // all possible update strategies for the StatefulSet controller.
-StatefulSetUpdateStrategyType :: string // enumStatefulSetUpdateStrategyType
+#StatefulSetUpdateStrategyType: string // #enumStatefulSetUpdateStrategyType
 
-enumStatefulSetUpdateStrategyType ::
-	RollingUpdateStatefulSetStrategyType |
-	OnDeleteStatefulSetStrategyType
+#enumStatefulSetUpdateStrategyType:
+	#RollingUpdateStatefulSetStrategyType |
+	#OnDeleteStatefulSetStrategyType
 
 // RollingUpdateStatefulSetStrategyType indicates that update will be
 // applied to all Pods in the StatefulSet with respect to the StatefulSet
 // ordering constraints. When a scale operation is performed with this
 // strategy, new Pods will be created from the specification version indicated
 // by the StatefulSet's updateRevision.
-RollingUpdateStatefulSetStrategyType :: StatefulSetUpdateStrategyType & "RollingUpdate"
+#RollingUpdateStatefulSetStrategyType: #StatefulSetUpdateStrategyType & "RollingUpdate"
 
 // OnDeleteStatefulSetStrategyType triggers the legacy behavior. Version
 // tracking and ordered rolling restarts are disabled. Pods are recreated
 // from the StatefulSetSpec when they are manually deleted. When a scale
 // operation is performed with this strategy,specification version indicated
 // by the StatefulSet's currentRevision.
-OnDeleteStatefulSetStrategyType :: StatefulSetUpdateStrategyType & "OnDelete"
+#OnDeleteStatefulSetStrategyType: #StatefulSetUpdateStrategyType & "OnDelete"
 
 // RollingUpdateStatefulSetStrategy is used to communicate parameter for RollingUpdateStatefulSetStrategyType.
-RollingUpdateStatefulSetStrategy :: {
+#RollingUpdateStatefulSetStrategy: {
 	// Partition indicates the ordinal at which the StatefulSet should be
 	// partitioned.
 	// Default value is 0.
@@ -103,7 +103,7 @@
 }
 
 // A StatefulSetSpec is the specification of a StatefulSet.
-StatefulSetSpec :: {
+#StatefulSetSpec: {
 	// replicas is the desired number of replicas of the given Template.
 	// These are replicas in the sense that they are instantiations of the
 	// same Template, but individual replicas also have a consistent identity.
@@ -115,13 +115,13 @@
 	// selector is a label query over pods that should match the replica count.
 	// It must match the pod template's labels.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
-	selector?: null | metav1.LabelSelector @go(Selector,*metav1.LabelSelector) @protobuf(2,bytes,opt)
+	selector?: null | metav1.#LabelSelector @go(Selector,*metav1.LabelSelector) @protobuf(2,bytes,opt)
 
 	// template is the object that describes the pod that will be created if
 	// insufficient replicas are detected. Each pod stamped out by the StatefulSet
 	// will fulfill this Template, but have a unique identity from the rest
 	// of the StatefulSet.
-	template: v1.PodTemplateSpec @go(Template) @protobuf(3,bytes,opt)
+	template: v1.#PodTemplateSpec @go(Template) @protobuf(3,bytes,opt)
 
 	// volumeClaimTemplates is a list of claims that pods are allowed to reference.
 	// The StatefulSet controller is responsible for mapping network identities to
@@ -131,7 +131,7 @@
 	// any volumes in the template, with the same name.
 	// TODO: Define the behavior if a claim already exists with the same name.
 	// +optional
-	volumeClaimTemplates?: [...v1.PersistentVolumeClaim] @go(VolumeClaimTemplates,[]v1.PersistentVolumeClaim) @protobuf(4,bytes,rep)
+	volumeClaimTemplates?: [...v1.#PersistentVolumeClaim] @go(VolumeClaimTemplates,[]v1.PersistentVolumeClaim) @protobuf(4,bytes,rep)
 
 	// serviceName is the name of the service that governs this StatefulSet.
 	// This service must exist before the StatefulSet, and is responsible for
@@ -149,12 +149,12 @@
 	// to match the desired scale without waiting, and on scale down will delete
 	// all pods at once.
 	// +optional
-	podManagementPolicy?: PodManagementPolicyType @go(PodManagementPolicy) @protobuf(6,bytes,opt,casttype=PodManagementPolicyType)
+	podManagementPolicy?: #PodManagementPolicyType @go(PodManagementPolicy) @protobuf(6,bytes,opt,casttype=PodManagementPolicyType)
 
 	// updateStrategy indicates the StatefulSetUpdateStrategy that will be
 	// employed to update Pods in the StatefulSet when a revision is made to
 	// Template.
-	updateStrategy?: StatefulSetUpdateStrategy @go(UpdateStrategy) @protobuf(7,bytes,opt)
+	updateStrategy?: #StatefulSetUpdateStrategy @go(UpdateStrategy) @protobuf(7,bytes,opt)
 
 	// revisionHistoryLimit is the maximum number of revisions that will
 	// be maintained in the StatefulSet's revision history. The revision history
@@ -164,7 +164,7 @@
 }
 
 // StatefulSetStatus represents the current state of a StatefulSet.
-StatefulSetStatus :: {
+#StatefulSetStatus: {
 	// observedGeneration is the most recent generation observed for this StatefulSet. It corresponds to the
 	// StatefulSet's generation, which is updated on mutation by the API Server.
 	// +optional
@@ -202,22 +202,22 @@
 	// +optional
 	// +patchMergeKey=type
 	// +patchStrategy=merge
-	conditions?: [...StatefulSetCondition] @go(Conditions,[]StatefulSetCondition) @protobuf(10,bytes,rep)
+	conditions?: [...#StatefulSetCondition] @go(Conditions,[]StatefulSetCondition) @protobuf(10,bytes,rep)
 }
 
-StatefulSetConditionType :: string
+#StatefulSetConditionType: string
 
 // StatefulSetCondition describes the state of a statefulset at a certain point.
-StatefulSetCondition :: {
+#StatefulSetCondition: {
 	// Type of statefulset condition.
-	type: StatefulSetConditionType @go(Type) @protobuf(1,bytes,opt,casttype=StatefulSetConditionType)
+	type: #StatefulSetConditionType @go(Type) @protobuf(1,bytes,opt,casttype=StatefulSetConditionType)
 
 	// Status of the condition, one of True, False, Unknown.
-	status: v1.ConditionStatus @go(Status) @protobuf(2,bytes,opt,casttype=k8s.io/api/core/v1.ConditionStatus)
+	status: v1.#ConditionStatus @go(Status) @protobuf(2,bytes,opt,casttype=k8s.io/api/core/v1.ConditionStatus)
 
 	// Last time the condition transitioned from one status to another.
 	// +optional
-	lastTransitionTime?: metav1.Time @go(LastTransitionTime) @protobuf(3,bytes,opt)
+	lastTransitionTime?: metav1.#Time @go(LastTransitionTime) @protobuf(3,bytes,opt)
 
 	// The reason for the condition's last transition.
 	// +optional
@@ -229,33 +229,33 @@
 }
 
 // StatefulSetList is a collection of StatefulSets.
-StatefulSetList :: {
-	metav1.TypeMeta
+#StatefulSetList: {
+	metav1.#TypeMeta
 
 	// +optional
-	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
-	items: [...StatefulSet] @go(Items,[]StatefulSet) @protobuf(2,bytes,rep)
+	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	items: [...#StatefulSet] @go(Items,[]StatefulSet) @protobuf(2,bytes,rep)
 }
 
 // Deployment enables declarative updates for Pods and ReplicaSets.
-Deployment :: {
-	metav1.TypeMeta
+#Deployment: {
+	metav1.#TypeMeta
 
 	// Standard object metadata.
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// Specification of the desired behavior of the Deployment.
 	// +optional
-	spec?: DeploymentSpec @go(Spec) @protobuf(2,bytes,opt)
+	spec?: #DeploymentSpec @go(Spec) @protobuf(2,bytes,opt)
 
 	// Most recently observed status of the Deployment.
 	// +optional
-	status?: DeploymentStatus @go(Status) @protobuf(3,bytes,opt)
+	status?: #DeploymentStatus @go(Status) @protobuf(3,bytes,opt)
 }
 
 // DeploymentSpec is the specification of the desired behavior of the Deployment.
-DeploymentSpec :: {
+#DeploymentSpec: {
 	// Number of desired pods. This is a pointer to distinguish between explicit
 	// zero and not specified. Defaults to 1.
 	// +optional
@@ -264,15 +264,15 @@
 	// Label selector for pods. Existing ReplicaSets whose pods are
 	// selected by this will be the ones affected by this deployment.
 	// It must match the pod template's labels.
-	selector?: null | metav1.LabelSelector @go(Selector,*metav1.LabelSelector) @protobuf(2,bytes,opt)
+	selector?: null | metav1.#LabelSelector @go(Selector,*metav1.LabelSelector) @protobuf(2,bytes,opt)
 
 	// Template describes the pods that will be created.
-	template: v1.PodTemplateSpec @go(Template) @protobuf(3,bytes,opt)
+	template: v1.#PodTemplateSpec @go(Template) @protobuf(3,bytes,opt)
 
 	// The deployment strategy to use to replace existing pods with new ones.
 	// +optional
 	// +patchStrategy=retainKeys
-	strategy?: DeploymentStrategy @go(Strategy) @protobuf(4,bytes,opt)
+	strategy?: #DeploymentStrategy @go(Strategy) @protobuf(4,bytes,opt)
 
 	// Minimum number of seconds for which a newly created pod should be ready
 	// without any of its container crashing, for it to be considered available.
@@ -301,13 +301,13 @@
 // DefaultDeploymentUniqueLabelKey is the default key of the selector that is added
 // to existing ReplicaSets (and label key that is added to its pods) to prevent the existing ReplicaSets
 // to select new pods (and old pods being select by new ReplicaSet).
-DefaultDeploymentUniqueLabelKey :: "pod-template-hash"
+#DefaultDeploymentUniqueLabelKey: "pod-template-hash"
 
 // DeploymentStrategy describes how to replace existing pods with new ones.
-DeploymentStrategy :: {
+#DeploymentStrategy: {
 	// Type of deployment. Can be "Recreate" or "RollingUpdate". Default is RollingUpdate.
 	// +optional
-	type?: DeploymentStrategyType @go(Type) @protobuf(1,bytes,opt,casttype=DeploymentStrategyType)
+	type?: #DeploymentStrategyType @go(Type) @protobuf(1,bytes,opt,casttype=DeploymentStrategyType)
 
 	// Rolling update config params. Present only if DeploymentStrategyType =
 	// RollingUpdate.
@@ -315,23 +315,23 @@
 	// TODO: Update this to follow our convention for oneOf, whatever we decide it
 	// to be.
 	// +optional
-	rollingUpdate?: null | RollingUpdateDeployment @go(RollingUpdate,*RollingUpdateDeployment) @protobuf(2,bytes,opt)
+	rollingUpdate?: null | #RollingUpdateDeployment @go(RollingUpdate,*RollingUpdateDeployment) @protobuf(2,bytes,opt)
 }
 
-DeploymentStrategyType :: string // enumDeploymentStrategyType
+#DeploymentStrategyType: string // #enumDeploymentStrategyType
 
-enumDeploymentStrategyType ::
-	RecreateDeploymentStrategyType |
-	RollingUpdateDeploymentStrategyType
+#enumDeploymentStrategyType:
+	#RecreateDeploymentStrategyType |
+	#RollingUpdateDeploymentStrategyType
 
 // Kill all existing pods before creating new ones.
-RecreateDeploymentStrategyType :: DeploymentStrategyType & "Recreate"
+#RecreateDeploymentStrategyType: #DeploymentStrategyType & "Recreate"
 
 // Replace the old ReplicaSets by new one using rolling update i.e gradually scale down the old ReplicaSets and scale up the new one.
-RollingUpdateDeploymentStrategyType :: DeploymentStrategyType & "RollingUpdate"
+#RollingUpdateDeploymentStrategyType: #DeploymentStrategyType & "RollingUpdate"
 
 // Spec to control the desired behavior of rolling update.
-RollingUpdateDeployment :: {
+#RollingUpdateDeployment: {
 	// The maximum number of pods that can be unavailable during the update.
 	// Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
 	// Absolute number is calculated from percentage by rounding down.
@@ -343,7 +343,7 @@
 	// that the total number of pods available at all times during the update is at
 	// least 70% of desired pods.
 	// +optional
-	maxUnavailable?: null | intstr.IntOrString @go(MaxUnavailable,*intstr.IntOrString) @protobuf(1,bytes,opt)
+	maxUnavailable?: null | intstr.#IntOrString @go(MaxUnavailable,*intstr.IntOrString) @protobuf(1,bytes,opt)
 
 	// The maximum number of pods that can be scheduled above the desired number of
 	// pods.
@@ -357,11 +357,11 @@
 	// new ReplicaSet can be scaled up further, ensuring that total number of pods running
 	// at any time during the update is at most 130% of desired pods.
 	// +optional
-	maxSurge?: null | intstr.IntOrString @go(MaxSurge,*intstr.IntOrString) @protobuf(2,bytes,opt)
+	maxSurge?: null | intstr.#IntOrString @go(MaxSurge,*intstr.IntOrString) @protobuf(2,bytes,opt)
 }
 
 // DeploymentStatus is the most recently observed status of the Deployment.
-DeploymentStatus :: {
+#DeploymentStatus: {
 	// The generation observed by the deployment controller.
 	// +optional
 	observedGeneration?: int64 @go(ObservedGeneration) @protobuf(1,varint,opt)
@@ -391,7 +391,7 @@
 	// Represents the latest available observations of a deployment's current state.
 	// +patchMergeKey=type
 	// +patchStrategy=merge
-	conditions?: [...DeploymentCondition] @go(Conditions,[]DeploymentCondition) @protobuf(6,bytes,rep)
+	conditions?: [...#DeploymentCondition] @go(Conditions,[]DeploymentCondition) @protobuf(6,bytes,rep)
 
 	// Count of hash collisions for the Deployment. The Deployment controller uses this
 	// field as a collision avoidance mechanism when it needs to create the name for the
@@ -400,40 +400,40 @@
 	collisionCount?: null | int32 @go(CollisionCount,*int32) @protobuf(8,varint,opt)
 }
 
-DeploymentConditionType :: string // enumDeploymentConditionType
+#DeploymentConditionType: string // #enumDeploymentConditionType
 
-enumDeploymentConditionType ::
-	DeploymentAvailable |
-	DeploymentProgressing |
-	DeploymentReplicaFailure
+#enumDeploymentConditionType:
+	#DeploymentAvailable |
+	#DeploymentProgressing |
+	#DeploymentReplicaFailure
 
 // Available means the deployment is available, ie. at least the minimum available
 // replicas required are up and running for at least minReadySeconds.
-DeploymentAvailable :: DeploymentConditionType & "Available"
+#DeploymentAvailable: #DeploymentConditionType & "Available"
 
 // Progressing means the deployment is progressing. Progress for a deployment is
 // considered when a new replica set is created or adopted, and when new pods scale
 // up or old pods scale down. Progress is not estimated for paused deployments or
 // when progressDeadlineSeconds is not specified.
-DeploymentProgressing :: DeploymentConditionType & "Progressing"
+#DeploymentProgressing: #DeploymentConditionType & "Progressing"
 
 // ReplicaFailure is added in a deployment when one of its pods fails to be created
 // or deleted.
-DeploymentReplicaFailure :: DeploymentConditionType & "ReplicaFailure"
+#DeploymentReplicaFailure: #DeploymentConditionType & "ReplicaFailure"
 
 // DeploymentCondition describes the state of a deployment at a certain point.
-DeploymentCondition :: {
+#DeploymentCondition: {
 	// Type of deployment condition.
-	type: DeploymentConditionType @go(Type) @protobuf(1,bytes,opt,casttype=DeploymentConditionType)
+	type: #DeploymentConditionType @go(Type) @protobuf(1,bytes,opt,casttype=DeploymentConditionType)
 
 	// Status of the condition, one of True, False, Unknown.
-	status: v1.ConditionStatus @go(Status) @protobuf(2,bytes,opt,casttype=k8s.io/api/core/v1.ConditionStatus)
+	status: v1.#ConditionStatus @go(Status) @protobuf(2,bytes,opt,casttype=k8s.io/api/core/v1.ConditionStatus)
 
 	// The last time this condition was updated.
-	lastUpdateTime?: metav1.Time @go(LastUpdateTime) @protobuf(6,bytes,opt)
+	lastUpdateTime?: metav1.#Time @go(LastUpdateTime) @protobuf(6,bytes,opt)
 
 	// Last time the condition transitioned from one status to another.
-	lastTransitionTime?: metav1.Time @go(LastTransitionTime) @protobuf(7,bytes,opt)
+	lastTransitionTime?: metav1.#Time @go(LastTransitionTime) @protobuf(7,bytes,opt)
 
 	// The reason for the condition's last transition.
 	reason?: string @go(Reason) @protobuf(4,bytes,opt)
@@ -443,22 +443,22 @@
 }
 
 // DeploymentList is a list of Deployments.
-DeploymentList :: {
-	metav1.TypeMeta
+#DeploymentList: {
+	metav1.#TypeMeta
 
 	// Standard list metadata.
 	// +optional
-	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// Items is the list of Deployments.
-	items: [...Deployment] @go(Items,[]Deployment) @protobuf(2,bytes,rep)
+	items: [...#Deployment] @go(Items,[]Deployment) @protobuf(2,bytes,rep)
 }
 
 // DaemonSetUpdateStrategy is a struct used to control the update strategy for a DaemonSet.
-DaemonSetUpdateStrategy :: {
+#DaemonSetUpdateStrategy: {
 	// Type of daemon set update. Can be "RollingUpdate" or "OnDelete". Default is RollingUpdate.
 	// +optional
-	type?: DaemonSetUpdateStrategyType @go(Type) @protobuf(1,bytes,opt)
+	type?: #DaemonSetUpdateStrategyType @go(Type) @protobuf(1,bytes,opt)
 
 	// Rolling update config params. Present only if type = "RollingUpdate".
 	//---
@@ -466,23 +466,23 @@
 	// to be. Same as Deployment `strategy.rollingUpdate`.
 	// See https://github.com/kubernetes/kubernetes/issues/35345
 	// +optional
-	rollingUpdate?: null | RollingUpdateDaemonSet @go(RollingUpdate,*RollingUpdateDaemonSet) @protobuf(2,bytes,opt)
+	rollingUpdate?: null | #RollingUpdateDaemonSet @go(RollingUpdate,*RollingUpdateDaemonSet) @protobuf(2,bytes,opt)
 }
 
-DaemonSetUpdateStrategyType :: string // enumDaemonSetUpdateStrategyType
+#DaemonSetUpdateStrategyType: string // #enumDaemonSetUpdateStrategyType
 
-enumDaemonSetUpdateStrategyType ::
-	RollingUpdateDaemonSetStrategyType |
-	OnDeleteDaemonSetStrategyType
+#enumDaemonSetUpdateStrategyType:
+	#RollingUpdateDaemonSetStrategyType |
+	#OnDeleteDaemonSetStrategyType
 
 // Replace the old daemons by new ones using rolling update i.e replace them on each node one after the other.
-RollingUpdateDaemonSetStrategyType :: DaemonSetUpdateStrategyType & "RollingUpdate"
+#RollingUpdateDaemonSetStrategyType: #DaemonSetUpdateStrategyType & "RollingUpdate"
 
 // Replace the old daemons only when it's killed
-OnDeleteDaemonSetStrategyType :: DaemonSetUpdateStrategyType & "OnDelete"
+#OnDeleteDaemonSetStrategyType: #DaemonSetUpdateStrategyType & "OnDelete"
 
 // Spec to control the desired behavior of daemon set rolling update.
-RollingUpdateDaemonSet :: {
+#RollingUpdateDaemonSet: {
 	// The maximum number of DaemonSet pods that can be unavailable during the
 	// update. Value can be an absolute number (ex: 5) or a percentage of total
 	// number of DaemonSet pods at the start of the update (ex: 10%). Absolute
@@ -498,27 +498,27 @@
 	// that at least 70% of original number of DaemonSet pods are available at
 	// all times during the update.
 	// +optional
-	maxUnavailable?: null | intstr.IntOrString @go(MaxUnavailable,*intstr.IntOrString) @protobuf(1,bytes,opt)
+	maxUnavailable?: null | intstr.#IntOrString @go(MaxUnavailable,*intstr.IntOrString) @protobuf(1,bytes,opt)
 }
 
 // DaemonSetSpec is the specification of a daemon set.
-DaemonSetSpec :: {
+#DaemonSetSpec: {
 	// A label query over pods that are managed by the daemon set.
 	// Must match in order to be controlled.
 	// It must match the pod template's labels.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
-	selector?: null | metav1.LabelSelector @go(Selector,*metav1.LabelSelector) @protobuf(1,bytes,opt)
+	selector?: null | metav1.#LabelSelector @go(Selector,*metav1.LabelSelector) @protobuf(1,bytes,opt)
 
 	// An object that describes the pod that will be created.
 	// The DaemonSet will create exactly one copy of this pod on every node
 	// that matches the template's node selector (or on every node if no node
 	// selector is specified).
 	// More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#pod-template
-	template: v1.PodTemplateSpec @go(Template) @protobuf(2,bytes,opt)
+	template: v1.#PodTemplateSpec @go(Template) @protobuf(2,bytes,opt)
 
 	// An update strategy to replace existing DaemonSet pods with new pods.
 	// +optional
-	updateStrategy?: DaemonSetUpdateStrategy @go(UpdateStrategy) @protobuf(3,bytes,opt)
+	updateStrategy?: #DaemonSetUpdateStrategy @go(UpdateStrategy) @protobuf(3,bytes,opt)
 
 	// The minimum number of seconds for which a newly created DaemonSet pod should
 	// be ready without any of its container crashing, for it to be considered
@@ -535,7 +535,7 @@
 }
 
 // DaemonSetStatus represents the current status of a daemon set.
-DaemonSetStatus :: {
+#DaemonSetStatus: {
 	// The number of nodes that are running at least 1
 	// daemon pod and are supposed to run the daemon pod.
 	// More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/
@@ -585,22 +585,22 @@
 	// +optional
 	// +patchMergeKey=type
 	// +patchStrategy=merge
-	conditions?: [...DaemonSetCondition] @go(Conditions,[]DaemonSetCondition) @protobuf(10,bytes,rep)
+	conditions?: [...#DaemonSetCondition] @go(Conditions,[]DaemonSetCondition) @protobuf(10,bytes,rep)
 }
 
-DaemonSetConditionType :: string
+#DaemonSetConditionType: string
 
 // DaemonSetCondition describes the state of a DaemonSet at a certain point.
-DaemonSetCondition :: {
+#DaemonSetCondition: {
 	// Type of DaemonSet condition.
-	type: DaemonSetConditionType @go(Type) @protobuf(1,bytes,opt,casttype=DaemonSetConditionType)
+	type: #DaemonSetConditionType @go(Type) @protobuf(1,bytes,opt,casttype=DaemonSetConditionType)
 
 	// Status of the condition, one of True, False, Unknown.
-	status: v1.ConditionStatus @go(Status) @protobuf(2,bytes,opt,casttype=k8s.io/api/core/v1.ConditionStatus)
+	status: v1.#ConditionStatus @go(Status) @protobuf(2,bytes,opt,casttype=k8s.io/api/core/v1.ConditionStatus)
 
 	// Last time the condition transitioned from one status to another.
 	// +optional
-	lastTransitionTime?: metav1.Time @go(LastTransitionTime) @protobuf(3,bytes,opt)
+	lastTransitionTime?: metav1.#Time @go(LastTransitionTime) @protobuf(3,bytes,opt)
 
 	// The reason for the condition's last transition.
 	// +optional
@@ -612,18 +612,18 @@
 }
 
 // DaemonSet represents the configuration of a daemon set.
-DaemonSet :: {
-	metav1.TypeMeta
+#DaemonSet: {
+	metav1.#TypeMeta
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// The desired behavior of this daemon set.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 	// +optional
-	spec?: DaemonSetSpec @go(Spec) @protobuf(2,bytes,opt)
+	spec?: #DaemonSetSpec @go(Spec) @protobuf(2,bytes,opt)
 
 	// The current status of this daemon set. This data may be
 	// out of date by some window of time.
@@ -631,41 +631,41 @@
 	// Read-only.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 	// +optional
-	status?: DaemonSetStatus @go(Status) @protobuf(3,bytes,opt)
+	status?: #DaemonSetStatus @go(Status) @protobuf(3,bytes,opt)
 }
 
 // DefaultDaemonSetUniqueLabelKey is the default label key that is added
 // to existing DaemonSet pods to distinguish between old and new
 // DaemonSet pods during DaemonSet template updates.
-DefaultDaemonSetUniqueLabelKey :: "controller-revision-hash"
+#DefaultDaemonSetUniqueLabelKey: "controller-revision-hash"
 
 // DaemonSetList is a collection of daemon sets.
-DaemonSetList :: {
-	metav1.TypeMeta
+#DaemonSetList: {
+	metav1.#TypeMeta
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// A list of daemon sets.
-	items: [...DaemonSet] @go(Items,[]DaemonSet) @protobuf(2,bytes,rep)
+	items: [...#DaemonSet] @go(Items,[]DaemonSet) @protobuf(2,bytes,rep)
 }
 
 // ReplicaSet ensures that a specified number of pod replicas are running at any given time.
-ReplicaSet :: {
-	metav1.TypeMeta
+#ReplicaSet: {
+	metav1.#TypeMeta
 
 	// If the Labels of a ReplicaSet are empty, they are defaulted to
 	// be the same as the Pod(s) that the ReplicaSet manages.
 	// Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// Spec defines the specification of the desired behavior of the ReplicaSet.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 	// +optional
-	spec?: ReplicaSetSpec @go(Spec) @protobuf(2,bytes,opt)
+	spec?: #ReplicaSetSpec @go(Spec) @protobuf(2,bytes,opt)
 
 	// Status is the most recently observed status of the ReplicaSet.
 	// This data may be out of date by some window of time.
@@ -673,25 +673,25 @@
 	// Read-only.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 	// +optional
-	status?: ReplicaSetStatus @go(Status) @protobuf(3,bytes,opt)
+	status?: #ReplicaSetStatus @go(Status) @protobuf(3,bytes,opt)
 }
 
 // ReplicaSetList is a collection of ReplicaSets.
-ReplicaSetList :: {
-	metav1.TypeMeta
+#ReplicaSetList: {
+	metav1.#TypeMeta
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
-	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// List of ReplicaSets.
 	// More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller
-	items: [...ReplicaSet] @go(Items,[]ReplicaSet) @protobuf(2,bytes,rep)
+	items: [...#ReplicaSet] @go(Items,[]ReplicaSet) @protobuf(2,bytes,rep)
 }
 
 // ReplicaSetSpec is the specification of a ReplicaSet.
-ReplicaSetSpec :: {
+#ReplicaSetSpec: {
 	// Replicas is the number of desired replicas.
 	// This is a pointer to distinguish between explicit zero and unspecified.
 	// Defaults to 1.
@@ -709,17 +709,17 @@
 	// Label keys and values that must match in order to be controlled by this replica set.
 	// It must match the pod template's labels.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
-	selector?: null | metav1.LabelSelector @go(Selector,*metav1.LabelSelector) @protobuf(2,bytes,opt)
+	selector?: null | metav1.#LabelSelector @go(Selector,*metav1.LabelSelector) @protobuf(2,bytes,opt)
 
 	// Template is the object that describes the pod that will be created if
 	// insufficient replicas are detected.
 	// More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#pod-template
 	// +optional
-	template?: v1.PodTemplateSpec @go(Template) @protobuf(3,bytes,opt)
+	template?: v1.#PodTemplateSpec @go(Template) @protobuf(3,bytes,opt)
 }
 
 // ReplicaSetStatus represents the current status of a ReplicaSet.
-ReplicaSetStatus :: {
+#ReplicaSetStatus: {
 	// Replicas is the most recently oberved number of replicas.
 	// More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller/#what-is-a-replicationcontroller
 	replicas: int32 @go(Replicas) @protobuf(1,varint,opt)
@@ -744,30 +744,30 @@
 	// +optional
 	// +patchMergeKey=type
 	// +patchStrategy=merge
-	conditions?: [...ReplicaSetCondition] @go(Conditions,[]ReplicaSetCondition) @protobuf(6,bytes,rep)
+	conditions?: [...#ReplicaSetCondition] @go(Conditions,[]ReplicaSetCondition) @protobuf(6,bytes,rep)
 }
 
-ReplicaSetConditionType :: string // enumReplicaSetConditionType
+#ReplicaSetConditionType: string // #enumReplicaSetConditionType
 
-enumReplicaSetConditionType ::
-	ReplicaSetReplicaFailure
+#enumReplicaSetConditionType:
+	#ReplicaSetReplicaFailure
 
 // ReplicaSetReplicaFailure is added in a replica set when one of its pods fails to be created
 // due to insufficient quota, limit ranges, pod security policy, node selectors, etc. or deleted
 // due to kubelet being down or finalizers are failing.
-ReplicaSetReplicaFailure :: ReplicaSetConditionType & "ReplicaFailure"
+#ReplicaSetReplicaFailure: #ReplicaSetConditionType & "ReplicaFailure"
 
 // ReplicaSetCondition describes the state of a replica set at a certain point.
-ReplicaSetCondition :: {
+#ReplicaSetCondition: {
 	// Type of replica set condition.
-	type: ReplicaSetConditionType @go(Type) @protobuf(1,bytes,opt,casttype=ReplicaSetConditionType)
+	type: #ReplicaSetConditionType @go(Type) @protobuf(1,bytes,opt,casttype=ReplicaSetConditionType)
 
 	// Status of the condition, one of True, False, Unknown.
-	status: v1.ConditionStatus @go(Status) @protobuf(2,bytes,opt,casttype=k8s.io/api/core/v1.ConditionStatus)
+	status: v1.#ConditionStatus @go(Status) @protobuf(2,bytes,opt,casttype=k8s.io/api/core/v1.ConditionStatus)
 
 	// The last time the condition transitioned from one status to another.
 	// +optional
-	lastTransitionTime?: metav1.Time @go(LastTransitionTime) @protobuf(3,bytes,opt)
+	lastTransitionTime?: metav1.#Time @go(LastTransitionTime) @protobuf(3,bytes,opt)
 
 	// The reason for the condition's last transition.
 	// +optional
@@ -787,29 +787,29 @@
 // the DaemonSet and StatefulSet controllers for update and rollback, this object is beta. However,
 // it may be subject to name and representation changes in future releases, and clients should not
 // depend on its stability. It is primarily for internal use by controllers.
-ControllerRevision :: {
-	metav1.TypeMeta
+#ControllerRevision: {
+	metav1.#TypeMeta
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// Data is the serialized representation of the state.
-	data?: runtime.RawExtension @go(Data) @protobuf(2,bytes,opt)
+	data?: runtime.#RawExtension @go(Data) @protobuf(2,bytes,opt)
 
 	// Revision indicates the revision of the state represented by Data.
 	revision: int64 @go(Revision) @protobuf(3,varint,opt)
 }
 
 // ControllerRevisionList is a resource containing a list of ControllerRevision objects.
-ControllerRevisionList :: {
-	metav1.TypeMeta
+#ControllerRevisionList: {
+	metav1.#TypeMeta
 
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// Items is the list of ControllerRevisions
-	items: [...ControllerRevision] @go(Items,[]ControllerRevision) @protobuf(2,bytes,rep)
+	items: [...#ControllerRevision] @go(Items,[]ControllerRevision) @protobuf(2,bytes,rep)
 }
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/annotation_key_constants_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/annotation_key_constants_go_gen.cue
index 892ae89..83bf898 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/annotation_key_constants_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/annotation_key_constants_go_gen.cue
@@ -6,52 +6,52 @@
 
 // ImagePolicyFailedOpenKey is added to pods created by failing open when the image policy
 // webhook backend fails.
-ImagePolicyFailedOpenKey :: "alpha.image-policy.k8s.io/failed-open"
+#ImagePolicyFailedOpenKey: "alpha.image-policy.k8s.io/failed-open"
 
 // PodPresetOptOutAnnotationKey represents the annotation key for a pod to exempt itself from pod preset manipulation
-PodPresetOptOutAnnotationKey :: "podpreset.admission.kubernetes.io/exclude"
+#PodPresetOptOutAnnotationKey: "podpreset.admission.kubernetes.io/exclude"
 
 // MirrorAnnotationKey represents the annotation key set by kubelets when creating mirror pods
-MirrorPodAnnotationKey :: "kubernetes.io/config.mirror"
+#MirrorPodAnnotationKey: "kubernetes.io/config.mirror"
 
 // TolerationsAnnotationKey represents the key of tolerations data (json serialized)
 // in the Annotations of a Pod.
-TolerationsAnnotationKey :: "scheduler.alpha.kubernetes.io/tolerations"
+#TolerationsAnnotationKey: "scheduler.alpha.kubernetes.io/tolerations"
 
 // TaintsAnnotationKey represents the key of taints data (json serialized)
 // in the Annotations of a Node.
-TaintsAnnotationKey :: "scheduler.alpha.kubernetes.io/taints"
+#TaintsAnnotationKey: "scheduler.alpha.kubernetes.io/taints"
 
 // SeccompPodAnnotationKey represents the key of a seccomp profile applied
 // to all containers of a pod.
-SeccompPodAnnotationKey :: "seccomp.security.alpha.kubernetes.io/pod"
+#SeccompPodAnnotationKey: "seccomp.security.alpha.kubernetes.io/pod"
 
 // SeccompContainerAnnotationKeyPrefix represents the key of a seccomp profile applied
 // to one container of a pod.
-SeccompContainerAnnotationKeyPrefix :: "container.seccomp.security.alpha.kubernetes.io/"
+#SeccompContainerAnnotationKeyPrefix: "container.seccomp.security.alpha.kubernetes.io/"
 
 // SeccompProfileRuntimeDefault represents the default seccomp profile used by container runtime.
-SeccompProfileRuntimeDefault :: "runtime/default"
+#SeccompProfileRuntimeDefault: "runtime/default"
 
 // DeprecatedSeccompProfileDockerDefault represents the default seccomp profile used by docker.
 // This is now deprecated and should be replaced by SeccompProfileRuntimeDefault.
-DeprecatedSeccompProfileDockerDefault :: "docker/default"
+#DeprecatedSeccompProfileDockerDefault: "docker/default"
 
 // PreferAvoidPodsAnnotationKey represents the key of preferAvoidPods data (json serialized)
 // in the Annotations of a Node.
-PreferAvoidPodsAnnotationKey :: "scheduler.alpha.kubernetes.io/preferAvoidPods"
+#PreferAvoidPodsAnnotationKey: "scheduler.alpha.kubernetes.io/preferAvoidPods"
 
 // ObjectTTLAnnotations represents a suggestion for kubelet for how long it can cache
 // an object (e.g. secret, config map) before fetching it again from apiserver.
 // This annotation can be attached to node.
-ObjectTTLAnnotationKey :: "node.alpha.kubernetes.io/ttl"
+#ObjectTTLAnnotationKey: "node.alpha.kubernetes.io/ttl"
 
 // annotation key prefix used to identify non-convertible json paths.
-NonConvertibleAnnotationPrefix :: "non-convertible.kubernetes.io"
+#NonConvertibleAnnotationPrefix: "non-convertible.kubernetes.io"
 
 // LastAppliedConfigAnnotation is the annotation used to store the previous
 // configuration of a resource for use in a three way diff by UpdateApplyAnnotation.
-LastAppliedConfigAnnotation :: "kubectl.kubernetes.io/last-applied-configuration"
+#LastAppliedConfigAnnotation: "kubectl.kubernetes.io/last-applied-configuration"
 
 // AnnotationLoadBalancerSourceRangesKey is the key of the annotation on a service to set allowed ingress ranges on their LoadBalancers
 //
@@ -60,7 +60,7 @@
 // access only from the CIDRs currently allocated to MIT & the USPS.
 //
 // Not all cloud providers support this annotation, though AWS & GCE do.
-AnnotationLoadBalancerSourceRangesKey :: "service.beta.kubernetes.io/load-balancer-source-ranges"
+#AnnotationLoadBalancerSourceRangesKey: "service.beta.kubernetes.io/load-balancer-source-ranges"
 
 // EndpointsLastChangeTriggerTime is the annotation key, set for endpoints objects, that
 // represents the timestamp (stored as RFC 3339 date-time string, e.g. '2018-10-22T19:32:52.1Z')
@@ -79,10 +79,10 @@
 //
 // This annotation will be used to compute the in-cluster network programming latency SLI, see
 // https://github.com/kubernetes/community/blob/master/sig-scalability/slos/network_programming_latency.md
-EndpointsLastChangeTriggerTime :: "endpoints.kubernetes.io/last-change-trigger-time"
+#EndpointsLastChangeTriggerTime: "endpoints.kubernetes.io/last-change-trigger-time"
 
 // MigratedPluginsAnnotationKey is the annotation key, set for CSINode objects, that is a comma-separated
 // list of in-tree plugins that will be serviced by the CSI backend on the Node represented by CSINode.
 // This annotation is used by the Attach Detach Controller to determine whether to use the in-tree or
 // CSI Backend for a volume plugin on a specific node.
-MigratedPluginsAnnotationKey :: "storage.alpha.kubernetes.io/migrated-plugins"
+#MigratedPluginsAnnotationKey: "storage.alpha.kubernetes.io/migrated-plugins"
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/register_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/register_go_gen.cue
index 907efa1..29c24ab 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/register_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/register_go_gen.cue
@@ -4,4 +4,4 @@
 
 package v1
 
-GroupName :: ""
+#GroupName: ""
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/types_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/types_go_gen.cue
index 2e9aa65..c0e52f9 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/types_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/types_go_gen.cue
@@ -12,30 +12,30 @@
 )
 
 // NamespaceDefault means the object is in the default namespace which is applied when not specified by clients
-NamespaceDefault :: "default"
+#NamespaceDefault: "default"
 
 // NamespaceAll is the default argument to specify on a context when you want to list or filter resources across all namespaces
-NamespaceAll :: ""
+#NamespaceAll: ""
 
 // NamespaceNodeLease is the namespace where we place node lease objects (used for node heartbeats)
-NamespaceNodeLease :: "kube-node-lease"
+#NamespaceNodeLease: "kube-node-lease"
 
 // TopologyKeyAny is the service topology key that matches any node
-TopologyKeyAny :: "*"
+#TopologyKeyAny: "*"
 
 // Volume represents a named volume in a pod that may be accessed by any container in the pod.
-Volume :: {
+#Volume: {
 	// Volume's name.
 	// Must be a DNS_LABEL and unique within the pod.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
 	name: string @go(Name) @protobuf(1,bytes,opt)
 
-	VolumeSource
+	#VolumeSource
 }
 
 // Represents the source of a volume to mount.
 // Only one of its members may be specified.
-VolumeSource :: {
+#VolumeSource: {
 	// HostPath represents a pre-existing file or directory on the host
 	// machine that is directly exposed to the container. This is generally
 	// used for system agents or other privileged things that are allowed
@@ -45,138 +45,138 @@
 	// TODO(jonesdl) We need to restrict who can use host directory mounts and who can/can not
 	// mount host directories as read/write.
 	// +optional
-	hostPath?: null | HostPathVolumeSource @go(HostPath,*HostPathVolumeSource) @protobuf(1,bytes,opt)
+	hostPath?: null | #HostPathVolumeSource @go(HostPath,*HostPathVolumeSource) @protobuf(1,bytes,opt)
 
 	// EmptyDir represents a temporary directory that shares a pod's lifetime.
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
 	// +optional
-	emptyDir?: null | EmptyDirVolumeSource @go(EmptyDir,*EmptyDirVolumeSource) @protobuf(2,bytes,opt)
+	emptyDir?: null | #EmptyDirVolumeSource @go(EmptyDir,*EmptyDirVolumeSource) @protobuf(2,bytes,opt)
 
 	// GCEPersistentDisk represents a GCE Disk resource that is attached to a
 	// kubelet's host machine and then exposed to the pod.
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
 	// +optional
-	gcePersistentDisk?: null | GCEPersistentDiskVolumeSource @go(GCEPersistentDisk,*GCEPersistentDiskVolumeSource) @protobuf(3,bytes,opt)
+	gcePersistentDisk?: null | #GCEPersistentDiskVolumeSource @go(GCEPersistentDisk,*GCEPersistentDiskVolumeSource) @protobuf(3,bytes,opt)
 
 	// AWSElasticBlockStore represents an AWS Disk resource that is attached to a
 	// kubelet's host machine and then exposed to the pod.
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
 	// +optional
-	awsElasticBlockStore?: null | AWSElasticBlockStoreVolumeSource @go(AWSElasticBlockStore,*AWSElasticBlockStoreVolumeSource) @protobuf(4,bytes,opt)
+	awsElasticBlockStore?: null | #AWSElasticBlockStoreVolumeSource @go(AWSElasticBlockStore,*AWSElasticBlockStoreVolumeSource) @protobuf(4,bytes,opt)
 
 	// GitRepo represents a git repository at a particular revision.
 	// DEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an
 	// EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir
 	// into the Pod's container.
 	// +optional
-	gitRepo?: null | GitRepoVolumeSource @go(GitRepo,*GitRepoVolumeSource) @protobuf(5,bytes,opt)
+	gitRepo?: null | #GitRepoVolumeSource @go(GitRepo,*GitRepoVolumeSource) @protobuf(5,bytes,opt)
 
 	// Secret represents a secret that should populate this volume.
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
 	// +optional
-	secret?: null | SecretVolumeSource @go(Secret,*SecretVolumeSource) @protobuf(6,bytes,opt)
+	secret?: null | #SecretVolumeSource @go(Secret,*SecretVolumeSource) @protobuf(6,bytes,opt)
 
 	// NFS represents an NFS mount on the host that shares a pod's lifetime
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
 	// +optional
-	nfs?: null | NFSVolumeSource @go(NFS,*NFSVolumeSource) @protobuf(7,bytes,opt)
+	nfs?: null | #NFSVolumeSource @go(NFS,*NFSVolumeSource) @protobuf(7,bytes,opt)
 
 	// ISCSI represents an ISCSI Disk resource that is attached to a
 	// kubelet's host machine and then exposed to the pod.
 	// More info: https://examples.k8s.io/volumes/iscsi/README.md
 	// +optional
-	iscsi?: null | ISCSIVolumeSource @go(ISCSI,*ISCSIVolumeSource) @protobuf(8,bytes,opt)
+	iscsi?: null | #ISCSIVolumeSource @go(ISCSI,*ISCSIVolumeSource) @protobuf(8,bytes,opt)
 
 	// Glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime.
 	// More info: https://examples.k8s.io/volumes/glusterfs/README.md
 	// +optional
-	glusterfs?: null | GlusterfsVolumeSource @go(Glusterfs,*GlusterfsVolumeSource) @protobuf(9,bytes,opt)
+	glusterfs?: null | #GlusterfsVolumeSource @go(Glusterfs,*GlusterfsVolumeSource) @protobuf(9,bytes,opt)
 
 	// PersistentVolumeClaimVolumeSource represents a reference to a
 	// PersistentVolumeClaim in the same namespace.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
 	// +optional
-	persistentVolumeClaim?: null | PersistentVolumeClaimVolumeSource @go(PersistentVolumeClaim,*PersistentVolumeClaimVolumeSource) @protobuf(10,bytes,opt)
+	persistentVolumeClaim?: null | #PersistentVolumeClaimVolumeSource @go(PersistentVolumeClaim,*PersistentVolumeClaimVolumeSource) @protobuf(10,bytes,opt)
 
 	// RBD represents a Rados Block Device mount on the host that shares a pod's lifetime.
 	// More info: https://examples.k8s.io/volumes/rbd/README.md
 	// +optional
-	rbd?: null | RBDVolumeSource @go(RBD,*RBDVolumeSource) @protobuf(11,bytes,opt)
+	rbd?: null | #RBDVolumeSource @go(RBD,*RBDVolumeSource) @protobuf(11,bytes,opt)
 
 	// FlexVolume represents a generic volume resource that is
 	// provisioned/attached using an exec based plugin.
 	// +optional
-	flexVolume?: null | FlexVolumeSource @go(FlexVolume,*FlexVolumeSource) @protobuf(12,bytes,opt)
+	flexVolume?: null | #FlexVolumeSource @go(FlexVolume,*FlexVolumeSource) @protobuf(12,bytes,opt)
 
 	// Cinder represents a cinder volume attached and mounted on kubelets host machine.
 	// More info: https://examples.k8s.io/mysql-cinder-pd/README.md
 	// +optional
-	cinder?: null | CinderVolumeSource @go(Cinder,*CinderVolumeSource) @protobuf(13,bytes,opt)
+	cinder?: null | #CinderVolumeSource @go(Cinder,*CinderVolumeSource) @protobuf(13,bytes,opt)
 
 	// CephFS represents a Ceph FS mount on the host that shares a pod's lifetime
 	// +optional
-	cephfs?: null | CephFSVolumeSource @go(CephFS,*CephFSVolumeSource) @protobuf(14,bytes,opt)
+	cephfs?: null | #CephFSVolumeSource @go(CephFS,*CephFSVolumeSource) @protobuf(14,bytes,opt)
 
 	// Flocker represents a Flocker volume attached to a kubelet's host machine. This depends on the Flocker control service being running
 	// +optional
-	flocker?: null | FlockerVolumeSource @go(Flocker,*FlockerVolumeSource) @protobuf(15,bytes,opt)
+	flocker?: null | #FlockerVolumeSource @go(Flocker,*FlockerVolumeSource) @protobuf(15,bytes,opt)
 
 	// DownwardAPI represents downward API about the pod that should populate this volume
 	// +optional
-	downwardAPI?: null | DownwardAPIVolumeSource @go(DownwardAPI,*DownwardAPIVolumeSource) @protobuf(16,bytes,opt)
+	downwardAPI?: null | #DownwardAPIVolumeSource @go(DownwardAPI,*DownwardAPIVolumeSource) @protobuf(16,bytes,opt)
 
 	// FC represents a Fibre Channel resource that is attached to a kubelet's host machine and then exposed to the pod.
 	// +optional
-	fc?: null | FCVolumeSource @go(FC,*FCVolumeSource) @protobuf(17,bytes,opt)
+	fc?: null | #FCVolumeSource @go(FC,*FCVolumeSource) @protobuf(17,bytes,opt)
 
 	// AzureFile represents an Azure File Service mount on the host and bind mount to the pod.
 	// +optional
-	azureFile?: null | AzureFileVolumeSource @go(AzureFile,*AzureFileVolumeSource) @protobuf(18,bytes,opt)
+	azureFile?: null | #AzureFileVolumeSource @go(AzureFile,*AzureFileVolumeSource) @protobuf(18,bytes,opt)
 
 	// ConfigMap represents a configMap that should populate this volume
 	// +optional
-	configMap?: null | ConfigMapVolumeSource @go(ConfigMap,*ConfigMapVolumeSource) @protobuf(19,bytes,opt)
+	configMap?: null | #ConfigMapVolumeSource @go(ConfigMap,*ConfigMapVolumeSource) @protobuf(19,bytes,opt)
 
 	// VsphereVolume represents a vSphere volume attached and mounted on kubelets host machine
 	// +optional
-	vsphereVolume?: null | VsphereVirtualDiskVolumeSource @go(VsphereVolume,*VsphereVirtualDiskVolumeSource) @protobuf(20,bytes,opt)
+	vsphereVolume?: null | #VsphereVirtualDiskVolumeSource @go(VsphereVolume,*VsphereVirtualDiskVolumeSource) @protobuf(20,bytes,opt)
 
 	// Quobyte represents a Quobyte mount on the host that shares a pod's lifetime
 	// +optional
-	quobyte?: null | QuobyteVolumeSource @go(Quobyte,*QuobyteVolumeSource) @protobuf(21,bytes,opt)
+	quobyte?: null | #QuobyteVolumeSource @go(Quobyte,*QuobyteVolumeSource) @protobuf(21,bytes,opt)
 
 	// AzureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.
 	// +optional
-	azureDisk?: null | AzureDiskVolumeSource @go(AzureDisk,*AzureDiskVolumeSource) @protobuf(22,bytes,opt)
+	azureDisk?: null | #AzureDiskVolumeSource @go(AzureDisk,*AzureDiskVolumeSource) @protobuf(22,bytes,opt)
 
 	// PhotonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine
-	photonPersistentDisk?: null | PhotonPersistentDiskVolumeSource @go(PhotonPersistentDisk,*PhotonPersistentDiskVolumeSource) @protobuf(23,bytes,opt)
+	photonPersistentDisk?: null | #PhotonPersistentDiskVolumeSource @go(PhotonPersistentDisk,*PhotonPersistentDiskVolumeSource) @protobuf(23,bytes,opt)
 
 	// Items for all in one resources secrets, configmaps, and downward API
-	projected?: null | ProjectedVolumeSource @go(Projected,*ProjectedVolumeSource) @protobuf(26,bytes,opt)
+	projected?: null | #ProjectedVolumeSource @go(Projected,*ProjectedVolumeSource) @protobuf(26,bytes,opt)
 
 	// PortworxVolume represents a portworx volume attached and mounted on kubelets host machine
 	// +optional
-	portworxVolume?: null | PortworxVolumeSource @go(PortworxVolume,*PortworxVolumeSource) @protobuf(24,bytes,opt)
+	portworxVolume?: null | #PortworxVolumeSource @go(PortworxVolume,*PortworxVolumeSource) @protobuf(24,bytes,opt)
 
 	// ScaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes.
 	// +optional
-	scaleIO?: null | ScaleIOVolumeSource @go(ScaleIO,*ScaleIOVolumeSource) @protobuf(25,bytes,opt)
+	scaleIO?: null | #ScaleIOVolumeSource @go(ScaleIO,*ScaleIOVolumeSource) @protobuf(25,bytes,opt)
 
 	// StorageOS represents a StorageOS volume attached and mounted on Kubernetes nodes.
 	// +optional
-	storageos?: null | StorageOSVolumeSource @go(StorageOS,*StorageOSVolumeSource) @protobuf(27,bytes,opt)
+	storageos?: null | #StorageOSVolumeSource @go(StorageOS,*StorageOSVolumeSource) @protobuf(27,bytes,opt)
 
 	// CSI (Container Storage Interface) represents storage that is handled by an external CSI driver (Alpha feature).
 	// +optional
-	csi?: null | CSIVolumeSource @go(CSI,*CSIVolumeSource) @protobuf(28,bytes,opt)
+	csi?: null | #CSIVolumeSource @go(CSI,*CSIVolumeSource) @protobuf(28,bytes,opt)
 }
 
 // PersistentVolumeClaimVolumeSource references the user's PVC in the same namespace.
 // This volume finds the bound PV and mounts that volume for the pod. A
 // PersistentVolumeClaimVolumeSource is, essentially, a wrapper around another
 // type of volume that is owned by someone else (the system).
-PersistentVolumeClaimVolumeSource :: {
+#PersistentVolumeClaimVolumeSource: {
 	// ClaimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
 	claimName: string @go(ClaimName) @protobuf(1,bytes,opt)
@@ -189,18 +189,18 @@
 
 // PersistentVolumeSource is similar to VolumeSource but meant for the
 // administrator who creates PVs. Exactly one of its members must be set.
-PersistentVolumeSource :: {
+#PersistentVolumeSource: {
 	// GCEPersistentDisk represents a GCE Disk resource that is attached to a
 	// kubelet's host machine and then exposed to the pod. Provisioned by an admin.
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
 	// +optional
-	gcePersistentDisk?: null | GCEPersistentDiskVolumeSource @go(GCEPersistentDisk,*GCEPersistentDiskVolumeSource) @protobuf(1,bytes,opt)
+	gcePersistentDisk?: null | #GCEPersistentDiskVolumeSource @go(GCEPersistentDisk,*GCEPersistentDiskVolumeSource) @protobuf(1,bytes,opt)
 
 	// AWSElasticBlockStore represents an AWS Disk resource that is attached to a
 	// kubelet's host machine and then exposed to the pod.
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
 	// +optional
-	awsElasticBlockStore?: null | AWSElasticBlockStoreVolumeSource @go(AWSElasticBlockStore,*AWSElasticBlockStoreVolumeSource) @protobuf(2,bytes,opt)
+	awsElasticBlockStore?: null | #AWSElasticBlockStoreVolumeSource @go(AWSElasticBlockStore,*AWSElasticBlockStoreVolumeSource) @protobuf(2,bytes,opt)
 
 	// HostPath represents a directory on the host.
 	// Provisioned by a developer or tester.
@@ -208,144 +208,144 @@
 	// On-host storage is not supported in any way and WILL NOT WORK in a multi-node cluster.
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
 	// +optional
-	hostPath?: null | HostPathVolumeSource @go(HostPath,*HostPathVolumeSource) @protobuf(3,bytes,opt)
+	hostPath?: null | #HostPathVolumeSource @go(HostPath,*HostPathVolumeSource) @protobuf(3,bytes,opt)
 
 	// Glusterfs represents a Glusterfs volume that is attached to a host and
 	// exposed to the pod. Provisioned by an admin.
 	// More info: https://examples.k8s.io/volumes/glusterfs/README.md
 	// +optional
-	glusterfs?: null | GlusterfsPersistentVolumeSource @go(Glusterfs,*GlusterfsPersistentVolumeSource) @protobuf(4,bytes,opt)
+	glusterfs?: null | #GlusterfsPersistentVolumeSource @go(Glusterfs,*GlusterfsPersistentVolumeSource) @protobuf(4,bytes,opt)
 
 	// NFS represents an NFS mount on the host. Provisioned by an admin.
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
 	// +optional
-	nfs?: null | NFSVolumeSource @go(NFS,*NFSVolumeSource) @protobuf(5,bytes,opt)
+	nfs?: null | #NFSVolumeSource @go(NFS,*NFSVolumeSource) @protobuf(5,bytes,opt)
 
 	// RBD represents a Rados Block Device mount on the host that shares a pod's lifetime.
 	// More info: https://examples.k8s.io/volumes/rbd/README.md
 	// +optional
-	rbd?: null | RBDPersistentVolumeSource @go(RBD,*RBDPersistentVolumeSource) @protobuf(6,bytes,opt)
+	rbd?: null | #RBDPersistentVolumeSource @go(RBD,*RBDPersistentVolumeSource) @protobuf(6,bytes,opt)
 
 	// ISCSI represents an ISCSI Disk resource that is attached to a
 	// kubelet's host machine and then exposed to the pod. Provisioned by an admin.
 	// +optional
-	iscsi?: null | ISCSIPersistentVolumeSource @go(ISCSI,*ISCSIPersistentVolumeSource) @protobuf(7,bytes,opt)
+	iscsi?: null | #ISCSIPersistentVolumeSource @go(ISCSI,*ISCSIPersistentVolumeSource) @protobuf(7,bytes,opt)
 
 	// Cinder represents a cinder volume attached and mounted on kubelets host machine.
 	// More info: https://examples.k8s.io/mysql-cinder-pd/README.md
 	// +optional
-	cinder?: null | CinderPersistentVolumeSource @go(Cinder,*CinderPersistentVolumeSource) @protobuf(8,bytes,opt)
+	cinder?: null | #CinderPersistentVolumeSource @go(Cinder,*CinderPersistentVolumeSource) @protobuf(8,bytes,opt)
 
 	// CephFS represents a Ceph FS mount on the host that shares a pod's lifetime
 	// +optional
-	cephfs?: null | CephFSPersistentVolumeSource @go(CephFS,*CephFSPersistentVolumeSource) @protobuf(9,bytes,opt)
+	cephfs?: null | #CephFSPersistentVolumeSource @go(CephFS,*CephFSPersistentVolumeSource) @protobuf(9,bytes,opt)
 
 	// FC represents a Fibre Channel resource that is attached to a kubelet's host machine and then exposed to the pod.
 	// +optional
-	fc?: null | FCVolumeSource @go(FC,*FCVolumeSource) @protobuf(10,bytes,opt)
+	fc?: null | #FCVolumeSource @go(FC,*FCVolumeSource) @protobuf(10,bytes,opt)
 
 	// Flocker represents a Flocker volume attached to a kubelet's host machine and exposed to the pod for its usage. This depends on the Flocker control service being running
 	// +optional
-	flocker?: null | FlockerVolumeSource @go(Flocker,*FlockerVolumeSource) @protobuf(11,bytes,opt)
+	flocker?: null | #FlockerVolumeSource @go(Flocker,*FlockerVolumeSource) @protobuf(11,bytes,opt)
 
 	// FlexVolume represents a generic volume resource that is
 	// provisioned/attached using an exec based plugin.
 	// +optional
-	flexVolume?: null | FlexPersistentVolumeSource @go(FlexVolume,*FlexPersistentVolumeSource) @protobuf(12,bytes,opt)
+	flexVolume?: null | #FlexPersistentVolumeSource @go(FlexVolume,*FlexPersistentVolumeSource) @protobuf(12,bytes,opt)
 
 	// AzureFile represents an Azure File Service mount on the host and bind mount to the pod.
 	// +optional
-	azureFile?: null | AzureFilePersistentVolumeSource @go(AzureFile,*AzureFilePersistentVolumeSource) @protobuf(13,bytes,opt)
+	azureFile?: null | #AzureFilePersistentVolumeSource @go(AzureFile,*AzureFilePersistentVolumeSource) @protobuf(13,bytes,opt)
 
 	// VsphereVolume represents a vSphere volume attached and mounted on kubelets host machine
 	// +optional
-	vsphereVolume?: null | VsphereVirtualDiskVolumeSource @go(VsphereVolume,*VsphereVirtualDiskVolumeSource) @protobuf(14,bytes,opt)
+	vsphereVolume?: null | #VsphereVirtualDiskVolumeSource @go(VsphereVolume,*VsphereVirtualDiskVolumeSource) @protobuf(14,bytes,opt)
 
 	// Quobyte represents a Quobyte mount on the host that shares a pod's lifetime
 	// +optional
-	quobyte?: null | QuobyteVolumeSource @go(Quobyte,*QuobyteVolumeSource) @protobuf(15,bytes,opt)
+	quobyte?: null | #QuobyteVolumeSource @go(Quobyte,*QuobyteVolumeSource) @protobuf(15,bytes,opt)
 
 	// AzureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.
 	// +optional
-	azureDisk?: null | AzureDiskVolumeSource @go(AzureDisk,*AzureDiskVolumeSource) @protobuf(16,bytes,opt)
+	azureDisk?: null | #AzureDiskVolumeSource @go(AzureDisk,*AzureDiskVolumeSource) @protobuf(16,bytes,opt)
 
 	// PhotonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine
-	photonPersistentDisk?: null | PhotonPersistentDiskVolumeSource @go(PhotonPersistentDisk,*PhotonPersistentDiskVolumeSource) @protobuf(17,bytes,opt)
+	photonPersistentDisk?: null | #PhotonPersistentDiskVolumeSource @go(PhotonPersistentDisk,*PhotonPersistentDiskVolumeSource) @protobuf(17,bytes,opt)
 
 	// PortworxVolume represents a portworx volume attached and mounted on kubelets host machine
 	// +optional
-	portworxVolume?: null | PortworxVolumeSource @go(PortworxVolume,*PortworxVolumeSource) @protobuf(18,bytes,opt)
+	portworxVolume?: null | #PortworxVolumeSource @go(PortworxVolume,*PortworxVolumeSource) @protobuf(18,bytes,opt)
 
 	// ScaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes.
 	// +optional
-	scaleIO?: null | ScaleIOPersistentVolumeSource @go(ScaleIO,*ScaleIOPersistentVolumeSource) @protobuf(19,bytes,opt)
+	scaleIO?: null | #ScaleIOPersistentVolumeSource @go(ScaleIO,*ScaleIOPersistentVolumeSource) @protobuf(19,bytes,opt)
 
 	// Local represents directly-attached storage with node affinity
 	// +optional
-	local?: null | LocalVolumeSource @go(Local,*LocalVolumeSource) @protobuf(20,bytes,opt)
+	local?: null | #LocalVolumeSource @go(Local,*LocalVolumeSource) @protobuf(20,bytes,opt)
 
 	// StorageOS represents a StorageOS volume that is attached to the kubelet's host machine and mounted into the pod
 	// More info: https://examples.k8s.io/volumes/storageos/README.md
 	// +optional
-	storageos?: null | StorageOSPersistentVolumeSource @go(StorageOS,*StorageOSPersistentVolumeSource) @protobuf(21,bytes,opt)
+	storageos?: null | #StorageOSPersistentVolumeSource @go(StorageOS,*StorageOSPersistentVolumeSource) @protobuf(21,bytes,opt)
 
 	// CSI represents storage that is handled by an external CSI driver (Beta feature).
 	// +optional
-	csi?: null | CSIPersistentVolumeSource @go(CSI,*CSIPersistentVolumeSource) @protobuf(22,bytes,opt)
+	csi?: null | #CSIPersistentVolumeSource @go(CSI,*CSIPersistentVolumeSource) @protobuf(22,bytes,opt)
 }
 
 // BetaStorageClassAnnotation represents the beta/previous StorageClass annotation.
 // It's currently still used and will be held for backwards compatibility
-BetaStorageClassAnnotation :: "volume.beta.kubernetes.io/storage-class"
+#BetaStorageClassAnnotation: "volume.beta.kubernetes.io/storage-class"
 
 // MountOptionAnnotation defines mount option annotation used in PVs
-MountOptionAnnotation :: "volume.beta.kubernetes.io/mount-options"
+#MountOptionAnnotation: "volume.beta.kubernetes.io/mount-options"
 
 // PersistentVolume (PV) is a storage resource provisioned by an administrator.
 // It is analogous to a node.
 // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes
-PersistentVolume :: {
-	metav1.TypeMeta
+#PersistentVolume: {
+	metav1.#TypeMeta
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// Spec defines a specification of a persistent volume owned by the cluster.
 	// Provisioned by an administrator.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistent-volumes
 	// +optional
-	spec?: PersistentVolumeSpec @go(Spec) @protobuf(2,bytes,opt)
+	spec?: #PersistentVolumeSpec @go(Spec) @protobuf(2,bytes,opt)
 
 	// Status represents the current information/status for the persistent volume.
 	// Populated by the system.
 	// Read-only.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistent-volumes
 	// +optional
-	status?: PersistentVolumeStatus @go(Status) @protobuf(3,bytes,opt)
+	status?: #PersistentVolumeStatus @go(Status) @protobuf(3,bytes,opt)
 }
 
 // PersistentVolumeSpec is the specification of a persistent volume.
-PersistentVolumeSpec :: {
+#PersistentVolumeSpec: {
 	// A description of the persistent volume's resources and capacity.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#capacity
 	// +optional
-	capacity?: ResourceList @go(Capacity) @protobuf(1,bytes,rep,casttype=ResourceList,castkey=ResourceName)
+	capacity?: #ResourceList @go(Capacity) @protobuf(1,bytes,rep,casttype=ResourceList,castkey=ResourceName)
 
-	PersistentVolumeSource
+	#PersistentVolumeSource
 
 	// AccessModes contains all ways the volume can be mounted.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes
 	// +optional
-	accessModes?: [...PersistentVolumeAccessMode] @go(AccessModes,[]PersistentVolumeAccessMode) @protobuf(3,bytes,rep,casttype=PersistentVolumeAccessMode)
+	accessModes?: [...#PersistentVolumeAccessMode] @go(AccessModes,[]PersistentVolumeAccessMode) @protobuf(3,bytes,rep,casttype=PersistentVolumeAccessMode)
 
 	// ClaimRef is part of a bi-directional binding between PersistentVolume and PersistentVolumeClaim.
 	// Expected to be non-nil when bound.
 	// claim.VolumeName is the authoritative bind between PV and PVC.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#binding
 	// +optional
-	claimRef?: null | ObjectReference @go(ClaimRef,*ObjectReference) @protobuf(4,bytes,opt)
+	claimRef?: null | #ObjectReference @go(ClaimRef,*ObjectReference) @protobuf(4,bytes,opt)
 
 	// What happens to a persistent volume when released from its claim.
 	// Valid options are Retain (default for manually created PersistentVolumes), Delete (default
@@ -353,7 +353,7 @@
 	// Recycle must be supported by the volume plugin underlying this PersistentVolume.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#reclaiming
 	// +optional
-	persistentVolumeReclaimPolicy?: PersistentVolumeReclaimPolicy @go(PersistentVolumeReclaimPolicy) @protobuf(5,bytes,opt,casttype=PersistentVolumeReclaimPolicy)
+	persistentVolumeReclaimPolicy?: #PersistentVolumeReclaimPolicy @go(PersistentVolumeReclaimPolicy) @protobuf(5,bytes,opt,casttype=PersistentVolumeReclaimPolicy)
 
 	// Name of StorageClass to which this persistent volume belongs. Empty value
 	// means that this volume does not belong to any StorageClass.
@@ -369,59 +369,59 @@
 	// volumeMode defines if a volume is intended to be used with a formatted filesystem
 	// or to remain in raw block state. Value of Filesystem is implied when not included in spec.
 	// +optional
-	volumeMode?: null | PersistentVolumeMode @go(VolumeMode,*PersistentVolumeMode) @protobuf(8,bytes,opt,casttype=PersistentVolumeMode)
+	volumeMode?: null | #PersistentVolumeMode @go(VolumeMode,*PersistentVolumeMode) @protobuf(8,bytes,opt,casttype=PersistentVolumeMode)
 
 	// NodeAffinity defines constraints that limit what nodes this volume can be accessed from.
 	// This field influences the scheduling of pods that use this volume.
 	// +optional
-	nodeAffinity?: null | VolumeNodeAffinity @go(NodeAffinity,*VolumeNodeAffinity) @protobuf(9,bytes,opt)
+	nodeAffinity?: null | #VolumeNodeAffinity @go(NodeAffinity,*VolumeNodeAffinity) @protobuf(9,bytes,opt)
 }
 
 // VolumeNodeAffinity defines constraints that limit what nodes this volume can be accessed from.
-VolumeNodeAffinity :: {
+#VolumeNodeAffinity: {
 	// Required specifies hard node constraints that must be met.
-	required?: null | NodeSelector @go(Required,*NodeSelector) @protobuf(1,bytes,opt)
+	required?: null | #NodeSelector @go(Required,*NodeSelector) @protobuf(1,bytes,opt)
 }
 
 // PersistentVolumeReclaimPolicy describes a policy for end-of-life maintenance of persistent volumes.
-PersistentVolumeReclaimPolicy :: string // enumPersistentVolumeReclaimPolicy
+#PersistentVolumeReclaimPolicy: string // #enumPersistentVolumeReclaimPolicy
 
-enumPersistentVolumeReclaimPolicy ::
-	PersistentVolumeReclaimRecycle |
-	PersistentVolumeReclaimDelete |
-	PersistentVolumeReclaimRetain
+#enumPersistentVolumeReclaimPolicy:
+	#PersistentVolumeReclaimRecycle |
+	#PersistentVolumeReclaimDelete |
+	#PersistentVolumeReclaimRetain
 
 // PersistentVolumeReclaimRecycle means the volume will be recycled back into the pool of unbound persistent volumes on release from its claim.
 // The volume plugin must support Recycling.
-PersistentVolumeReclaimRecycle :: PersistentVolumeReclaimPolicy & "Recycle"
+#PersistentVolumeReclaimRecycle: #PersistentVolumeReclaimPolicy & "Recycle"
 
 // PersistentVolumeReclaimDelete means the volume will be deleted from Kubernetes on release from its claim.
 // The volume plugin must support Deletion.
-PersistentVolumeReclaimDelete :: PersistentVolumeReclaimPolicy & "Delete"
+#PersistentVolumeReclaimDelete: #PersistentVolumeReclaimPolicy & "Delete"
 
 // PersistentVolumeReclaimRetain means the volume will be left in its current phase (Released) for manual reclamation by the administrator.
 // The default policy is Retain.
-PersistentVolumeReclaimRetain :: PersistentVolumeReclaimPolicy & "Retain"
+#PersistentVolumeReclaimRetain: #PersistentVolumeReclaimPolicy & "Retain"
 
 // PersistentVolumeMode describes how a volume is intended to be consumed, either Block or Filesystem.
-PersistentVolumeMode :: string // enumPersistentVolumeMode
+#PersistentVolumeMode: string // #enumPersistentVolumeMode
 
-enumPersistentVolumeMode ::
-	PersistentVolumeBlock |
-	PersistentVolumeFilesystem
+#enumPersistentVolumeMode:
+	#PersistentVolumeBlock |
+	#PersistentVolumeFilesystem
 
 // PersistentVolumeBlock means the volume will not be formatted with a filesystem and will remain a raw block device.
-PersistentVolumeBlock :: PersistentVolumeMode & "Block"
+#PersistentVolumeBlock: #PersistentVolumeMode & "Block"
 
 // PersistentVolumeFilesystem means the volume will be or is formatted with a filesystem.
-PersistentVolumeFilesystem :: PersistentVolumeMode & "Filesystem"
+#PersistentVolumeFilesystem: #PersistentVolumeMode & "Filesystem"
 
 // PersistentVolumeStatus is the current status of a persistent volume.
-PersistentVolumeStatus :: {
+#PersistentVolumeStatus: {
 	// Phase indicates if a volume is available, bound to a claim, or released by a claim.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#phase
 	// +optional
-	phase?: PersistentVolumePhase @go(Phase) @protobuf(1,bytes,opt,casttype=PersistentVolumePhase)
+	phase?: #PersistentVolumePhase @go(Phase) @protobuf(1,bytes,opt,casttype=PersistentVolumePhase)
 
 	// A human-readable message indicating details about why the volume is in this state.
 	// +optional
@@ -434,70 +434,70 @@
 }
 
 // PersistentVolumeList is a list of PersistentVolume items.
-PersistentVolumeList :: {
-	metav1.TypeMeta
+#PersistentVolumeList: {
+	metav1.#TypeMeta
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
-	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// List of persistent volumes.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes
-	items: [...PersistentVolume] @go(Items,[]PersistentVolume) @protobuf(2,bytes,rep)
+	items: [...#PersistentVolume] @go(Items,[]PersistentVolume) @protobuf(2,bytes,rep)
 }
 
 // PersistentVolumeClaim is a user's request for and claim to a persistent volume
-PersistentVolumeClaim :: {
-	metav1.TypeMeta
+#PersistentVolumeClaim: {
+	metav1.#TypeMeta
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// Spec defines the desired characteristics of a volume requested by a pod author.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
 	// +optional
-	spec?: PersistentVolumeClaimSpec @go(Spec) @protobuf(2,bytes,opt)
+	spec?: #PersistentVolumeClaimSpec @go(Spec) @protobuf(2,bytes,opt)
 
 	// Status represents the current information/status of a persistent volume claim.
 	// Read-only.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
 	// +optional
-	status?: PersistentVolumeClaimStatus @go(Status) @protobuf(3,bytes,opt)
+	status?: #PersistentVolumeClaimStatus @go(Status) @protobuf(3,bytes,opt)
 }
 
 // PersistentVolumeClaimList is a list of PersistentVolumeClaim items.
-PersistentVolumeClaimList :: {
-	metav1.TypeMeta
+#PersistentVolumeClaimList: {
+	metav1.#TypeMeta
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
-	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// A list of persistent volume claims.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
-	items: [...PersistentVolumeClaim] @go(Items,[]PersistentVolumeClaim) @protobuf(2,bytes,rep)
+	items: [...#PersistentVolumeClaim] @go(Items,[]PersistentVolumeClaim) @protobuf(2,bytes,rep)
 }
 
 // PersistentVolumeClaimSpec describes the common attributes of storage devices
 // and allows a Source for provider-specific attributes
-PersistentVolumeClaimSpec :: {
+#PersistentVolumeClaimSpec: {
 	// AccessModes contains the desired access modes the volume should have.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
 	// +optional
-	accessModes?: [...PersistentVolumeAccessMode] @go(AccessModes,[]PersistentVolumeAccessMode) @protobuf(1,bytes,rep,casttype=PersistentVolumeAccessMode)
+	accessModes?: [...#PersistentVolumeAccessMode] @go(AccessModes,[]PersistentVolumeAccessMode) @protobuf(1,bytes,rep,casttype=PersistentVolumeAccessMode)
 
 	// A label query over volumes to consider for binding.
 	// +optional
-	selector?: null | metav1.LabelSelector @go(Selector,*metav1.LabelSelector) @protobuf(4,bytes,opt)
+	selector?: null | metav1.#LabelSelector @go(Selector,*metav1.LabelSelector) @protobuf(4,bytes,opt)
 
 	// Resources represents the minimum resources the volume should have.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
 	// +optional
-	resources?: ResourceRequirements @go(Resources) @protobuf(2,bytes,opt)
+	resources?: #ResourceRequirements @go(Resources) @protobuf(2,bytes,opt)
 
 	// VolumeName is the binding reference to the PersistentVolume backing this claim.
 	// +optional
@@ -511,7 +511,7 @@
 	// volumeMode defines what type of volume is required by the claim.
 	// Value of Filesystem is implied when not included in claim spec.
 	// +optional
-	volumeMode?: null | PersistentVolumeMode @go(VolumeMode,*PersistentVolumeMode) @protobuf(6,bytes,opt,casttype=PersistentVolumeMode)
+	volumeMode?: null | #PersistentVolumeMode @go(VolumeMode,*PersistentVolumeMode) @protobuf(6,bytes,opt,casttype=PersistentVolumeMode)
 
 	// This field can be used to specify either:
 	// * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot - Beta)
@@ -526,34 +526,34 @@
 	// In the future, we plan to support more data source types and the behavior
 	// of the provisioner may change.
 	// +optional
-	dataSource?: null | TypedLocalObjectReference @go(DataSource,*TypedLocalObjectReference) @protobuf(7,bytes,opt)
+	dataSource?: null | #TypedLocalObjectReference @go(DataSource,*TypedLocalObjectReference) @protobuf(7,bytes,opt)
 }
 
 // PersistentVolumeClaimConditionType is a valid value of PersistentVolumeClaimCondition.Type
-PersistentVolumeClaimConditionType :: string // enumPersistentVolumeClaimConditionType
+#PersistentVolumeClaimConditionType: string // #enumPersistentVolumeClaimConditionType
 
-enumPersistentVolumeClaimConditionType ::
-	PersistentVolumeClaimResizing |
-	PersistentVolumeClaimFileSystemResizePending
+#enumPersistentVolumeClaimConditionType:
+	#PersistentVolumeClaimResizing |
+	#PersistentVolumeClaimFileSystemResizePending
 
 // PersistentVolumeClaimResizing - a user trigger resize of pvc has been started
-PersistentVolumeClaimResizing :: PersistentVolumeClaimConditionType & "Resizing"
+#PersistentVolumeClaimResizing: #PersistentVolumeClaimConditionType & "Resizing"
 
 // PersistentVolumeClaimFileSystemResizePending - controller resize is finished and a file system resize is pending on node
-PersistentVolumeClaimFileSystemResizePending :: PersistentVolumeClaimConditionType & "FileSystemResizePending"
+#PersistentVolumeClaimFileSystemResizePending: #PersistentVolumeClaimConditionType & "FileSystemResizePending"
 
 // PersistentVolumeClaimCondition contails details about state of pvc
-PersistentVolumeClaimCondition :: {
-	type:   PersistentVolumeClaimConditionType @go(Type) @protobuf(1,bytes,opt,casttype=PersistentVolumeClaimConditionType)
-	status: ConditionStatus                    @go(Status) @protobuf(2,bytes,opt,casttype=ConditionStatus)
+#PersistentVolumeClaimCondition: {
+	type:   #PersistentVolumeClaimConditionType @go(Type) @protobuf(1,bytes,opt,casttype=PersistentVolumeClaimConditionType)
+	status: #ConditionStatus                    @go(Status) @protobuf(2,bytes,opt,casttype=ConditionStatus)
 
 	// Last time we probed the condition.
 	// +optional
-	lastProbeTime?: metav1.Time @go(LastProbeTime) @protobuf(3,bytes,opt)
+	lastProbeTime?: metav1.#Time @go(LastProbeTime) @protobuf(3,bytes,opt)
 
 	// Last time the condition transitioned from one status to another.
 	// +optional
-	lastTransitionTime?: metav1.Time @go(LastTransitionTime) @protobuf(4,bytes,opt)
+	lastTransitionTime?: metav1.#Time @go(LastTransitionTime) @protobuf(4,bytes,opt)
 
 	// Unique, this should be a short, machine understandable string that gives the reason
 	// for condition's last transition. If it reports "ResizeStarted" that means the underlying
@@ -567,130 +567,130 @@
 }
 
 // PersistentVolumeClaimStatus is the current status of a persistent volume claim.
-PersistentVolumeClaimStatus :: {
+#PersistentVolumeClaimStatus: {
 	// Phase represents the current phase of PersistentVolumeClaim.
 	// +optional
-	phase?: PersistentVolumeClaimPhase @go(Phase) @protobuf(1,bytes,opt,casttype=PersistentVolumeClaimPhase)
+	phase?: #PersistentVolumeClaimPhase @go(Phase) @protobuf(1,bytes,opt,casttype=PersistentVolumeClaimPhase)
 
 	// AccessModes contains the actual access modes the volume backing the PVC has.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
 	// +optional
-	accessModes?: [...PersistentVolumeAccessMode] @go(AccessModes,[]PersistentVolumeAccessMode) @protobuf(2,bytes,rep,casttype=PersistentVolumeAccessMode)
+	accessModes?: [...#PersistentVolumeAccessMode] @go(AccessModes,[]PersistentVolumeAccessMode) @protobuf(2,bytes,rep,casttype=PersistentVolumeAccessMode)
 
 	// Represents the actual resources of the underlying volume.
 	// +optional
-	capacity?: ResourceList @go(Capacity) @protobuf(3,bytes,rep,casttype=ResourceList,castkey=ResourceName)
+	capacity?: #ResourceList @go(Capacity) @protobuf(3,bytes,rep,casttype=ResourceList,castkey=ResourceName)
 
 	// Current Condition of persistent volume claim. If underlying persistent volume is being
 	// resized then the Condition will be set to 'ResizeStarted'.
 	// +optional
 	// +patchMergeKey=type
 	// +patchStrategy=merge
-	conditions?: [...PersistentVolumeClaimCondition] @go(Conditions,[]PersistentVolumeClaimCondition) @protobuf(4,bytes,rep)
+	conditions?: [...#PersistentVolumeClaimCondition] @go(Conditions,[]PersistentVolumeClaimCondition) @protobuf(4,bytes,rep)
 }
 
-PersistentVolumeAccessMode :: string // enumPersistentVolumeAccessMode
+#PersistentVolumeAccessMode: string // #enumPersistentVolumeAccessMode
 
-enumPersistentVolumeAccessMode ::
-	ReadWriteOnce |
-	ReadOnlyMany |
-	ReadWriteMany
+#enumPersistentVolumeAccessMode:
+	#ReadWriteOnce |
+	#ReadOnlyMany |
+	#ReadWriteMany
 
 // can be mounted in read/write mode to exactly 1 host
-ReadWriteOnce :: PersistentVolumeAccessMode & "ReadWriteOnce"
+#ReadWriteOnce: #PersistentVolumeAccessMode & "ReadWriteOnce"
 
 // can be mounted in read-only mode to many hosts
-ReadOnlyMany :: PersistentVolumeAccessMode & "ReadOnlyMany"
+#ReadOnlyMany: #PersistentVolumeAccessMode & "ReadOnlyMany"
 
 // can be mounted in read/write mode to many hosts
-ReadWriteMany :: PersistentVolumeAccessMode & "ReadWriteMany"
+#ReadWriteMany: #PersistentVolumeAccessMode & "ReadWriteMany"
 
-PersistentVolumePhase :: string // enumPersistentVolumePhase
+#PersistentVolumePhase: string // #enumPersistentVolumePhase
 
-enumPersistentVolumePhase ::
-	VolumePending |
-	VolumeAvailable |
-	VolumeBound |
-	VolumeReleased |
-	VolumeFailed
+#enumPersistentVolumePhase:
+	#VolumePending |
+	#VolumeAvailable |
+	#VolumeBound |
+	#VolumeReleased |
+	#VolumeFailed
 
 // used for PersistentVolumes that are not available
-VolumePending :: PersistentVolumePhase & "Pending"
+#VolumePending: #PersistentVolumePhase & "Pending"
 
 // used for PersistentVolumes that are not yet bound
 // Available volumes are held by the binder and matched to PersistentVolumeClaims
-VolumeAvailable :: PersistentVolumePhase & "Available"
+#VolumeAvailable: #PersistentVolumePhase & "Available"
 
 // used for PersistentVolumes that are bound
-VolumeBound :: PersistentVolumePhase & "Bound"
+#VolumeBound: #PersistentVolumePhase & "Bound"
 
 // used for PersistentVolumes where the bound PersistentVolumeClaim was deleted
 // released volumes must be recycled before becoming available again
 // this phase is used by the persistent volume claim binder to signal to another process to reclaim the resource
-VolumeReleased :: PersistentVolumePhase & "Released"
+#VolumeReleased: #PersistentVolumePhase & "Released"
 
 // used for PersistentVolumes that failed to be correctly recycled or deleted after being released from a claim
-VolumeFailed :: PersistentVolumePhase & "Failed"
+#VolumeFailed: #PersistentVolumePhase & "Failed"
 
-PersistentVolumeClaimPhase :: string // enumPersistentVolumeClaimPhase
+#PersistentVolumeClaimPhase: string // #enumPersistentVolumeClaimPhase
 
-enumPersistentVolumeClaimPhase ::
-	ClaimPending |
-	ClaimBound |
-	ClaimLost
+#enumPersistentVolumeClaimPhase:
+	#ClaimPending |
+	#ClaimBound |
+	#ClaimLost
 
 // used for PersistentVolumeClaims that are not yet bound
-ClaimPending :: PersistentVolumeClaimPhase & "Pending"
+#ClaimPending: #PersistentVolumeClaimPhase & "Pending"
 
 // used for PersistentVolumeClaims that are bound
-ClaimBound :: PersistentVolumeClaimPhase & "Bound"
+#ClaimBound: #PersistentVolumeClaimPhase & "Bound"
 
 // used for PersistentVolumeClaims that lost their underlying
 // PersistentVolume. The claim was bound to a PersistentVolume and this
 // volume does not exist any longer and all data on it was lost.
-ClaimLost :: PersistentVolumeClaimPhase & "Lost"
+#ClaimLost: #PersistentVolumeClaimPhase & "Lost"
 
-HostPathType :: string // enumHostPathType
+#HostPathType: string // #enumHostPathType
 
-enumHostPathType ::
-	HostPathUnset |
-	HostPathDirectoryOrCreate |
-	HostPathDirectory |
-	HostPathFileOrCreate |
-	HostPathFile |
-	HostPathSocket |
-	HostPathCharDev |
-	HostPathBlockDev
+#enumHostPathType:
+	#HostPathUnset |
+	#HostPathDirectoryOrCreate |
+	#HostPathDirectory |
+	#HostPathFileOrCreate |
+	#HostPathFile |
+	#HostPathSocket |
+	#HostPathCharDev |
+	#HostPathBlockDev
 
 // For backwards compatible, leave it empty if unset
-HostPathUnset :: HostPathType & ""
+#HostPathUnset: #HostPathType & ""
 
 // If nothing exists at the given path, an empty directory will be created there
 // as needed with file mode 0755, having the same group and ownership with Kubelet.
-HostPathDirectoryOrCreate :: HostPathType & "DirectoryOrCreate"
+#HostPathDirectoryOrCreate: #HostPathType & "DirectoryOrCreate"
 
 // A directory must exist at the given path
-HostPathDirectory :: HostPathType & "Directory"
+#HostPathDirectory: #HostPathType & "Directory"
 
 // If nothing exists at the given path, an empty file will be created there
 // as needed with file mode 0644, having the same group and ownership with Kubelet.
-HostPathFileOrCreate :: HostPathType & "FileOrCreate"
+#HostPathFileOrCreate: #HostPathType & "FileOrCreate"
 
 // A file must exist at the given path
-HostPathFile :: HostPathType & "File"
+#HostPathFile: #HostPathType & "File"
 
 // A UNIX socket must exist at the given path
-HostPathSocket :: HostPathType & "Socket"
+#HostPathSocket: #HostPathType & "Socket"
 
 // A character device must exist at the given path
-HostPathCharDev :: HostPathType & "CharDevice"
+#HostPathCharDev: #HostPathType & "CharDevice"
 
 // A block device must exist at the given path
-HostPathBlockDev :: HostPathType & "BlockDevice"
+#HostPathBlockDev: #HostPathType & "BlockDevice"
 
 // Represents a host path mapped into a pod.
 // Host path volumes do not support ownership management or SELinux relabeling.
-HostPathVolumeSource :: {
+#HostPathVolumeSource: {
 	// Path of the directory on the host.
 	// If the path is a symlink, it will follow the link to the real path.
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
@@ -700,18 +700,18 @@
 	// Defaults to ""
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
 	// +optional
-	type?: null | HostPathType @go(Type,*HostPathType) @protobuf(2,bytes,opt)
+	type?: null | #HostPathType @go(Type,*HostPathType) @protobuf(2,bytes,opt)
 }
 
 // Represents an empty directory for a pod.
 // Empty directory volumes support ownership management and SELinux relabeling.
-EmptyDirVolumeSource :: {
+#EmptyDirVolumeSource: {
 	// What type of storage medium should back this directory.
 	// The default is "" which means to use the node's default medium.
 	// Must be an empty string (default) or Memory.
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
 	// +optional
-	medium?: StorageMedium @go(Medium) @protobuf(1,bytes,opt,casttype=StorageMedium)
+	medium?: #StorageMedium @go(Medium) @protobuf(1,bytes,opt,casttype=StorageMedium)
 
 	// Total amount of local storage required for this EmptyDir volume.
 	// The size limit is also applicable for memory medium.
@@ -720,12 +720,12 @@
 	// The default is nil which means that the limit is undefined.
 	// More info: http://kubernetes.io/docs/user-guide/volumes#emptydir
 	// +optional
-	sizeLimit?: null | resource.Quantity @go(SizeLimit,*resource.Quantity) @protobuf(2,bytes,opt)
+	sizeLimit?: null | resource.#Quantity @go(SizeLimit,*resource.Quantity) @protobuf(2,bytes,opt)
 }
 
 // Represents a Glusterfs mount that lasts the lifetime of a pod.
 // Glusterfs volumes do not support ownership management or SELinux relabeling.
-GlusterfsVolumeSource :: {
+#GlusterfsVolumeSource: {
 	// EndpointsName is the endpoint name that details Glusterfs topology.
 	// More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
 	endpoints: string @go(EndpointsName) @protobuf(1,bytes,opt)
@@ -743,7 +743,7 @@
 
 // Represents a Glusterfs mount that lasts the lifetime of a pod.
 // Glusterfs volumes do not support ownership management or SELinux relabeling.
-GlusterfsPersistentVolumeSource :: {
+#GlusterfsPersistentVolumeSource: {
 	// EndpointsName is the endpoint name that details Glusterfs topology.
 	// More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
 	endpoints: string @go(EndpointsName) @protobuf(1,bytes,opt)
@@ -767,7 +767,7 @@
 
 // Represents a Rados Block Device mount that lasts the lifetime of a pod.
 // RBD volumes support ownership management and SELinux relabeling.
-RBDVolumeSource :: {
+#RBDVolumeSource: {
 	// A collection of Ceph monitors.
 	// More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
 	monitors: [...string] @go(CephMonitors,[]string) @protobuf(1,bytes,rep)
@@ -807,7 +807,7 @@
 	// Default is nil.
 	// More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
 	// +optional
-	secretRef?: null | LocalObjectReference @go(SecretRef,*LocalObjectReference) @protobuf(7,bytes,opt)
+	secretRef?: null | #LocalObjectReference @go(SecretRef,*LocalObjectReference) @protobuf(7,bytes,opt)
 
 	// ReadOnly here will force the ReadOnly setting in VolumeMounts.
 	// Defaults to false.
@@ -818,7 +818,7 @@
 
 // Represents a Rados Block Device mount that lasts the lifetime of a pod.
 // RBD volumes support ownership management and SELinux relabeling.
-RBDPersistentVolumeSource :: {
+#RBDPersistentVolumeSource: {
 	// A collection of Ceph monitors.
 	// More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
 	monitors: [...string] @go(CephMonitors,[]string) @protobuf(1,bytes,rep)
@@ -858,7 +858,7 @@
 	// Default is nil.
 	// More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
 	// +optional
-	secretRef?: null | SecretReference @go(SecretRef,*SecretReference) @protobuf(7,bytes,opt)
+	secretRef?: null | #SecretReference @go(SecretRef,*SecretReference) @protobuf(7,bytes,opt)
 
 	// ReadOnly here will force the ReadOnly setting in VolumeMounts.
 	// Defaults to false.
@@ -871,7 +871,7 @@
 // A Cinder volume must exist before mounting to a container.
 // The volume must also be in the same region as the kubelet.
 // Cinder volumes support ownership management and SELinux relabeling.
-CinderVolumeSource :: {
+#CinderVolumeSource: {
 	// volume id used to identify the volume in cinder.
 	// More info: https://examples.k8s.io/mysql-cinder-pd/README.md
 	volumeID: string @go(VolumeID) @protobuf(1,bytes,opt)
@@ -892,14 +892,14 @@
 	// Optional: points to a secret object containing parameters used to connect
 	// to OpenStack.
 	// +optional
-	secretRef?: null | LocalObjectReference @go(SecretRef,*LocalObjectReference) @protobuf(4,bytes,opt)
+	secretRef?: null | #LocalObjectReference @go(SecretRef,*LocalObjectReference) @protobuf(4,bytes,opt)
 }
 
 // Represents a cinder volume resource in Openstack.
 // A Cinder volume must exist before mounting to a container.
 // The volume must also be in the same region as the kubelet.
 // Cinder volumes support ownership management and SELinux relabeling.
-CinderPersistentVolumeSource :: {
+#CinderPersistentVolumeSource: {
 	// volume id used to identify the volume in cinder.
 	// More info: https://examples.k8s.io/mysql-cinder-pd/README.md
 	volumeID: string @go(VolumeID) @protobuf(1,bytes,opt)
@@ -920,12 +920,12 @@
 	// Optional: points to a secret object containing parameters used to connect
 	// to OpenStack.
 	// +optional
-	secretRef?: null | SecretReference @go(SecretRef,*SecretReference) @protobuf(4,bytes,opt)
+	secretRef?: null | #SecretReference @go(SecretRef,*SecretReference) @protobuf(4,bytes,opt)
 }
 
 // Represents a Ceph Filesystem mount that lasts the lifetime of a pod
 // Cephfs volumes do not support ownership management or SELinux relabeling.
-CephFSVolumeSource :: {
+#CephFSVolumeSource: {
 	// Required: Monitors is a collection of Ceph monitors
 	// More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
 	monitors: [...string] @go(Monitors,[]string) @protobuf(1,bytes,rep)
@@ -947,7 +947,7 @@
 	// Optional: SecretRef is reference to the authentication secret for User, default is empty.
 	// More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
 	// +optional
-	secretRef?: null | LocalObjectReference @go(SecretRef,*LocalObjectReference) @protobuf(5,bytes,opt)
+	secretRef?: null | #LocalObjectReference @go(SecretRef,*LocalObjectReference) @protobuf(5,bytes,opt)
 
 	// Optional: Defaults to false (read/write). ReadOnly here will force
 	// the ReadOnly setting in VolumeMounts.
@@ -958,7 +958,7 @@
 
 // SecretReference represents a Secret Reference. It has enough information to retrieve secret
 // in any namespace
-SecretReference :: {
+#SecretReference: {
 	// Name is unique within a namespace to reference a secret resource.
 	// +optional
 	name?: string @go(Name) @protobuf(1,bytes,opt)
@@ -970,7 +970,7 @@
 
 // Represents a Ceph Filesystem mount that lasts the lifetime of a pod
 // Cephfs volumes do not support ownership management or SELinux relabeling.
-CephFSPersistentVolumeSource :: {
+#CephFSPersistentVolumeSource: {
 	// Required: Monitors is a collection of Ceph monitors
 	// More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
 	monitors: [...string] @go(Monitors,[]string) @protobuf(1,bytes,rep)
@@ -992,7 +992,7 @@
 	// Optional: SecretRef is reference to the authentication secret for User, default is empty.
 	// More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
 	// +optional
-	secretRef?: null | SecretReference @go(SecretRef,*SecretReference) @protobuf(5,bytes,opt)
+	secretRef?: null | #SecretReference @go(SecretRef,*SecretReference) @protobuf(5,bytes,opt)
 
 	// Optional: Defaults to false (read/write). ReadOnly here will force
 	// the ReadOnly setting in VolumeMounts.
@@ -1004,7 +1004,7 @@
 // Represents a Flocker volume mounted by the Flocker agent.
 // One and only one of datasetName and datasetUUID should be set.
 // Flocker volumes do not support ownership management or SELinux relabeling.
-FlockerVolumeSource :: {
+#FlockerVolumeSource: {
 	// Name of the dataset stored as metadata -> name on the dataset for Flocker
 	// should be considered as deprecated
 	// +optional
@@ -1016,35 +1016,35 @@
 }
 
 // StorageMedium defines ways that storage can be allocated to a volume.
-StorageMedium :: string // enumStorageMedium
+#StorageMedium: string // #enumStorageMedium
 
-enumStorageMedium ::
-	StorageMediumDefault |
-	StorageMediumMemory |
-	StorageMediumHugePages |
-	StorageMediumHugePagesPrefix
+#enumStorageMedium:
+	#StorageMediumDefault |
+	#StorageMediumMemory |
+	#StorageMediumHugePages |
+	#StorageMediumHugePagesPrefix
 
-StorageMediumDefault ::         StorageMedium & ""
-StorageMediumMemory ::          StorageMedium & "Memory"
-StorageMediumHugePages ::       StorageMedium & "HugePages"
-StorageMediumHugePagesPrefix :: StorageMedium & "HugePages-"
+#StorageMediumDefault:         #StorageMedium & ""
+#StorageMediumMemory:          #StorageMedium & "Memory"
+#StorageMediumHugePages:       #StorageMedium & "HugePages"
+#StorageMediumHugePagesPrefix: #StorageMedium & "HugePages-"
 
 // Protocol defines network protocols supported for things like container ports.
-Protocol :: string // enumProtocol
+#Protocol: string // #enumProtocol
 
-enumProtocol ::
-	ProtocolTCP |
-	ProtocolUDP |
-	ProtocolSCTP
+#enumProtocol:
+	#ProtocolTCP |
+	#ProtocolUDP |
+	#ProtocolSCTP
 
 // ProtocolTCP is the TCP protocol.
-ProtocolTCP :: Protocol & "TCP"
+#ProtocolTCP: #Protocol & "TCP"
 
 // ProtocolUDP is the UDP protocol.
-ProtocolUDP :: Protocol & "UDP"
+#ProtocolUDP: #Protocol & "UDP"
 
 // ProtocolSCTP is the SCTP protocol.
-ProtocolSCTP :: Protocol & "SCTP"
+#ProtocolSCTP: #Protocol & "SCTP"
 
 // Represents a Persistent Disk resource in Google Compute Engine.
 //
@@ -1052,7 +1052,7 @@
 // also be in the same GCE project and zone as the kubelet. A GCE PD
 // can only be mounted as read/write once or read-only many times. GCE
 // PDs support ownership management and SELinux relabeling.
-GCEPersistentDiskVolumeSource :: {
+#GCEPersistentDiskVolumeSource: {
 	// Unique name of the PD resource in GCE. Used to identify the disk in GCE.
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
 	pdName: string @go(PDName) @protobuf(1,bytes,opt)
@@ -1082,7 +1082,7 @@
 
 // Represents a Quobyte mount that lasts the lifetime of a pod.
 // Quobyte volumes do not support ownership management or SELinux relabeling.
-QuobyteVolumeSource :: {
+#QuobyteVolumeSource: {
 	// Registry represents a single or multiple Quobyte Registry services
 	// specified as a string as host:port pair (multiple entries are separated with commas)
 	// which acts as the central registry for volumes
@@ -1114,7 +1114,7 @@
 
 // FlexPersistentVolumeSource represents a generic persistent volume resource that is
 // provisioned/attached using an exec based plugin.
-FlexPersistentVolumeSource :: {
+#FlexPersistentVolumeSource: {
 	// Driver is the name of the driver to use for this volume.
 	driver: string @go(Driver) @protobuf(1,bytes,opt)
 
@@ -1130,7 +1130,7 @@
 	// contains more than one secret, all secrets are passed to the plugin
 	// scripts.
 	// +optional
-	secretRef?: null | SecretReference @go(SecretRef,*SecretReference) @protobuf(3,bytes,opt)
+	secretRef?: null | #SecretReference @go(SecretRef,*SecretReference) @protobuf(3,bytes,opt)
 
 	// Optional: Defaults to false (read/write). ReadOnly here will force
 	// the ReadOnly setting in VolumeMounts.
@@ -1144,7 +1144,7 @@
 
 // FlexVolume represents a generic volume resource that is
 // provisioned/attached using an exec based plugin.
-FlexVolumeSource :: {
+#FlexVolumeSource: {
 	// Driver is the name of the driver to use for this volume.
 	driver: string @go(Driver) @protobuf(1,bytes,opt)
 
@@ -1160,7 +1160,7 @@
 	// contains more than one secret, all secrets are passed to the plugin
 	// scripts.
 	// +optional
-	secretRef?: null | LocalObjectReference @go(SecretRef,*LocalObjectReference) @protobuf(3,bytes,opt)
+	secretRef?: null | #LocalObjectReference @go(SecretRef,*LocalObjectReference) @protobuf(3,bytes,opt)
 
 	// Optional: Defaults to false (read/write). ReadOnly here will force
 	// the ReadOnly setting in VolumeMounts.
@@ -1178,7 +1178,7 @@
 // must also be in the same AWS zone as the kubelet. An AWS EBS disk
 // can only be mounted as read/write once. AWS EBS volumes support
 // ownership management and SELinux relabeling.
-AWSElasticBlockStoreVolumeSource :: {
+#AWSElasticBlockStoreVolumeSource: {
 	// Unique ID of the persistent disk resource in AWS (Amazon EBS volume).
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
 	volumeID: string @go(VolumeID) @protobuf(1,bytes,opt)
@@ -1212,7 +1212,7 @@
 // DEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an
 // EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir
 // into the Pod's container.
-GitRepoVolumeSource :: {
+#GitRepoVolumeSource: {
 	// Repository URL
 	repository: string @go(Repository) @protobuf(1,bytes,opt)
 
@@ -1233,7 +1233,7 @@
 // The contents of the target Secret's Data field will be presented in a volume
 // as files using the keys in the Data field as the file names.
 // Secret volumes support ownership management and SELinux relabeling.
-SecretVolumeSource :: {
+#SecretVolumeSource: {
 	// Name of the secret in the pod's namespace to use.
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
 	// +optional
@@ -1247,7 +1247,7 @@
 	// the volume setup will error unless it is marked optional. Paths must be
 	// relative and may not contain the '..' path or start with '..'.
 	// +optional
-	items?: [...KeyToPath] @go(Items,[]KeyToPath) @protobuf(2,bytes,rep)
+	items?: [...#KeyToPath] @go(Items,[]KeyToPath) @protobuf(2,bytes,rep)
 
 	// Optional: mode bits to use on created files by default. Must be a
 	// value between 0 and 0777. Defaults to 0644.
@@ -1262,7 +1262,7 @@
 	optional?: null | bool @go(Optional,*bool) @protobuf(4,varint,opt)
 }
 
-SecretVolumeSourceDefaultMode :: int32 & 0o644
+#SecretVolumeSourceDefaultMode: int32 & 0o644
 
 // Adapts a secret into a projected volume.
 //
@@ -1270,8 +1270,8 @@
 // projected volume as files using the keys in the Data field as the file names.
 // Note that this is identical to a secret volume source without the default
 // mode.
-SecretProjection :: {
-	LocalObjectReference
+#SecretProjection: {
+	#LocalObjectReference
 
 	// If unspecified, each key-value pair in the Data field of the referenced
 	// Secret will be projected into the volume as a file whose name is the
@@ -1281,7 +1281,7 @@
 	// the volume setup will error unless it is marked optional. Paths must be
 	// relative and may not contain the '..' path or start with '..'.
 	// +optional
-	items?: [...KeyToPath] @go(Items,[]KeyToPath) @protobuf(2,bytes,rep)
+	items?: [...#KeyToPath] @go(Items,[]KeyToPath) @protobuf(2,bytes,rep)
 
 	// Specify whether the Secret or its key must be defined
 	// +optional
@@ -1290,7 +1290,7 @@
 
 // Represents an NFS mount that lasts the lifetime of a pod.
 // NFS volumes do not support ownership management or SELinux relabeling.
-NFSVolumeSource :: {
+#NFSVolumeSource: {
 	// Server is the hostname or IP address of the NFS server.
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
 	server: string @go(Server) @protobuf(1,bytes,opt)
@@ -1310,7 +1310,7 @@
 // Represents an ISCSI disk.
 // ISCSI volumes can only be mounted as read/write once.
 // ISCSI volumes support ownership management and SELinux relabeling.
-ISCSIVolumeSource :: {
+#ISCSIVolumeSource: {
 	// iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port
 	// is other than default (typically TCP ports 860 and 3260).
 	targetPortal: string @go(TargetPortal) @protobuf(1,bytes,opt)
@@ -1354,7 +1354,7 @@
 
 	// CHAP Secret for iSCSI target and initiator authentication
 	// +optional
-	secretRef?: null | LocalObjectReference @go(SecretRef,*LocalObjectReference) @protobuf(10,bytes,opt)
+	secretRef?: null | #LocalObjectReference @go(SecretRef,*LocalObjectReference) @protobuf(10,bytes,opt)
 
 	// Custom iSCSI Initiator Name.
 	// If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface
@@ -1366,7 +1366,7 @@
 // ISCSIPersistentVolumeSource represents an ISCSI disk.
 // ISCSI volumes can only be mounted as read/write once.
 // ISCSI volumes support ownership management and SELinux relabeling.
-ISCSIPersistentVolumeSource :: {
+#ISCSIPersistentVolumeSource: {
 	// iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port
 	// is other than default (typically TCP ports 860 and 3260).
 	targetPortal: string @go(TargetPortal) @protobuf(1,bytes,opt)
@@ -1410,7 +1410,7 @@
 
 	// CHAP Secret for iSCSI target and initiator authentication
 	// +optional
-	secretRef?: null | SecretReference @go(SecretRef,*SecretReference) @protobuf(10,bytes,opt)
+	secretRef?: null | #SecretReference @go(SecretRef,*SecretReference) @protobuf(10,bytes,opt)
 
 	// Custom iSCSI Initiator Name.
 	// If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface
@@ -1422,7 +1422,7 @@
 // Represents a Fibre Channel volume.
 // Fibre Channel volumes can only be mounted as read/write once.
 // Fibre Channel volumes support ownership management and SELinux relabeling.
-FCVolumeSource :: {
+#FCVolumeSource: {
 	// Optional: FC target worldwide names (WWNs)
 	// +optional
 	targetWWNs?: [...string] @go(TargetWWNs,[]string) @protobuf(1,bytes,rep)
@@ -1450,7 +1450,7 @@
 }
 
 // AzureFile represents an Azure File Service mount on the host and bind mount to the pod.
-AzureFileVolumeSource :: {
+#AzureFileVolumeSource: {
 	// the name of secret that contains Azure Storage Account Name and Key
 	secretName: string @go(SecretName) @protobuf(1,bytes,opt)
 
@@ -1464,7 +1464,7 @@
 }
 
 // AzureFile represents an Azure File Service mount on the host and bind mount to the pod.
-AzureFilePersistentVolumeSource :: {
+#AzureFilePersistentVolumeSource: {
 	// the name of secret that contains Azure Storage Account Name and Key
 	secretName: string @go(SecretName) @protobuf(1,bytes,opt)
 
@@ -1483,7 +1483,7 @@
 }
 
 // Represents a vSphere volume resource.
-VsphereVirtualDiskVolumeSource :: {
+#VsphereVirtualDiskVolumeSource: {
 	// Path that identifies vSphere volume vmdk
 	volumePath: string @go(VolumePath) @protobuf(1,bytes,opt)
 
@@ -1503,7 +1503,7 @@
 }
 
 // Represents a Photon Controller persistent disk resource.
-PhotonPersistentDiskVolumeSource :: {
+#PhotonPersistentDiskVolumeSource: {
 	// ID that identifies Photon Controller persistent disk
 	pdID: string @go(PdID) @protobuf(1,bytes,opt)
 
@@ -1513,29 +1513,29 @@
 	fsType?: string @go(FSType) @protobuf(2,bytes,opt)
 }
 
-AzureDataDiskCachingMode :: string // enumAzureDataDiskCachingMode
+#AzureDataDiskCachingMode: string // #enumAzureDataDiskCachingMode
 
-enumAzureDataDiskCachingMode ::
-	AzureDataDiskCachingNone |
-	AzureDataDiskCachingReadOnly |
-	AzureDataDiskCachingReadWrite
+#enumAzureDataDiskCachingMode:
+	#AzureDataDiskCachingNone |
+	#AzureDataDiskCachingReadOnly |
+	#AzureDataDiskCachingReadWrite
 
-AzureDataDiskKind :: string // enumAzureDataDiskKind
+#AzureDataDiskKind: string // #enumAzureDataDiskKind
 
-enumAzureDataDiskKind ::
-	AzureSharedBlobDisk |
-	AzureDedicatedBlobDisk |
-	AzureManagedDisk
+#enumAzureDataDiskKind:
+	#AzureSharedBlobDisk |
+	#AzureDedicatedBlobDisk |
+	#AzureManagedDisk
 
-AzureDataDiskCachingNone ::      AzureDataDiskCachingMode & "None"
-AzureDataDiskCachingReadOnly ::  AzureDataDiskCachingMode & "ReadOnly"
-AzureDataDiskCachingReadWrite :: AzureDataDiskCachingMode & "ReadWrite"
-AzureSharedBlobDisk ::           AzureDataDiskKind & "Shared"
-AzureDedicatedBlobDisk ::        AzureDataDiskKind & "Dedicated"
-AzureManagedDisk ::              AzureDataDiskKind & "Managed"
+#AzureDataDiskCachingNone:      #AzureDataDiskCachingMode & "None"
+#AzureDataDiskCachingReadOnly:  #AzureDataDiskCachingMode & "ReadOnly"
+#AzureDataDiskCachingReadWrite: #AzureDataDiskCachingMode & "ReadWrite"
+#AzureSharedBlobDisk:           #AzureDataDiskKind & "Shared"
+#AzureDedicatedBlobDisk:        #AzureDataDiskKind & "Dedicated"
+#AzureManagedDisk:              #AzureDataDiskKind & "Managed"
 
 // AzureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.
-AzureDiskVolumeSource :: {
+#AzureDiskVolumeSource: {
 	// The Name of the data disk in the blob storage
 	diskName: string @go(DiskName) @protobuf(1,bytes,opt)
 
@@ -1544,7 +1544,7 @@
 
 	// Host Caching mode: None, Read Only, Read Write.
 	// +optional
-	cachingMode?: null | AzureDataDiskCachingMode @go(CachingMode,*AzureDataDiskCachingMode) @protobuf(3,bytes,opt,casttype=AzureDataDiskCachingMode)
+	cachingMode?: null | #AzureDataDiskCachingMode @go(CachingMode,*AzureDataDiskCachingMode) @protobuf(3,bytes,opt,casttype=AzureDataDiskCachingMode)
 
 	// Filesystem type to mount.
 	// Must be a filesystem type supported by the host operating system.
@@ -1558,11 +1558,11 @@
 	readOnly?: null | bool @go(ReadOnly,*bool) @protobuf(5,varint,opt)
 
 	// Expected values Shared: multiple blob disks per storage account  Dedicated: single blob disk per storage account  Managed: azure managed data disk (only in managed availability set). defaults to shared
-	kind?: null | AzureDataDiskKind @go(Kind,*AzureDataDiskKind) @protobuf(6,bytes,opt,casttype=AzureDataDiskKind)
+	kind?: null | #AzureDataDiskKind @go(Kind,*AzureDataDiskKind) @protobuf(6,bytes,opt,casttype=AzureDataDiskKind)
 }
 
 // PortworxVolumeSource represents a Portworx volume resource.
-PortworxVolumeSource :: {
+#PortworxVolumeSource: {
 	// VolumeID uniquely identifies a Portworx volume
 	volumeID: string @go(VolumeID) @protobuf(1,bytes,opt)
 
@@ -1578,7 +1578,7 @@
 }
 
 // ScaleIOVolumeSource represents a persistent ScaleIO volume
-ScaleIOVolumeSource :: {
+#ScaleIOVolumeSource: {
 	// The host address of the ScaleIO API Gateway.
 	gateway: string @go(Gateway) @protobuf(1,bytes,opt)
 
@@ -1587,7 +1587,7 @@
 
 	// SecretRef references to the secret for ScaleIO user and other
 	// sensitive information. If this is not provided, Login operation will fail.
-	secretRef?: null | LocalObjectReference @go(SecretRef,*LocalObjectReference) @protobuf(3,bytes,opt)
+	secretRef?: null | #LocalObjectReference @go(SecretRef,*LocalObjectReference) @protobuf(3,bytes,opt)
 
 	// Flag to enable/disable SSL communication with Gateway, default false
 	// +optional
@@ -1624,7 +1624,7 @@
 }
 
 // ScaleIOPersistentVolumeSource represents a persistent ScaleIO volume
-ScaleIOPersistentVolumeSource :: {
+#ScaleIOPersistentVolumeSource: {
 	// The host address of the ScaleIO API Gateway.
 	gateway: string @go(Gateway) @protobuf(1,bytes,opt)
 
@@ -1633,7 +1633,7 @@
 
 	// SecretRef references to the secret for ScaleIO user and other
 	// sensitive information. If this is not provided, Login operation will fail.
-	secretRef?: null | SecretReference @go(SecretRef,*SecretReference) @protobuf(3,bytes,opt)
+	secretRef?: null | #SecretReference @go(SecretRef,*SecretReference) @protobuf(3,bytes,opt)
 
 	// Flag to enable/disable SSL communication with Gateway, default false
 	// +optional
@@ -1670,7 +1670,7 @@
 }
 
 // Represents a StorageOS persistent volume resource.
-StorageOSVolumeSource :: {
+#StorageOSVolumeSource: {
 	// VolumeName is the human-readable name of the StorageOS volume.  Volume
 	// names are only unique within a namespace.
 	volumeName?: string @go(VolumeName) @protobuf(1,bytes,opt)
@@ -1698,11 +1698,11 @@
 	// SecretRef specifies the secret to use for obtaining the StorageOS API
 	// credentials.  If not specified, default values will be attempted.
 	// +optional
-	secretRef?: null | LocalObjectReference @go(SecretRef,*LocalObjectReference) @protobuf(5,bytes,opt)
+	secretRef?: null | #LocalObjectReference @go(SecretRef,*LocalObjectReference) @protobuf(5,bytes,opt)
 }
 
 // Represents a StorageOS persistent volume resource.
-StorageOSPersistentVolumeSource :: {
+#StorageOSPersistentVolumeSource: {
 	// VolumeName is the human-readable name of the StorageOS volume.  Volume
 	// names are only unique within a namespace.
 	volumeName?: string @go(VolumeName) @protobuf(1,bytes,opt)
@@ -1730,7 +1730,7 @@
 	// SecretRef specifies the secret to use for obtaining the StorageOS API
 	// credentials.  If not specified, default values will be attempted.
 	// +optional
-	secretRef?: null | ObjectReference @go(SecretRef,*ObjectReference) @protobuf(5,bytes,opt)
+	secretRef?: null | #ObjectReference @go(SecretRef,*ObjectReference) @protobuf(5,bytes,opt)
 }
 
 // Adapts a ConfigMap into a volume.
@@ -1739,8 +1739,8 @@
 // volume as files using the keys in the Data field as the file names, unless
 // the items element is populated with specific mappings of keys to paths.
 // ConfigMap volumes support ownership management and SELinux relabeling.
-ConfigMapVolumeSource :: {
-	LocalObjectReference
+#ConfigMapVolumeSource: {
+	#LocalObjectReference
 
 	// If unspecified, each key-value pair in the Data field of the referenced
 	// ConfigMap will be projected into the volume as a file whose name is the
@@ -1750,7 +1750,7 @@
 	// the volume setup will error unless it is marked optional. Paths must be
 	// relative and may not contain the '..' path or start with '..'.
 	// +optional
-	items?: [...KeyToPath] @go(Items,[]KeyToPath) @protobuf(2,bytes,rep)
+	items?: [...#KeyToPath] @go(Items,[]KeyToPath) @protobuf(2,bytes,rep)
 
 	// Optional: mode bits to use on created files by default. Must be a
 	// value between 0 and 0777. Defaults to 0644.
@@ -1765,7 +1765,7 @@
 	optional?: null | bool @go(Optional,*bool) @protobuf(4,varint,opt)
 }
 
-ConfigMapVolumeSourceDefaultMode :: int32 & 0o644
+#ConfigMapVolumeSourceDefaultMode: int32 & 0o644
 
 // Adapts a ConfigMap into a projected volume.
 //
@@ -1774,8 +1774,8 @@
 // unless the items element is populated with specific mappings of keys to paths.
 // Note that this is identical to a configmap volume source without the default
 // mode.
-ConfigMapProjection :: {
-	LocalObjectReference
+#ConfigMapProjection: {
+	#LocalObjectReference
 
 	// If unspecified, each key-value pair in the Data field of the referenced
 	// ConfigMap will be projected into the volume as a file whose name is the
@@ -1785,7 +1785,7 @@
 	// the volume setup will error unless it is marked optional. Paths must be
 	// relative and may not contain the '..' path or start with '..'.
 	// +optional
-	items?: [...KeyToPath] @go(Items,[]KeyToPath) @protobuf(2,bytes,rep)
+	items?: [...#KeyToPath] @go(Items,[]KeyToPath) @protobuf(2,bytes,rep)
 
 	// Specify whether the ConfigMap or its keys must be defined
 	// +optional
@@ -1796,7 +1796,7 @@
 // volume. This projection can be used to insert a service account token into
 // the pods runtime filesystem for use against APIs (Kubernetes API Server or
 // otherwise).
-ServiceAccountTokenProjection :: {
+#ServiceAccountTokenProjection: {
 	// Audience is the intended audience of the token. A recipient of a token
 	// must identify itself with an identifier specified in the audience of the
 	// token, and otherwise should reject the token. The audience defaults to the
@@ -1819,9 +1819,9 @@
 }
 
 // Represents a projected volume source
-ProjectedVolumeSource :: {
+#ProjectedVolumeSource: {
 	// list of volume projections
-	sources: [...VolumeProjection] @go(Sources,[]VolumeProjection) @protobuf(1,bytes,rep)
+	sources: [...#VolumeProjection] @go(Sources,[]VolumeProjection) @protobuf(1,bytes,rep)
 
 	// Mode bits to use on created files by default. Must be a value between
 	// 0 and 0777.
@@ -1833,28 +1833,28 @@
 }
 
 // Projection that may be projected along with other supported volume types
-VolumeProjection :: {
+#VolumeProjection: {
 	// information about the secret data to project
 	// +optional
-	secret?: null | SecretProjection @go(Secret,*SecretProjection) @protobuf(1,bytes,opt)
+	secret?: null | #SecretProjection @go(Secret,*SecretProjection) @protobuf(1,bytes,opt)
 
 	// information about the downwardAPI data to project
 	// +optional
-	downwardAPI?: null | DownwardAPIProjection @go(DownwardAPI,*DownwardAPIProjection) @protobuf(2,bytes,opt)
+	downwardAPI?: null | #DownwardAPIProjection @go(DownwardAPI,*DownwardAPIProjection) @protobuf(2,bytes,opt)
 
 	// information about the configMap data to project
 	// +optional
-	configMap?: null | ConfigMapProjection @go(ConfigMap,*ConfigMapProjection) @protobuf(3,bytes,opt)
+	configMap?: null | #ConfigMapProjection @go(ConfigMap,*ConfigMapProjection) @protobuf(3,bytes,opt)
 
 	// information about the serviceAccountToken data to project
 	// +optional
-	serviceAccountToken?: null | ServiceAccountTokenProjection @go(ServiceAccountToken,*ServiceAccountTokenProjection) @protobuf(4,bytes,opt)
+	serviceAccountToken?: null | #ServiceAccountTokenProjection @go(ServiceAccountToken,*ServiceAccountTokenProjection) @protobuf(4,bytes,opt)
 }
 
-ProjectedVolumeSourceDefaultMode :: int32 & 0o644
+#ProjectedVolumeSourceDefaultMode: int32 & 0o644
 
 // Maps a string key to a path within a volume.
-KeyToPath :: {
+#KeyToPath: {
 	// The key to project.
 	key: string @go(Key) @protobuf(1,bytes,opt)
 
@@ -1873,7 +1873,7 @@
 }
 
 // Local represents directly-attached storage with node affinity (Beta feature)
-LocalVolumeSource :: {
+#LocalVolumeSource: {
 	// The full path to the volume on the node.
 	// It can be either a directory or block device (disk, partition, ...).
 	path: string @go(Path) @protobuf(1,bytes,opt)
@@ -1887,7 +1887,7 @@
 }
 
 // Represents storage that is managed by an external CSI volume driver (Beta feature)
-CSIPersistentVolumeSource :: {
+#CSIPersistentVolumeSource: {
 	// Driver is the name of the driver to use for this volume.
 	// Required.
 	driver: string @go(Driver) @protobuf(1,bytes,opt)
@@ -1918,7 +1918,7 @@
 	// This field is optional, and may be empty if no secret is required. If the
 	// secret object contains more than one secret, all secrets are passed.
 	// +optional
-	controllerPublishSecretRef?: null | SecretReference @go(ControllerPublishSecretRef,*SecretReference) @protobuf(6,bytes,opt)
+	controllerPublishSecretRef?: null | #SecretReference @go(ControllerPublishSecretRef,*SecretReference) @protobuf(6,bytes,opt)
 
 	// NodeStageSecretRef is a reference to the secret object containing sensitive
 	// information to pass to the CSI driver to complete the CSI NodeStageVolume
@@ -1926,7 +1926,7 @@
 	// This field is optional, and may be empty if no secret is required. If the
 	// secret object contains more than one secret, all secrets are passed.
 	// +optional
-	nodeStageSecretRef?: null | SecretReference @go(NodeStageSecretRef,*SecretReference) @protobuf(7,bytes,opt)
+	nodeStageSecretRef?: null | #SecretReference @go(NodeStageSecretRef,*SecretReference) @protobuf(7,bytes,opt)
 
 	// NodePublishSecretRef is a reference to the secret object containing
 	// sensitive information to pass to the CSI driver to complete the CSI
@@ -1934,7 +1934,7 @@
 	// This field is optional, and may be empty if no secret is required. If the
 	// secret object contains more than one secret, all secrets are passed.
 	// +optional
-	nodePublishSecretRef?: null | SecretReference @go(NodePublishSecretRef,*SecretReference) @protobuf(8,bytes,opt)
+	nodePublishSecretRef?: null | #SecretReference @go(NodePublishSecretRef,*SecretReference) @protobuf(8,bytes,opt)
 
 	// ControllerExpandSecretRef is a reference to the secret object containing
 	// sensitive information to pass to the CSI driver to complete the CSI
@@ -1943,11 +1943,11 @@
 	// This field is optional, and may be empty if no secret is required. If the
 	// secret object contains more than one secret, all secrets are passed.
 	// +optional
-	controllerExpandSecretRef?: null | SecretReference @go(ControllerExpandSecretRef,*SecretReference) @protobuf(9,bytes,opt)
+	controllerExpandSecretRef?: null | #SecretReference @go(ControllerExpandSecretRef,*SecretReference) @protobuf(9,bytes,opt)
 }
 
 // Represents a source location of a volume to mount, managed by an external CSI driver
-CSIVolumeSource :: {
+#CSIVolumeSource: {
 	// Driver is the name of the CSI driver that handles this volume.
 	// Consult with your admin for the correct name as registered in the cluster.
 	driver: string @go(Driver) @protobuf(1,bytes,opt)
@@ -1974,11 +1974,11 @@
 	// This field is optional, and  may be empty if no secret is required. If the
 	// secret object contains more than one secret, all secret references are passed.
 	// +optional
-	nodePublishSecretRef?: null | LocalObjectReference @go(NodePublishSecretRef,*LocalObjectReference) @protobuf(5,bytes,opt)
+	nodePublishSecretRef?: null | #LocalObjectReference @go(NodePublishSecretRef,*LocalObjectReference) @protobuf(5,bytes,opt)
 }
 
 // ContainerPort represents a network port in a single container.
-ContainerPort :: {
+#ContainerPort: {
 	// If specified, this must be an IANA_SVC_NAME and unique within the pod. Each
 	// named port in a pod must have a unique name. Name for the port that can be
 	// referred to by services.
@@ -1999,7 +1999,7 @@
 	// Protocol for port. Must be UDP, TCP, or SCTP.
 	// Defaults to "TCP".
 	// +optional
-	protocol?: Protocol @go(Protocol) @protobuf(4,bytes,opt,casttype=Protocol)
+	protocol?: #Protocol @go(Protocol) @protobuf(4,bytes,opt,casttype=Protocol)
 
 	// What host IP to bind the external port to.
 	// +optional
@@ -2007,7 +2007,7 @@
 }
 
 // VolumeMount describes a mounting of a Volume within a container.
-VolumeMount :: {
+#VolumeMount: {
 	// This must match the Name of a Volume.
 	name: string @go(Name) @protobuf(1,bytes,opt)
 
@@ -2030,7 +2030,7 @@
 	// When not set, MountPropagationNone is used.
 	// This field is beta in 1.10.
 	// +optional
-	mountPropagation?: null | MountPropagationMode @go(MountPropagation,*MountPropagationMode) @protobuf(5,bytes,opt,casttype=MountPropagationMode)
+	mountPropagation?: null | #MountPropagationMode @go(MountPropagation,*MountPropagationMode) @protobuf(5,bytes,opt,casttype=MountPropagationMode)
 
 	// Expanded path within the volume from which the container's volume should be mounted.
 	// Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.
@@ -2041,19 +2041,19 @@
 }
 
 // MountPropagationMode describes mount propagation.
-MountPropagationMode :: string // enumMountPropagationMode
+#MountPropagationMode: string // #enumMountPropagationMode
 
-enumMountPropagationMode ::
-	MountPropagationNone |
-	MountPropagationHostToContainer |
-	MountPropagationBidirectional
+#enumMountPropagationMode:
+	#MountPropagationNone |
+	#MountPropagationHostToContainer |
+	#MountPropagationBidirectional
 
 // MountPropagationNone means that the volume in a container will
 // not receive new mounts from the host or other containers, and filesystems
 // mounted inside the container won't be propagated to the host or other
 // containers.
 // Note that this mode corresponds to "private" in Linux terminology.
-MountPropagationNone :: MountPropagationMode & "None"
+#MountPropagationNone: #MountPropagationMode & "None"
 
 // MountPropagationHostToContainer means that the volume in a container will
 // receive new mounts from the host or other containers, but filesystems
@@ -2061,17 +2061,17 @@
 // containers.
 // Note that this mode is recursively applied to all mounts in the volume
 // ("rslave" in Linux terminology).
-MountPropagationHostToContainer :: MountPropagationMode & "HostToContainer"
+#MountPropagationHostToContainer: #MountPropagationMode & "HostToContainer"
 
 // MountPropagationBidirectional means that the volume in a container will
 // receive new mounts from the host or other containers, and its own mounts
 // will be propagated from the container to the host or other containers.
 // Note that this mode is recursively applied to all mounts in the volume
 // ("rshared" in Linux terminology).
-MountPropagationBidirectional :: MountPropagationMode & "Bidirectional"
+#MountPropagationBidirectional: #MountPropagationMode & "Bidirectional"
 
 // volumeDevice describes a mapping of a raw block device within a container.
-VolumeDevice :: {
+#VolumeDevice: {
 	// name must match the name of a persistentVolumeClaim in the pod
 	name: string @go(Name) @protobuf(1,bytes,opt)
 
@@ -2080,7 +2080,7 @@
 }
 
 // EnvVar represents an environment variable present in a Container.
-EnvVar :: {
+#EnvVar: {
 	// Name of the environment variable. Must be a C_IDENTIFIER.
 	name: string @go(Name) @protobuf(1,bytes,opt)
 
@@ -2097,32 +2097,32 @@
 
 	// Source for the environment variable's value. Cannot be used if value is not empty.
 	// +optional
-	valueFrom?: null | EnvVarSource @go(ValueFrom,*EnvVarSource) @protobuf(3,bytes,opt)
+	valueFrom?: null | #EnvVarSource @go(ValueFrom,*EnvVarSource) @protobuf(3,bytes,opt)
 }
 
 // EnvVarSource represents a source for the value of an EnvVar.
-EnvVarSource :: {
+#EnvVarSource: {
 	// Selects a field of the pod: supports metadata.name, metadata.namespace, metadata.labels, metadata.annotations,
 	// spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
 	// +optional
-	fieldRef?: null | ObjectFieldSelector @go(FieldRef,*ObjectFieldSelector) @protobuf(1,bytes,opt)
+	fieldRef?: null | #ObjectFieldSelector @go(FieldRef,*ObjectFieldSelector) @protobuf(1,bytes,opt)
 
 	// Selects a resource of the container: only resources limits and requests
 	// (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
 	// +optional
-	resourceFieldRef?: null | ResourceFieldSelector @go(ResourceFieldRef,*ResourceFieldSelector) @protobuf(2,bytes,opt)
+	resourceFieldRef?: null | #ResourceFieldSelector @go(ResourceFieldRef,*ResourceFieldSelector) @protobuf(2,bytes,opt)
 
 	// Selects a key of a ConfigMap.
 	// +optional
-	configMapKeyRef?: null | ConfigMapKeySelector @go(ConfigMapKeyRef,*ConfigMapKeySelector) @protobuf(3,bytes,opt)
+	configMapKeyRef?: null | #ConfigMapKeySelector @go(ConfigMapKeyRef,*ConfigMapKeySelector) @protobuf(3,bytes,opt)
 
 	// Selects a key of a secret in the pod's namespace
 	// +optional
-	secretKeyRef?: null | SecretKeySelector @go(SecretKeyRef,*SecretKeySelector) @protobuf(4,bytes,opt)
+	secretKeyRef?: null | #SecretKeySelector @go(SecretKeyRef,*SecretKeySelector) @protobuf(4,bytes,opt)
 }
 
 // ObjectFieldSelector selects an APIVersioned field of an object.
-ObjectFieldSelector :: {
+#ObjectFieldSelector: {
 	// Version of the schema the FieldPath is written in terms of, defaults to "v1".
 	// +optional
 	apiVersion?: string @go(APIVersion) @protobuf(1,bytes,opt)
@@ -2132,7 +2132,7 @@
 }
 
 // ResourceFieldSelector represents container resources (cpu, memory) and their output format
-ResourceFieldSelector :: {
+#ResourceFieldSelector: {
 	// Container name: required for volumes, optional for env vars
 	// +optional
 	containerName?: string @go(ContainerName) @protobuf(1,bytes,opt)
@@ -2142,12 +2142,12 @@
 
 	// Specifies the output format of the exposed resources, defaults to "1"
 	// +optional
-	divisor?: resource.Quantity @go(Divisor) @protobuf(3,bytes,opt)
+	divisor?: resource.#Quantity @go(Divisor) @protobuf(3,bytes,opt)
 }
 
 // Selects a key from a ConfigMap.
-ConfigMapKeySelector :: {
-	LocalObjectReference
+#ConfigMapKeySelector: {
+	#LocalObjectReference
 
 	// The key to select.
 	key: string @go(Key) @protobuf(2,bytes,opt)
@@ -2158,8 +2158,8 @@
 }
 
 // SecretKeySelector selects a key of a Secret.
-SecretKeySelector :: {
-	LocalObjectReference
+#SecretKeySelector: {
+	#LocalObjectReference
 
 	// The key of the secret to select from.  Must be a valid secret key.
 	key: string @go(Key) @protobuf(2,bytes,opt)
@@ -2170,18 +2170,18 @@
 }
 
 // EnvFromSource represents the source of a set of ConfigMaps
-EnvFromSource :: {
+#EnvFromSource: {
 	// An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
 	// +optional
 	prefix?: string @go(Prefix) @protobuf(1,bytes,opt)
 
 	// The ConfigMap to select from
 	// +optional
-	configMapRef?: null | ConfigMapEnvSource @go(ConfigMapRef,*ConfigMapEnvSource) @protobuf(2,bytes,opt)
+	configMapRef?: null | #ConfigMapEnvSource @go(ConfigMapRef,*ConfigMapEnvSource) @protobuf(2,bytes,opt)
 
 	// The Secret to select from
 	// +optional
-	secretRef?: null | SecretEnvSource @go(SecretRef,*SecretEnvSource) @protobuf(3,bytes,opt)
+	secretRef?: null | #SecretEnvSource @go(SecretRef,*SecretEnvSource) @protobuf(3,bytes,opt)
 }
 
 // ConfigMapEnvSource selects a ConfigMap to populate the environment
@@ -2189,8 +2189,8 @@
 //
 // The contents of the target ConfigMap's Data field will represent the
 // key-value pairs as environment variables.
-ConfigMapEnvSource :: {
-	LocalObjectReference
+#ConfigMapEnvSource: {
+	#LocalObjectReference
 
 	// Specify whether the ConfigMap must be defined
 	// +optional
@@ -2202,8 +2202,8 @@
 //
 // The contents of the target Secret's Data field will represent the
 // key-value pairs as environment variables.
-SecretEnvSource :: {
-	LocalObjectReference
+#SecretEnvSource: {
+	#LocalObjectReference
 
 	// Specify whether the Secret must be defined
 	// +optional
@@ -2211,7 +2211,7 @@
 }
 
 // HTTPHeader describes a custom header to be used in HTTP probes
-HTTPHeader :: {
+#HTTPHeader: {
 	// The header field name
 	name: string @go(Name) @protobuf(1,bytes,opt)
 
@@ -2220,7 +2220,7 @@
 }
 
 // HTTPGetAction describes an action based on HTTP Get requests.
-HTTPGetAction :: {
+#HTTPGetAction: {
 	// Path to access on the HTTP server.
 	// +optional
 	path?: string @go(Path) @protobuf(1,bytes,opt)
@@ -2228,7 +2228,7 @@
 	// Name or number of the port to access on the container.
 	// Number must be in the range 1 to 65535.
 	// Name must be an IANA_SVC_NAME.
-	port: intstr.IntOrString @go(Port) @protobuf(2,bytes,opt)
+	port: intstr.#IntOrString @go(Port) @protobuf(2,bytes,opt)
 
 	// Host name to connect to, defaults to the pod IP. You probably want to set
 	// "Host" in httpHeaders instead.
@@ -2238,32 +2238,32 @@
 	// Scheme to use for connecting to the host.
 	// Defaults to HTTP.
 	// +optional
-	scheme?: URIScheme @go(Scheme) @protobuf(4,bytes,opt,casttype=URIScheme)
+	scheme?: #URIScheme @go(Scheme) @protobuf(4,bytes,opt,casttype=URIScheme)
 
 	// Custom headers to set in the request. HTTP allows repeated headers.
 	// +optional
-	httpHeaders?: [...HTTPHeader] @go(HTTPHeaders,[]HTTPHeader) @protobuf(5,bytes,rep)
+	httpHeaders?: [...#HTTPHeader] @go(HTTPHeaders,[]HTTPHeader) @protobuf(5,bytes,rep)
 }
 
 // URIScheme identifies the scheme used for connection to a host for Get actions
-URIScheme :: string // enumURIScheme
+#URIScheme: string // #enumURIScheme
 
-enumURIScheme ::
-	URISchemeHTTP |
-	URISchemeHTTPS
+#enumURIScheme:
+	#URISchemeHTTP |
+	#URISchemeHTTPS
 
 // URISchemeHTTP means that the scheme used will be http://
-URISchemeHTTP :: URIScheme & "HTTP"
+#URISchemeHTTP: #URIScheme & "HTTP"
 
 // URISchemeHTTPS means that the scheme used will be https://
-URISchemeHTTPS :: URIScheme & "HTTPS"
+#URISchemeHTTPS: #URIScheme & "HTTPS"
 
 // TCPSocketAction describes an action based on opening a socket
-TCPSocketAction :: {
+#TCPSocketAction: {
 	// Number or name of the port to access on the container.
 	// Number must be in the range 1 to 65535.
 	// Name must be an IANA_SVC_NAME.
-	port: intstr.IntOrString @go(Port) @protobuf(1,bytes,opt)
+	port: intstr.#IntOrString @go(Port) @protobuf(1,bytes,opt)
 
 	// Optional: Host name to connect to, defaults to the pod IP.
 	// +optional
@@ -2271,7 +2271,7 @@
 }
 
 // ExecAction describes a "run in container" action.
-ExecAction :: {
+#ExecAction: {
 	// Command is the command line to execute inside the container, the working directory for the
 	// command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
 	// not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
@@ -2283,8 +2283,8 @@
 
 // Probe describes a health check to be performed against a container to determine whether it is
 // alive or ready to receive traffic.
-Probe :: {
-	Handler
+#Probe: {
+	#Handler
 
 	// Number of seconds after the container has started before liveness probes are initiated.
 	// More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
@@ -2314,85 +2314,85 @@
 }
 
 // PullPolicy describes a policy for if/when to pull a container image
-PullPolicy :: string // enumPullPolicy
+#PullPolicy: string // #enumPullPolicy
 
-enumPullPolicy ::
-	PullAlways |
-	PullNever |
-	PullIfNotPresent
+#enumPullPolicy:
+	#PullAlways |
+	#PullNever |
+	#PullIfNotPresent
 
 // PullAlways means that kubelet always attempts to pull the latest image. Container will fail If the pull fails.
-PullAlways :: PullPolicy & "Always"
+#PullAlways: #PullPolicy & "Always"
 
 // PullNever means that kubelet never pulls an image, but only uses a local image. Container will fail if the image isn't present
-PullNever :: PullPolicy & "Never"
+#PullNever: #PullPolicy & "Never"
 
 // PullIfNotPresent means that kubelet pulls if the image isn't present on disk. Container will fail if the image isn't present and the pull fails.
-PullIfNotPresent :: PullPolicy & "IfNotPresent"
+#PullIfNotPresent: #PullPolicy & "IfNotPresent"
 
 // PreemptionPolicy describes a policy for if/when to preempt a pod.
-PreemptionPolicy :: string // enumPreemptionPolicy
+#PreemptionPolicy: string // #enumPreemptionPolicy
 
-enumPreemptionPolicy ::
-	PreemptLowerPriority |
-	PreemptNever
+#enumPreemptionPolicy:
+	#PreemptLowerPriority |
+	#PreemptNever
 
 // PreemptLowerPriority means that pod can preempt other pods with lower priority.
-PreemptLowerPriority :: PreemptionPolicy & "PreemptLowerPriority"
+#PreemptLowerPriority: #PreemptionPolicy & "PreemptLowerPriority"
 
 // PreemptNever means that pod never preempts other pods with lower priority.
-PreemptNever :: PreemptionPolicy & "Never"
+#PreemptNever: #PreemptionPolicy & "Never"
 
 // TerminationMessagePolicy describes how termination messages are retrieved from a container.
-TerminationMessagePolicy :: string // enumTerminationMessagePolicy
+#TerminationMessagePolicy: string // #enumTerminationMessagePolicy
 
-enumTerminationMessagePolicy ::
-	TerminationMessageReadFile |
-	TerminationMessageFallbackToLogsOnError
+#enumTerminationMessagePolicy:
+	#TerminationMessageReadFile |
+	#TerminationMessageFallbackToLogsOnError
 
 // TerminationMessageReadFile is the default behavior and will set the container status message to
 // the contents of the container's terminationMessagePath when the container exits.
-TerminationMessageReadFile :: TerminationMessagePolicy & "File"
+#TerminationMessageReadFile: #TerminationMessagePolicy & "File"
 
 // TerminationMessageFallbackToLogsOnError will read the most recent contents of the container logs
 // for the container status message when the container exits with an error and the
 // terminationMessagePath has no contents.
-TerminationMessageFallbackToLogsOnError :: TerminationMessagePolicy & "FallbackToLogsOnError"
+#TerminationMessageFallbackToLogsOnError: #TerminationMessagePolicy & "FallbackToLogsOnError"
 
 // Capability represent POSIX capabilities type
-Capability :: string
+#Capability: string
 
 // Adds and removes POSIX capabilities from running containers.
-Capabilities :: {
+#Capabilities: {
 	// Added capabilities
 	// +optional
-	add?: [...Capability] @go(Add,[]Capability) @protobuf(1,bytes,rep,casttype=Capability)
+	add?: [...#Capability] @go(Add,[]Capability) @protobuf(1,bytes,rep,casttype=Capability)
 
 	// Removed capabilities
 	// +optional
-	drop?: [...Capability] @go(Drop,[]Capability) @protobuf(2,bytes,rep,casttype=Capability)
+	drop?: [...#Capability] @go(Drop,[]Capability) @protobuf(2,bytes,rep,casttype=Capability)
 }
 
 // ResourceRequirements describes the compute resource requirements.
-ResourceRequirements :: {
+#ResourceRequirements: {
 	// Limits describes the maximum amount of compute resources allowed.
 	// More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
 	// +optional
-	limits?: ResourceList @go(Limits) @protobuf(1,bytes,rep,casttype=ResourceList,castkey=ResourceName)
+	limits?: #ResourceList @go(Limits) @protobuf(1,bytes,rep,casttype=ResourceList,castkey=ResourceName)
 
 	// Requests describes the minimum amount of compute resources required.
 	// If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
 	// otherwise to an implementation-defined value.
 	// More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
 	// +optional
-	requests?: ResourceList @go(Requests) @protobuf(2,bytes,rep,casttype=ResourceList,castkey=ResourceName)
+	requests?: #ResourceList @go(Requests) @protobuf(2,bytes,rep,casttype=ResourceList,castkey=ResourceName)
 }
 
 // TerminationMessagePathDefault means the default path to capture the application termination message running in a container
-TerminationMessagePathDefault :: "/dev/termination-log"
+#TerminationMessagePathDefault: "/dev/termination-log"
 
 // A single application container that you want to run within a pod.
-Container :: {
+#Container: {
 	// Name of the container specified as a DNS_LABEL.
 	// Each container in a pod must have a unique name (DNS_LABEL).
 	// Cannot be updated.
@@ -2447,7 +2447,7 @@
 	// +listType=map
 	// +listMapKey=containerPort
 	// +listMapKey=protocol
-	ports?: [...ContainerPort] @go(Ports,[]ContainerPort) @protobuf(6,bytes,rep)
+	ports?: [...#ContainerPort] @go(Ports,[]ContainerPort) @protobuf(6,bytes,rep)
 
 	// List of sources to populate environment variables in the container.
 	// The keys defined within a source must be a C_IDENTIFIER. All invalid keys
@@ -2456,47 +2456,47 @@
 	// Values defined by an Env with a duplicate key will take precedence.
 	// Cannot be updated.
 	// +optional
-	envFrom?: [...EnvFromSource] @go(EnvFrom,[]EnvFromSource) @protobuf(19,bytes,rep)
+	envFrom?: [...#EnvFromSource] @go(EnvFrom,[]EnvFromSource) @protobuf(19,bytes,rep)
 
 	// List of environment variables to set in the container.
 	// Cannot be updated.
 	// +optional
 	// +patchMergeKey=name
 	// +patchStrategy=merge
-	env?: [...EnvVar] @go(Env,[]EnvVar) @protobuf(7,bytes,rep)
+	env?: [...#EnvVar] @go(Env,[]EnvVar) @protobuf(7,bytes,rep)
 
 	// Compute Resources required by this container.
 	// Cannot be updated.
 	// More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
 	// +optional
-	resources?: ResourceRequirements @go(Resources) @protobuf(8,bytes,opt)
+	resources?: #ResourceRequirements @go(Resources) @protobuf(8,bytes,opt)
 
 	// Pod volumes to mount into the container's filesystem.
 	// Cannot be updated.
 	// +optional
 	// +patchMergeKey=mountPath
 	// +patchStrategy=merge
-	volumeMounts?: [...VolumeMount] @go(VolumeMounts,[]VolumeMount) @protobuf(9,bytes,rep)
+	volumeMounts?: [...#VolumeMount] @go(VolumeMounts,[]VolumeMount) @protobuf(9,bytes,rep)
 
 	// volumeDevices is the list of block devices to be used by the container.
 	// +patchMergeKey=devicePath
 	// +patchStrategy=merge
 	// +optional
-	volumeDevices?: [...VolumeDevice] @go(VolumeDevices,[]VolumeDevice) @protobuf(21,bytes,rep)
+	volumeDevices?: [...#VolumeDevice] @go(VolumeDevices,[]VolumeDevice) @protobuf(21,bytes,rep)
 
 	// Periodic probe of container liveness.
 	// Container will be restarted if the probe fails.
 	// Cannot be updated.
 	// More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
 	// +optional
-	livenessProbe?: null | Probe @go(LivenessProbe,*Probe) @protobuf(10,bytes,opt)
+	livenessProbe?: null | #Probe @go(LivenessProbe,*Probe) @protobuf(10,bytes,opt)
 
 	// Periodic probe of container service readiness.
 	// Container will be removed from service endpoints if the probe fails.
 	// Cannot be updated.
 	// More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
 	// +optional
-	readinessProbe?: null | Probe @go(ReadinessProbe,*Probe) @protobuf(11,bytes,opt)
+	readinessProbe?: null | #Probe @go(ReadinessProbe,*Probe) @protobuf(11,bytes,opt)
 
 	// StartupProbe indicates that the Pod has successfully initialized.
 	// If specified, no other probes are executed until this completes successfully.
@@ -2507,12 +2507,12 @@
 	// This is a beta feature enabled by the StartupProbe feature flag.
 	// More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
 	// +optional
-	startupProbe?: null | Probe @go(StartupProbe,*Probe) @protobuf(22,bytes,opt)
+	startupProbe?: null | #Probe @go(StartupProbe,*Probe) @protobuf(22,bytes,opt)
 
 	// Actions that the management system should take in response to container lifecycle events.
 	// Cannot be updated.
 	// +optional
-	lifecycle?: null | Lifecycle @go(Lifecycle,*Lifecycle) @protobuf(12,bytes,opt)
+	lifecycle?: null | #Lifecycle @go(Lifecycle,*Lifecycle) @protobuf(12,bytes,opt)
 
 	// Optional: Path at which the file to which the container's termination message
 	// will be written is mounted into the container's filesystem.
@@ -2532,7 +2532,7 @@
 	// Defaults to File.
 	// Cannot be updated.
 	// +optional
-	terminationMessagePolicy?: TerminationMessagePolicy @go(TerminationMessagePolicy) @protobuf(20,bytes,opt,casttype=TerminationMessagePolicy)
+	terminationMessagePolicy?: #TerminationMessagePolicy @go(TerminationMessagePolicy) @protobuf(20,bytes,opt,casttype=TerminationMessagePolicy)
 
 	// Image pull policy.
 	// One of Always, Never, IfNotPresent.
@@ -2540,13 +2540,13 @@
 	// Cannot be updated.
 	// More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
 	// +optional
-	imagePullPolicy?: PullPolicy @go(ImagePullPolicy) @protobuf(14,bytes,opt,casttype=PullPolicy)
+	imagePullPolicy?: #PullPolicy @go(ImagePullPolicy) @protobuf(14,bytes,opt,casttype=PullPolicy)
 
 	// Security options the pod should run with.
 	// More info: https://kubernetes.io/docs/concepts/policy/security-context/
 	// More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
 	// +optional
-	securityContext?: null | SecurityContext @go(SecurityContext,*SecurityContext) @protobuf(15,bytes,opt)
+	securityContext?: null | #SecurityContext @go(SecurityContext,*SecurityContext) @protobuf(15,bytes,opt)
 
 	// Whether this container should allocate a buffer for stdin in the container runtime. If this
 	// is not set, reads from stdin in the container will always result in EOF.
@@ -2572,33 +2572,33 @@
 
 // Handler defines a specific action that should be taken
 // TODO: pass structured data to these actions, and document that data here.
-Handler :: {
+#Handler: {
 	// One and only one of the following should be specified.
 	// Exec specifies the action to take.
 	// +optional
-	exec?: null | ExecAction @go(Exec,*ExecAction) @protobuf(1,bytes,opt)
+	exec?: null | #ExecAction @go(Exec,*ExecAction) @protobuf(1,bytes,opt)
 
 	// HTTPGet specifies the http request to perform.
 	// +optional
-	httpGet?: null | HTTPGetAction @go(HTTPGet,*HTTPGetAction) @protobuf(2,bytes,opt)
+	httpGet?: null | #HTTPGetAction @go(HTTPGet,*HTTPGetAction) @protobuf(2,bytes,opt)
 
 	// TCPSocket specifies an action involving a TCP port.
 	// TCP hooks not yet supported
 	// TODO: implement a realistic TCP lifecycle hook
 	// +optional
-	tcpSocket?: null | TCPSocketAction @go(TCPSocket,*TCPSocketAction) @protobuf(3,bytes,opt)
+	tcpSocket?: null | #TCPSocketAction @go(TCPSocket,*TCPSocketAction) @protobuf(3,bytes,opt)
 }
 
 // Lifecycle describes actions that the management system should take in response to container lifecycle
 // events. For the PostStart and PreStop lifecycle handlers, management of the container blocks
 // until the action is complete, unless the container process fails, in which case the handler is aborted.
-Lifecycle :: {
+#Lifecycle: {
 	// PostStart is called immediately after a container is created. If the handler fails,
 	// the container is terminated and restarted according to its restart policy.
 	// Other management of the container blocks until the hook completes.
 	// More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
 	// +optional
-	postStart?: null | Handler @go(PostStart,*Handler) @protobuf(1,bytes,opt)
+	postStart?: null | #Handler @go(PostStart,*Handler) @protobuf(1,bytes,opt)
 
 	// PreStop is called immediately before a container is terminated due to an
 	// API request or management event such as liveness/startup probe failure,
@@ -2611,22 +2611,22 @@
 	// or until the termination grace period is reached.
 	// More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
 	// +optional
-	preStop?: null | Handler @go(PreStop,*Handler) @protobuf(2,bytes,opt)
+	preStop?: null | #Handler @go(PreStop,*Handler) @protobuf(2,bytes,opt)
 }
 
-ConditionStatus :: string // enumConditionStatus
+#ConditionStatus: string // #enumConditionStatus
 
-enumConditionStatus ::
-	ConditionTrue |
-	ConditionFalse |
-	ConditionUnknown
+#enumConditionStatus:
+	#ConditionTrue |
+	#ConditionFalse |
+	#ConditionUnknown
 
-ConditionTrue ::    ConditionStatus & "True"
-ConditionFalse ::   ConditionStatus & "False"
-ConditionUnknown :: ConditionStatus & "Unknown"
+#ConditionTrue:    #ConditionStatus & "True"
+#ConditionFalse:   #ConditionStatus & "False"
+#ConditionUnknown: #ConditionStatus & "Unknown"
 
 // ContainerStateWaiting is a waiting state of a container.
-ContainerStateWaiting :: {
+#ContainerStateWaiting: {
 	// (brief) reason the container is not yet running.
 	// +optional
 	reason?: string @go(Reason) @protobuf(1,bytes,opt)
@@ -2637,14 +2637,14 @@
 }
 
 // ContainerStateRunning is a running state of a container.
-ContainerStateRunning :: {
+#ContainerStateRunning: {
 	// Time at which the container was last (re-)started
 	// +optional
-	startedAt?: metav1.Time @go(StartedAt) @protobuf(1,bytes,opt)
+	startedAt?: metav1.#Time @go(StartedAt) @protobuf(1,bytes,opt)
 }
 
 // ContainerStateTerminated is a terminated state of a container.
-ContainerStateTerminated :: {
+#ContainerStateTerminated: {
 	// Exit status from the last termination of the container
 	exitCode: int32 @go(ExitCode) @protobuf(1,varint,opt)
 
@@ -2662,11 +2662,11 @@
 
 	// Time at which previous execution of the container started
 	// +optional
-	startedAt?: metav1.Time @go(StartedAt) @protobuf(5,bytes,opt)
+	startedAt?: metav1.#Time @go(StartedAt) @protobuf(5,bytes,opt)
 
 	// Time at which the container last terminated
 	// +optional
-	finishedAt?: metav1.Time @go(FinishedAt) @protobuf(6,bytes,opt)
+	finishedAt?: metav1.#Time @go(FinishedAt) @protobuf(6,bytes,opt)
 
 	// Container's ID in the format 'docker://<container_id>'
 	// +optional
@@ -2676,33 +2676,33 @@
 // ContainerState holds a possible state of container.
 // Only one of its members may be specified.
 // If none of them is specified, the default one is ContainerStateWaiting.
-ContainerState :: {
+#ContainerState: {
 	// Details about a waiting container
 	// +optional
-	waiting?: null | ContainerStateWaiting @go(Waiting,*ContainerStateWaiting) @protobuf(1,bytes,opt)
+	waiting?: null | #ContainerStateWaiting @go(Waiting,*ContainerStateWaiting) @protobuf(1,bytes,opt)
 
 	// Details about a running container
 	// +optional
-	running?: null | ContainerStateRunning @go(Running,*ContainerStateRunning) @protobuf(2,bytes,opt)
+	running?: null | #ContainerStateRunning @go(Running,*ContainerStateRunning) @protobuf(2,bytes,opt)
 
 	// Details about a terminated container
 	// +optional
-	terminated?: null | ContainerStateTerminated @go(Terminated,*ContainerStateTerminated) @protobuf(3,bytes,opt)
+	terminated?: null | #ContainerStateTerminated @go(Terminated,*ContainerStateTerminated) @protobuf(3,bytes,opt)
 }
 
 // ContainerStatus contains details for the current status of this container.
-ContainerStatus :: {
+#ContainerStatus: {
 	// This must be a DNS_LABEL. Each container in a pod must have a unique name.
 	// Cannot be updated.
 	name: string @go(Name) @protobuf(1,bytes,opt)
 
 	// Details about the container's current condition.
 	// +optional
-	state?: ContainerState @go(State) @protobuf(2,bytes,opt)
+	state?: #ContainerState @go(State) @protobuf(2,bytes,opt)
 
 	// Details about the container's last termination condition.
 	// +optional
-	lastState?: ContainerState @go(LastTerminationState) @protobuf(3,bytes,opt)
+	lastState?: #ContainerState @go(LastTerminationState) @protobuf(3,bytes,opt)
 
 	// Specifies whether the container has passed its readiness probe.
 	ready: bool @go(Ready) @protobuf(4,varint,opt)
@@ -2734,80 +2734,80 @@
 }
 
 // PodPhase is a label for the condition of a pod at the current time.
-PodPhase :: string // enumPodPhase
+#PodPhase: string // #enumPodPhase
 
-enumPodPhase ::
-	PodPending |
-	PodRunning |
-	PodSucceeded |
-	PodFailed |
-	PodUnknown
+#enumPodPhase:
+	#PodPending |
+	#PodRunning |
+	#PodSucceeded |
+	#PodFailed |
+	#PodUnknown
 
 // PodPending means the pod has been accepted by the system, but one or more of the containers
 // has not been started. This includes time before being bound to a node, as well as time spent
 // pulling images onto the host.
-PodPending :: PodPhase & "Pending"
+#PodPending: #PodPhase & "Pending"
 
 // PodRunning means the pod has been bound to a node and all of the containers have been started.
 // At least one container is still running or is in the process of being restarted.
-PodRunning :: PodPhase & "Running"
+#PodRunning: #PodPhase & "Running"
 
 // PodSucceeded means that all containers in the pod have voluntarily terminated
 // with a container exit code of 0, and the system is not going to restart any of these containers.
-PodSucceeded :: PodPhase & "Succeeded"
+#PodSucceeded: #PodPhase & "Succeeded"
 
 // PodFailed means that all containers in the pod have terminated, and at least one container has
 // terminated in a failure (exited with a non-zero exit code or was stopped by the system).
-PodFailed :: PodPhase & "Failed"
+#PodFailed: #PodPhase & "Failed"
 
 // PodUnknown means that for some reason the state of the pod could not be obtained, typically due
 // to an error in communicating with the host of the pod.
-PodUnknown :: PodPhase & "Unknown"
+#PodUnknown: #PodPhase & "Unknown"
 
 // PodConditionType is a valid value for PodCondition.Type
-PodConditionType :: string // enumPodConditionType
+#PodConditionType: string // #enumPodConditionType
 
-enumPodConditionType ::
-	ContainersReady |
-	PodInitialized |
-	PodReady |
-	PodScheduled
+#enumPodConditionType:
+	#ContainersReady |
+	#PodInitialized |
+	#PodReady |
+	#PodScheduled
 
 // ContainersReady indicates whether all containers in the pod are ready.
-ContainersReady :: PodConditionType & "ContainersReady"
+#ContainersReady: #PodConditionType & "ContainersReady"
 
 // PodInitialized means that all init containers in the pod have started successfully.
-PodInitialized :: PodConditionType & "Initialized"
+#PodInitialized: #PodConditionType & "Initialized"
 
 // PodReady means the pod is able to service requests and should be added to the
 // load balancing pools of all matching services.
-PodReady :: PodConditionType & "Ready"
+#PodReady: #PodConditionType & "Ready"
 
 // PodScheduled represents status of the scheduling process for this pod.
-PodScheduled :: PodConditionType & "PodScheduled"
+#PodScheduled: #PodConditionType & "PodScheduled"
 
 // PodReasonUnschedulable reason in PodScheduled PodCondition means that the scheduler
 // can't schedule the pod right now, for example due to insufficient resources in the cluster.
-PodReasonUnschedulable :: "Unschedulable"
+#PodReasonUnschedulable: "Unschedulable"
 
 // PodCondition contains details for the current condition of this pod.
-PodCondition :: {
+#PodCondition: {
 	// Type is the type of the condition.
 	// More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-conditions
-	type: PodConditionType @go(Type) @protobuf(1,bytes,opt,casttype=PodConditionType)
+	type: #PodConditionType @go(Type) @protobuf(1,bytes,opt,casttype=PodConditionType)
 
 	// Status is the status of the condition.
 	// Can be True, False, Unknown.
 	// More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-conditions
-	status: ConditionStatus @go(Status) @protobuf(2,bytes,opt,casttype=ConditionStatus)
+	status: #ConditionStatus @go(Status) @protobuf(2,bytes,opt,casttype=ConditionStatus)
 
 	// Last time we probed the condition.
 	// +optional
-	lastProbeTime?: metav1.Time @go(LastProbeTime) @protobuf(3,bytes,opt)
+	lastProbeTime?: metav1.#Time @go(LastProbeTime) @protobuf(3,bytes,opt)
 
 	// Last time the condition transitioned from one status to another.
 	// +optional
-	lastTransitionTime?: metav1.Time @go(LastTransitionTime) @protobuf(4,bytes,opt)
+	lastTransitionTime?: metav1.#Time @go(LastTransitionTime) @protobuf(4,bytes,opt)
 
 	// Unique, one-word, CamelCase reason for the condition's last transition.
 	// +optional
@@ -2822,79 +2822,79 @@
 // Only one of the following restart policies may be specified.
 // If none of the following policies is specified, the default one
 // is RestartPolicyAlways.
-RestartPolicy :: string // enumRestartPolicy
+#RestartPolicy: string // #enumRestartPolicy
 
-enumRestartPolicy ::
-	RestartPolicyAlways |
-	RestartPolicyOnFailure |
-	RestartPolicyNever
+#enumRestartPolicy:
+	#RestartPolicyAlways |
+	#RestartPolicyOnFailure |
+	#RestartPolicyNever
 
-RestartPolicyAlways ::    RestartPolicy & "Always"
-RestartPolicyOnFailure :: RestartPolicy & "OnFailure"
-RestartPolicyNever ::     RestartPolicy & "Never"
+#RestartPolicyAlways:    #RestartPolicy & "Always"
+#RestartPolicyOnFailure: #RestartPolicy & "OnFailure"
+#RestartPolicyNever:     #RestartPolicy & "Never"
 
 // DNSPolicy defines how a pod's DNS will be configured.
-DNSPolicy :: string // enumDNSPolicy
+#DNSPolicy: string // #enumDNSPolicy
 
-enumDNSPolicy ::
-	DNSClusterFirstWithHostNet |
-	DNSClusterFirst |
-	DNSDefault |
-	DNSNone
+#enumDNSPolicy:
+	#DNSClusterFirstWithHostNet |
+	#DNSClusterFirst |
+	#DNSDefault |
+	#DNSNone
 
 // DNSClusterFirstWithHostNet indicates that the pod should use cluster DNS
 // first, if it is available, then fall back on the default
 // (as determined by kubelet) DNS settings.
-DNSClusterFirstWithHostNet :: DNSPolicy & "ClusterFirstWithHostNet"
+#DNSClusterFirstWithHostNet: #DNSPolicy & "ClusterFirstWithHostNet"
 
 // DNSClusterFirst indicates that the pod should use cluster DNS
 // first unless hostNetwork is true, if it is available, then
 // fall back on the default (as determined by kubelet) DNS settings.
-DNSClusterFirst :: DNSPolicy & "ClusterFirst"
+#DNSClusterFirst: #DNSPolicy & "ClusterFirst"
 
 // DNSDefault indicates that the pod should use the default (as
 // determined by kubelet) DNS settings.
-DNSDefault :: DNSPolicy & "Default"
+#DNSDefault: #DNSPolicy & "Default"
 
 // DNSNone indicates that the pod should use empty DNS settings. DNS
 // parameters such as nameservers and search paths should be defined via
 // DNSConfig.
-DNSNone :: DNSPolicy & "None"
+#DNSNone: #DNSPolicy & "None"
 
 // DefaultTerminationGracePeriodSeconds indicates the default duration in
 // seconds a pod needs to terminate gracefully.
-DefaultTerminationGracePeriodSeconds :: 30
+#DefaultTerminationGracePeriodSeconds: 30
 
 // A node selector represents the union of the results of one or more label queries
 // over a set of nodes; that is, it represents the OR of the selectors represented
 // by the node selector terms.
-NodeSelector :: {
+#NodeSelector: {
 	//Required. A list of node selector terms. The terms are ORed.
-	nodeSelectorTerms: [...NodeSelectorTerm] @go(NodeSelectorTerms,[]NodeSelectorTerm) @protobuf(1,bytes,rep)
+	nodeSelectorTerms: [...#NodeSelectorTerm] @go(NodeSelectorTerms,[]NodeSelectorTerm) @protobuf(1,bytes,rep)
 }
 
 // A null or empty node selector term matches no objects. The requirements of
 // them are ANDed.
 // The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
-NodeSelectorTerm :: {
+#NodeSelectorTerm: {
 	// A list of node selector requirements by node's labels.
 	// +optional
-	matchExpressions?: [...NodeSelectorRequirement] @go(MatchExpressions,[]NodeSelectorRequirement) @protobuf(1,bytes,rep)
+	matchExpressions?: [...#NodeSelectorRequirement] @go(MatchExpressions,[]NodeSelectorRequirement) @protobuf(1,bytes,rep)
 
 	// A list of node selector requirements by node's fields.
 	// +optional
-	matchFields?: [...NodeSelectorRequirement] @go(MatchFields,[]NodeSelectorRequirement) @protobuf(2,bytes,rep)
+	matchFields?: [...#NodeSelectorRequirement] @go(MatchFields,[]NodeSelectorRequirement) @protobuf(2,bytes,rep)
 }
 
 // A node selector requirement is a selector that contains values, a key, and an operator
 // that relates the key and values.
-NodeSelectorRequirement :: {
+#NodeSelectorRequirement: {
 	// The label key that the selector applies to.
 	key: string @go(Key) @protobuf(1,bytes,opt)
 
 	// Represents a key's relationship to a set of values.
 	// Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.
-	operator: NodeSelectorOperator @go(Operator) @protobuf(2,bytes,opt,casttype=NodeSelectorOperator)
+	operator: #NodeSelectorOperator @go(Operator) @protobuf(2,bytes,opt,casttype=NodeSelectorOperator)
 
 	// An array of string values. If the operator is In or NotIn,
 	// the values array must be non-empty. If the operator is Exists or DoesNotExist,
@@ -2907,37 +2907,37 @@
 
 // A node selector operator is the set of operators that can be used in
 // a node selector requirement.
-NodeSelectorOperator :: string // enumNodeSelectorOperator
+#NodeSelectorOperator: string // #enumNodeSelectorOperator
 
-enumNodeSelectorOperator ::
-	NodeSelectorOpIn |
-	NodeSelectorOpNotIn |
-	NodeSelectorOpExists |
-	NodeSelectorOpDoesNotExist |
-	NodeSelectorOpGt |
-	NodeSelectorOpLt
+#enumNodeSelectorOperator:
+	#NodeSelectorOpIn |
+	#NodeSelectorOpNotIn |
+	#NodeSelectorOpExists |
+	#NodeSelectorOpDoesNotExist |
+	#NodeSelectorOpGt |
+	#NodeSelectorOpLt
 
-NodeSelectorOpIn ::           NodeSelectorOperator & "In"
-NodeSelectorOpNotIn ::        NodeSelectorOperator & "NotIn"
-NodeSelectorOpExists ::       NodeSelectorOperator & "Exists"
-NodeSelectorOpDoesNotExist :: NodeSelectorOperator & "DoesNotExist"
-NodeSelectorOpGt ::           NodeSelectorOperator & "Gt"
-NodeSelectorOpLt ::           NodeSelectorOperator & "Lt"
+#NodeSelectorOpIn:           #NodeSelectorOperator & "In"
+#NodeSelectorOpNotIn:        #NodeSelectorOperator & "NotIn"
+#NodeSelectorOpExists:       #NodeSelectorOperator & "Exists"
+#NodeSelectorOpDoesNotExist: #NodeSelectorOperator & "DoesNotExist"
+#NodeSelectorOpGt:           #NodeSelectorOperator & "Gt"
+#NodeSelectorOpLt:           #NodeSelectorOperator & "Lt"
 
 // A topology selector term represents the result of label queries.
 // A null or empty topology selector term matches no objects.
 // The requirements of them are ANDed.
 // It provides a subset of functionality as NodeSelectorTerm.
 // This is an alpha feature and may change in the future.
-TopologySelectorTerm :: {
+#TopologySelectorTerm: {
 	// A list of topology selector requirements by labels.
 	// +optional
-	matchLabelExpressions?: [...TopologySelectorLabelRequirement] @go(MatchLabelExpressions,[]TopologySelectorLabelRequirement) @protobuf(1,bytes,rep)
+	matchLabelExpressions?: [...#TopologySelectorLabelRequirement] @go(MatchLabelExpressions,[]TopologySelectorLabelRequirement) @protobuf(1,bytes,rep)
 }
 
 // A topology selector requirement is a selector that matches given label.
 // This is an alpha feature and may change in the future.
-TopologySelectorLabelRequirement :: {
+#TopologySelectorLabelRequirement: {
 	// The label key that the selector applies to.
 	key: string @go(Key) @protobuf(1,bytes,opt)
 
@@ -2947,22 +2947,22 @@
 }
 
 // Affinity is a group of affinity scheduling rules.
-Affinity :: {
+#Affinity: {
 	// Describes node affinity scheduling rules for the pod.
 	// +optional
-	nodeAffinity?: null | NodeAffinity @go(NodeAffinity,*NodeAffinity) @protobuf(1,bytes,opt)
+	nodeAffinity?: null | #NodeAffinity @go(NodeAffinity,*NodeAffinity) @protobuf(1,bytes,opt)
 
 	// Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
 	// +optional
-	podAffinity?: null | PodAffinity @go(PodAffinity,*PodAffinity) @protobuf(2,bytes,opt)
+	podAffinity?: null | #PodAffinity @go(PodAffinity,*PodAffinity) @protobuf(2,bytes,opt)
 
 	// Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
 	// +optional
-	podAntiAffinity?: null | PodAntiAffinity @go(PodAntiAffinity,*PodAntiAffinity) @protobuf(3,bytes,opt)
+	podAntiAffinity?: null | #PodAntiAffinity @go(PodAntiAffinity,*PodAntiAffinity) @protobuf(3,bytes,opt)
 }
 
 // Pod affinity is a group of inter pod affinity scheduling rules.
-PodAffinity :: {
+#PodAffinity: {
 	// If the affinity requirements specified by this field are not met at
 	// scheduling time, the pod will not be scheduled onto the node.
 	// If the affinity requirements specified by this field cease to be met
@@ -2971,7 +2971,7 @@
 	// When there are multiple elements, the lists of nodes corresponding to each
 	// podAffinityTerm are intersected, i.e. all terms must be satisfied.
 	// +optional
-	requiredDuringSchedulingIgnoredDuringExecution?: [...PodAffinityTerm] @go(RequiredDuringSchedulingIgnoredDuringExecution,[]PodAffinityTerm) @protobuf(1,bytes,rep)
+	requiredDuringSchedulingIgnoredDuringExecution?: [...#PodAffinityTerm] @go(RequiredDuringSchedulingIgnoredDuringExecution,[]PodAffinityTerm) @protobuf(1,bytes,rep)
 
 	// The scheduler will prefer to schedule pods to nodes that satisfy
 	// the affinity expressions specified by this field, but it may choose
@@ -2983,11 +2983,11 @@
 	// "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
 	// node(s) with the highest sum are the most preferred.
 	// +optional
-	preferredDuringSchedulingIgnoredDuringExecution?: [...WeightedPodAffinityTerm] @go(PreferredDuringSchedulingIgnoredDuringExecution,[]WeightedPodAffinityTerm) @protobuf(2,bytes,rep)
+	preferredDuringSchedulingIgnoredDuringExecution?: [...#WeightedPodAffinityTerm] @go(PreferredDuringSchedulingIgnoredDuringExecution,[]WeightedPodAffinityTerm) @protobuf(2,bytes,rep)
 }
 
 // Pod anti affinity is a group of inter pod anti affinity scheduling rules.
-PodAntiAffinity :: {
+#PodAntiAffinity: {
 	// If the anti-affinity requirements specified by this field are not met at
 	// scheduling time, the pod will not be scheduled onto the node.
 	// If the anti-affinity requirements specified by this field cease to be met
@@ -2996,7 +2996,7 @@
 	// When there are multiple elements, the lists of nodes corresponding to each
 	// podAffinityTerm are intersected, i.e. all terms must be satisfied.
 	// +optional
-	requiredDuringSchedulingIgnoredDuringExecution?: [...PodAffinityTerm] @go(RequiredDuringSchedulingIgnoredDuringExecution,[]PodAffinityTerm) @protobuf(1,bytes,rep)
+	requiredDuringSchedulingIgnoredDuringExecution?: [...#PodAffinityTerm] @go(RequiredDuringSchedulingIgnoredDuringExecution,[]PodAffinityTerm) @protobuf(1,bytes,rep)
 
 	// The scheduler will prefer to schedule pods to nodes that satisfy
 	// the anti-affinity expressions specified by this field, but it may choose
@@ -3008,17 +3008,17 @@
 	// "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the
 	// node(s) with the highest sum are the most preferred.
 	// +optional
-	preferredDuringSchedulingIgnoredDuringExecution?: [...WeightedPodAffinityTerm] @go(PreferredDuringSchedulingIgnoredDuringExecution,[]WeightedPodAffinityTerm) @protobuf(2,bytes,rep)
+	preferredDuringSchedulingIgnoredDuringExecution?: [...#WeightedPodAffinityTerm] @go(PreferredDuringSchedulingIgnoredDuringExecution,[]WeightedPodAffinityTerm) @protobuf(2,bytes,rep)
 }
 
 // The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-WeightedPodAffinityTerm :: {
+#WeightedPodAffinityTerm: {
 	// weight associated with matching the corresponding podAffinityTerm,
 	// in the range 1-100.
 	weight: int32 @go(Weight) @protobuf(1,varint,opt)
 
 	// Required. A pod affinity term, associated with the corresponding weight.
-	podAffinityTerm: PodAffinityTerm @go(PodAffinityTerm) @protobuf(2,bytes,opt)
+	podAffinityTerm: #PodAffinityTerm @go(PodAffinityTerm) @protobuf(2,bytes,opt)
 }
 
 // Defines a set of pods (namely those matching the labelSelector
@@ -3027,10 +3027,10 @@
 // where co-located is defined as running on a node whose value of
 // the label with key <topologyKey> matches that of any node on which
 // a pod of the set of pods is running
-PodAffinityTerm :: {
+#PodAffinityTerm: {
 	// A label query over a set of resources, in this case pods.
 	// +optional
-	labelSelector?: null | metav1.LabelSelector @go(LabelSelector,*metav1.LabelSelector) @protobuf(1,bytes,opt)
+	labelSelector?: null | metav1.#LabelSelector @go(LabelSelector,*metav1.LabelSelector) @protobuf(1,bytes,opt)
 
 	// namespaces specifies which namespaces the labelSelector applies to (matches against);
 	// null or empty list means "this pod's namespace"
@@ -3046,14 +3046,14 @@
 }
 
 // Node affinity is a group of node affinity scheduling rules.
-NodeAffinity :: {
+#NodeAffinity: {
 	// If the affinity requirements specified by this field are not met at
 	// scheduling time, the pod will not be scheduled onto the node.
 	// If the affinity requirements specified by this field cease to be met
 	// at some point during pod execution (e.g. due to an update), the system
 	// may or may not try to eventually evict the pod from its node.
 	// +optional
-	requiredDuringSchedulingIgnoredDuringExecution?: null | NodeSelector @go(RequiredDuringSchedulingIgnoredDuringExecution,*NodeSelector) @protobuf(1,bytes,opt)
+	requiredDuringSchedulingIgnoredDuringExecution?: null | #NodeSelector @go(RequiredDuringSchedulingIgnoredDuringExecution,*NodeSelector) @protobuf(1,bytes,opt)
 
 	// The scheduler will prefer to schedule pods to nodes that satisfy
 	// the affinity expressions specified by this field, but it may choose
@@ -3065,22 +3065,22 @@
 	// "weight" to the sum if the node matches the corresponding matchExpressions; the
 	// node(s) with the highest sum are the most preferred.
 	// +optional
-	preferredDuringSchedulingIgnoredDuringExecution?: [...PreferredSchedulingTerm] @go(PreferredDuringSchedulingIgnoredDuringExecution,[]PreferredSchedulingTerm) @protobuf(2,bytes,rep)
+	preferredDuringSchedulingIgnoredDuringExecution?: [...#PreferredSchedulingTerm] @go(PreferredDuringSchedulingIgnoredDuringExecution,[]PreferredSchedulingTerm) @protobuf(2,bytes,rep)
 }
 
 // An empty preferred scheduling term matches all objects with implicit weight 0
 // (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
-PreferredSchedulingTerm :: {
+#PreferredSchedulingTerm: {
 	// Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
 	weight: int32 @go(Weight) @protobuf(1,varint,opt)
 
 	// A node selector term, associated with the corresponding weight.
-	preference: NodeSelectorTerm @go(Preference) @protobuf(2,bytes,opt)
+	preference: #NodeSelectorTerm @go(Preference) @protobuf(2,bytes,opt)
 }
 
 // The node this Taint is attached to has the "effect" on
 // any pod that does not tolerate the Taint.
-Taint :: {
+#Taint: {
 	// Required. The taint key to be applied to a node.
 	key: string @go(Key) @protobuf(1,bytes,opt)
 
@@ -3091,39 +3091,39 @@
 	// Required. The effect of the taint on pods
 	// that do not tolerate the taint.
 	// Valid effects are NoSchedule, PreferNoSchedule and NoExecute.
-	effect: TaintEffect @go(Effect) @protobuf(3,bytes,opt,casttype=TaintEffect)
+	effect: #TaintEffect @go(Effect) @protobuf(3,bytes,opt,casttype=TaintEffect)
 
 	// TimeAdded represents the time at which the taint was added.
 	// It is only written for NoExecute taints.
 	// +optional
-	timeAdded?: null | metav1.Time @go(TimeAdded,*metav1.Time) @protobuf(4,bytes,opt)
+	timeAdded?: null | metav1.#Time @go(TimeAdded,*metav1.Time) @protobuf(4,bytes,opt)
 }
 
-TaintEffect :: string // enumTaintEffect
+#TaintEffect: string // #enumTaintEffect
 
-enumTaintEffect ::
-	TaintEffectNoSchedule |
-	TaintEffectPreferNoSchedule |
-	TaintEffectNoExecute
+#enumTaintEffect:
+	#TaintEffectNoSchedule |
+	#TaintEffectPreferNoSchedule |
+	#TaintEffectNoExecute
 
 // Do not allow new pods to schedule onto the node unless they tolerate the taint,
 // but allow all pods submitted to Kubelet without going through the scheduler
 // to start, and allow all already-running pods to continue running.
 // Enforced by the scheduler.
-TaintEffectNoSchedule :: TaintEffect & "NoSchedule"
+#TaintEffectNoSchedule: #TaintEffect & "NoSchedule"
 
 // Like TaintEffectNoSchedule, but the scheduler tries not to schedule
 // new pods onto the node, rather than prohibiting new pods from scheduling
 // onto the node entirely. Enforced by the scheduler.
-TaintEffectPreferNoSchedule :: TaintEffect & "PreferNoSchedule"
+#TaintEffectPreferNoSchedule: #TaintEffect & "PreferNoSchedule"
 
 // Evict any already-running pods that do not tolerate the taint.
 // Currently enforced by NodeController.
-TaintEffectNoExecute :: TaintEffect & "NoExecute"
+#TaintEffectNoExecute: #TaintEffect & "NoExecute"
 
 // The pod this Toleration is attached to tolerates any taint that matches
 // the triple <key,value,effect> using the matching operator <operator>.
-Toleration :: {
+#Toleration: {
 	// Key is the taint key that the toleration applies to. Empty means match all taint keys.
 	// If the key is empty, operator must be Exists; this combination means to match all values and all keys.
 	// +optional
@@ -3134,7 +3134,7 @@
 	// Exists is equivalent to wildcard for value, so that a pod can
 	// tolerate all taints of a particular category.
 	// +optional
-	operator?: TolerationOperator @go(Operator) @protobuf(2,bytes,opt,casttype=TolerationOperator)
+	operator?: #TolerationOperator @go(Operator) @protobuf(2,bytes,opt,casttype=TolerationOperator)
 
 	// Value is the taint value the toleration matches to.
 	// If the operator is Exists, the value should be empty, otherwise just a regular string.
@@ -3144,7 +3144,7 @@
 	// Effect indicates the taint effect to match. Empty means match all taint effects.
 	// When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
 	// +optional
-	effect?: TaintEffect @go(Effect) @protobuf(4,bytes,opt,casttype=TaintEffect)
+	effect?: #TaintEffect @go(Effect) @protobuf(4,bytes,opt,casttype=TaintEffect)
 
 	// TolerationSeconds represents the period of time the toleration (which must be
 	// of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
@@ -3155,29 +3155,29 @@
 }
 
 // A toleration operator is the set of operators that can be used in a toleration.
-TolerationOperator :: string // enumTolerationOperator
+#TolerationOperator: string // #enumTolerationOperator
 
-enumTolerationOperator ::
-	TolerationOpExists |
-	TolerationOpEqual
+#enumTolerationOperator:
+	#TolerationOpExists |
+	#TolerationOpEqual
 
-TolerationOpExists :: TolerationOperator & "Exists"
-TolerationOpEqual ::  TolerationOperator & "Equal"
+#TolerationOpExists: #TolerationOperator & "Exists"
+#TolerationOpEqual:  #TolerationOperator & "Equal"
 
 // PodReadinessGate contains the reference to a pod condition
-PodReadinessGate :: {
+#PodReadinessGate: {
 	// ConditionType refers to a condition in the pod's condition list with matching type.
-	conditionType: PodConditionType @go(ConditionType) @protobuf(1,bytes,opt,casttype=PodConditionType)
+	conditionType: #PodConditionType @go(ConditionType) @protobuf(1,bytes,opt,casttype=PodConditionType)
 }
 
 // PodSpec is a description of a pod.
-PodSpec :: {
+#PodSpec: {
 	// List of volumes that can be mounted by containers belonging to the pod.
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes
 	// +optional
 	// +patchMergeKey=name
 	// +patchStrategy=merge,retainKeys
-	volumes?: [...Volume] @go(Volumes,[]Volume) @protobuf(1,bytes,rep)
+	volumes?: [...#Volume] @go(Volumes,[]Volume) @protobuf(1,bytes,rep)
 
 	// List of initialization containers belonging to the pod.
 	// Init containers are executed in order prior to containers being started. If any
@@ -3194,7 +3194,7 @@
 	// More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
 	// +patchMergeKey=name
 	// +patchStrategy=merge
-	initContainers?: [...Container] @go(InitContainers,[]Container) @protobuf(20,bytes,rep)
+	initContainers?: [...#Container] @go(InitContainers,[]Container) @protobuf(20,bytes,rep)
 
 	// List of containers belonging to the pod.
 	// Containers cannot currently be added or removed.
@@ -3202,7 +3202,7 @@
 	// Cannot be updated.
 	// +patchMergeKey=name
 	// +patchStrategy=merge
-	containers: [...Container] @go(Containers,[]Container) @protobuf(2,bytes,rep)
+	containers: [...#Container] @go(Containers,[]Container) @protobuf(2,bytes,rep)
 
 	// List of ephemeral containers run in this pod. Ephemeral containers may be run in an existing
 	// pod to perform user-initiated actions such as debugging. This list cannot be specified when
@@ -3212,14 +3212,14 @@
 	// +optional
 	// +patchMergeKey=name
 	// +patchStrategy=merge
-	ephemeralContainers?: [...EphemeralContainer] @go(EphemeralContainers,[]EphemeralContainer) @protobuf(34,bytes,rep)
+	ephemeralContainers?: [...#EphemeralContainer] @go(EphemeralContainers,[]EphemeralContainer) @protobuf(34,bytes,rep)
 
 	// Restart policy for all containers within the pod.
 	// One of Always, OnFailure, Never.
 	// Default to Always.
 	// More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy
 	// +optional
-	restartPolicy?: RestartPolicy @go(RestartPolicy) @protobuf(3,bytes,opt,casttype=RestartPolicy)
+	restartPolicy?: #RestartPolicy @go(RestartPolicy) @protobuf(3,bytes,opt,casttype=RestartPolicy)
 
 	// Optional duration in seconds the pod needs to terminate gracefully. May be decreased in delete request.
 	// Value must be non-negative integer. The value zero indicates delete immediately.
@@ -3244,7 +3244,7 @@
 	// To have DNS options set along with hostNetwork, you have to specify DNS policy
 	// explicitly to 'ClusterFirstWithHostNet'.
 	// +optional
-	dnsPolicy?: DNSPolicy @go(DNSPolicy) @protobuf(6,bytes,opt,casttype=DNSPolicy)
+	dnsPolicy?: #DNSPolicy @go(DNSPolicy) @protobuf(6,bytes,opt,casttype=DNSPolicy)
 
 	// NodeSelector is a selector which must be true for the pod to fit on a node.
 	// Selector which must match a node's labels for the pod to be scheduled on that node.
@@ -3304,7 +3304,7 @@
 	// SecurityContext holds pod-level security attributes and common container settings.
 	// Optional: Defaults to empty.  See type description for default values of each field.
 	// +optional
-	securityContext?: null | PodSecurityContext @go(SecurityContext,*PodSecurityContext) @protobuf(14,bytes,opt)
+	securityContext?: null | #PodSecurityContext @go(SecurityContext,*PodSecurityContext) @protobuf(14,bytes,opt)
 
 	// ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
 	// If specified, these secrets will be passed to individual puller implementations for them to use. For example,
@@ -3313,7 +3313,7 @@
 	// +optional
 	// +patchMergeKey=name
 	// +patchStrategy=merge
-	imagePullSecrets?: [...LocalObjectReference] @go(ImagePullSecrets,[]LocalObjectReference) @protobuf(15,bytes,rep)
+	imagePullSecrets?: [...#LocalObjectReference] @go(ImagePullSecrets,[]LocalObjectReference) @protobuf(15,bytes,rep)
 
 	// Specifies the hostname of the Pod
 	// If not specified, the pod's hostname will be set to a system-defined value.
@@ -3327,7 +3327,7 @@
 
 	// If specified, the pod's scheduling constraints
 	// +optional
-	affinity?: null | Affinity @go(Affinity,*Affinity) @protobuf(18,bytes,opt)
+	affinity?: null | #Affinity @go(Affinity,*Affinity) @protobuf(18,bytes,opt)
 
 	// If specified, the pod will be dispatched by specified scheduler.
 	// If not specified, the pod will be dispatched by default scheduler.
@@ -3336,14 +3336,14 @@
 
 	// If specified, the pod's tolerations.
 	// +optional
-	tolerations?: [...Toleration] @go(Tolerations,[]Toleration) @protobuf(22,bytes,opt)
+	tolerations?: [...#Toleration] @go(Tolerations,[]Toleration) @protobuf(22,bytes,opt)
 
 	// HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts
 	// file if specified. This is only valid for non-hostNetwork pods.
 	// +optional
 	// +patchMergeKey=ip
 	// +patchStrategy=merge
-	hostAliases?: [...HostAlias] @go(HostAliases,[]HostAlias) @protobuf(23,bytes,rep)
+	hostAliases?: [...#HostAlias] @go(HostAliases,[]HostAlias) @protobuf(23,bytes,rep)
 
 	// If specified, indicates the pod's priority. "system-node-critical" and
 	// "system-cluster-critical" are two special keywords which indicate the
@@ -3366,14 +3366,14 @@
 	// Parameters specified here will be merged to the generated DNS
 	// configuration based on DNSPolicy.
 	// +optional
-	dnsConfig?: null | PodDNSConfig @go(DNSConfig,*PodDNSConfig) @protobuf(26,bytes,opt)
+	dnsConfig?: null | #PodDNSConfig @go(DNSConfig,*PodDNSConfig) @protobuf(26,bytes,opt)
 
 	// If specified, all readiness gates will be evaluated for pod readiness.
 	// A pod is ready when all its containers are ready AND
 	// all conditions specified in the readiness gates have status equal to "True"
 	// More info: https://git.k8s.io/enhancements/keps/sig-network/0007-pod-ready%2B%2B.md
 	// +optional
-	readinessGates?: [...PodReadinessGate] @go(ReadinessGates,[]PodReadinessGate) @protobuf(28,bytes,opt)
+	readinessGates?: [...#PodReadinessGate] @go(ReadinessGates,[]PodReadinessGate) @protobuf(28,bytes,opt)
 
 	// RuntimeClassName refers to a RuntimeClass object in the node.k8s.io group, which should be used
 	// to run this pod.  If no RuntimeClass resource matches the named class, the pod will not be run.
@@ -3395,7 +3395,7 @@
 	// Defaults to PreemptLowerPriority if unset.
 	// This field is alpha-level and is only honored by servers that enable the NonPreemptingPriority feature.
 	// +optional
-	preemptionPolicy?: null | PreemptionPolicy @go(PreemptionPolicy,*PreemptionPolicy) @protobuf(31,bytes,opt)
+	preemptionPolicy?: null | #PreemptionPolicy @go(PreemptionPolicy,*PreemptionPolicy) @protobuf(31,bytes,opt)
 
 	// Overhead represents the resource overhead associated with running a pod for a given RuntimeClass.
 	// This field will be autopopulated at admission time by the RuntimeClass admission controller. If
@@ -3406,7 +3406,7 @@
 	// More info: https://git.k8s.io/enhancements/keps/sig-node/20190226-pod-overhead.md
 	// This field is alpha-level as of Kubernetes v1.16, and is only honored by servers that enable the PodOverhead feature.
 	// +optional
-	overhead?: ResourceList @go(Overhead) @protobuf(32,bytes,opt)
+	overhead?: #ResourceList @go(Overhead) @protobuf(32,bytes,opt)
 
 	// TopologySpreadConstraints describes how a group of pods ought to spread across topology
 	// domains. Scheduler will schedule pods in a way which abides by the constraints.
@@ -3418,25 +3418,25 @@
 	// +listType=map
 	// +listMapKey=topologyKey
 	// +listMapKey=whenUnsatisfiable
-	topologySpreadConstraints?: [...TopologySpreadConstraint] @go(TopologySpreadConstraints,[]TopologySpreadConstraint) @protobuf(33,bytes,opt)
+	topologySpreadConstraints?: [...#TopologySpreadConstraint] @go(TopologySpreadConstraints,[]TopologySpreadConstraint) @protobuf(33,bytes,opt)
 }
 
-UnsatisfiableConstraintAction :: string // enumUnsatisfiableConstraintAction
+#UnsatisfiableConstraintAction: string // #enumUnsatisfiableConstraintAction
 
-enumUnsatisfiableConstraintAction ::
-	DoNotSchedule |
-	ScheduleAnyway
+#enumUnsatisfiableConstraintAction:
+	#DoNotSchedule |
+	#ScheduleAnyway
 
 // DoNotSchedule instructs the scheduler not to schedule the pod
 // when constraints are not satisfied.
-DoNotSchedule :: UnsatisfiableConstraintAction & "DoNotSchedule"
+#DoNotSchedule: #UnsatisfiableConstraintAction & "DoNotSchedule"
 
 // ScheduleAnyway instructs the scheduler to schedule the pod
 // even if constraints are not satisfied.
-ScheduleAnyway :: UnsatisfiableConstraintAction & "ScheduleAnyway"
+#ScheduleAnyway: #UnsatisfiableConstraintAction & "ScheduleAnyway"
 
 // TopologySpreadConstraint specifies how to spread matching pods among the given topology.
-TopologySpreadConstraint :: {
+#TopologySpreadConstraint: {
 	// MaxSkew describes the degree to which pods may be unevenly distributed.
 	// It's the maximum permitted difference between the number of matching pods in
 	// any two topology domains of a given topology type.
@@ -3479,21 +3479,21 @@
 	// MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler
 	// won't make it *more* imbalanced.
 	// It's a required field.
-	whenUnsatisfiable: UnsatisfiableConstraintAction @go(WhenUnsatisfiable) @protobuf(3,bytes,opt,casttype=UnsatisfiableConstraintAction)
+	whenUnsatisfiable: #UnsatisfiableConstraintAction @go(WhenUnsatisfiable) @protobuf(3,bytes,opt,casttype=UnsatisfiableConstraintAction)
 
 	// LabelSelector is used to find matching pods.
 	// Pods that match this label selector are counted to determine the number of pods
 	// in their corresponding topology domain.
 	// +optional
-	labelSelector?: null | metav1.LabelSelector @go(LabelSelector,*metav1.LabelSelector) @protobuf(4,bytes,opt)
+	labelSelector?: null | metav1.#LabelSelector @go(LabelSelector,*metav1.LabelSelector) @protobuf(4,bytes,opt)
 }
 
 // The default value for enableServiceLinks attribute.
-DefaultEnableServiceLinks :: true
+#DefaultEnableServiceLinks: true
 
 // HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
 // pod's hosts file.
-HostAlias :: {
+#HostAlias: {
 	// IP address of the host file entry.
 	ip?: string @go(IP) @protobuf(1,bytes,opt)
 
@@ -3503,40 +3503,40 @@
 
 // PodFSGroupChangePolicy holds policies that will be used for applying fsGroup to a volume
 // when volume is mounted.
-PodFSGroupChangePolicy :: string // enumPodFSGroupChangePolicy
+#PodFSGroupChangePolicy: string // #enumPodFSGroupChangePolicy
 
-enumPodFSGroupChangePolicy ::
-	FSGroupChangeOnRootMismatch |
-	FSGroupChangeAlways
+#enumPodFSGroupChangePolicy:
+	#FSGroupChangeOnRootMismatch |
+	#FSGroupChangeAlways
 
 // FSGroupChangeOnRootMismatch indicates that volume's ownership and permissions will be changed
 // only when permission and ownership of root directory does not match with expected
 // permissions on the volume. This can help shorten the time it takes to change
 // ownership and permissions of a volume.
-FSGroupChangeOnRootMismatch :: PodFSGroupChangePolicy & "OnRootMismatch"
+#FSGroupChangeOnRootMismatch: #PodFSGroupChangePolicy & "OnRootMismatch"
 
 // FSGroupChangeAlways indicates that volume's ownership and permissions
 // should always be changed whenever volume is mounted inside a Pod. This the default
 // behavior.
-FSGroupChangeAlways :: PodFSGroupChangePolicy & "Always"
+#FSGroupChangeAlways: #PodFSGroupChangePolicy & "Always"
 
 // PodSecurityContext holds pod-level security attributes and common container settings.
 // Some fields are also present in container.securityContext.  Field values of
 // container.securityContext take precedence over field values of PodSecurityContext.
-PodSecurityContext :: {
+#PodSecurityContext: {
 	// The SELinux context to be applied to all containers.
 	// If unspecified, the container runtime will allocate a random SELinux context for each
 	// container.  May also be set in SecurityContext.  If set in
 	// both SecurityContext and PodSecurityContext, the value specified in SecurityContext
 	// takes precedence for that container.
 	// +optional
-	seLinuxOptions?: null | SELinuxOptions @go(SELinuxOptions,*SELinuxOptions) @protobuf(1,bytes,opt)
+	seLinuxOptions?: null | #SELinuxOptions @go(SELinuxOptions,*SELinuxOptions) @protobuf(1,bytes,opt)
 
 	// The Windows specific settings applied to all containers.
 	// If unspecified, the options within a container's SecurityContext will be used.
 	// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
 	// +optional
-	windowsOptions?: null | WindowsSecurityContextOptions @go(WindowsOptions,*WindowsSecurityContextOptions) @protobuf(8,bytes,opt)
+	windowsOptions?: null | #WindowsSecurityContextOptions @go(WindowsOptions,*WindowsSecurityContextOptions) @protobuf(8,bytes,opt)
 
 	// The UID to run the entrypoint of the container process.
 	// Defaults to user specified in image metadata if unspecified.
@@ -3584,7 +3584,7 @@
 	// Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
 	// sysctls (by the container runtime) might fail to launch.
 	// +optional
-	sysctls?: [...Sysctl] @go(Sysctls,[]Sysctl) @protobuf(7,bytes,rep)
+	sysctls?: [...#Sysctl] @go(Sysctls,[]Sysctl) @protobuf(7,bytes,rep)
 
 	// fsGroupChangePolicy defines behavior of changing ownership and permission of the volume
 	// before being exposed inside Pod. This field will only apply to
@@ -3593,29 +3593,29 @@
 	// and emptydir.
 	// Valid values are "OnRootMismatch" and "Always". If not specified defaults to "Always".
 	// +optional
-	fsGroupChangePolicy?: null | PodFSGroupChangePolicy @go(FSGroupChangePolicy,*PodFSGroupChangePolicy) @protobuf(9,bytes,opt)
+	fsGroupChangePolicy?: null | #PodFSGroupChangePolicy @go(FSGroupChangePolicy,*PodFSGroupChangePolicy) @protobuf(9,bytes,opt)
 }
 
 // PodQOSClass defines the supported qos classes of Pods.
-PodQOSClass :: string // enumPodQOSClass
+#PodQOSClass: string // #enumPodQOSClass
 
-enumPodQOSClass ::
-	PodQOSGuaranteed |
-	PodQOSBurstable |
-	PodQOSBestEffort
+#enumPodQOSClass:
+	#PodQOSGuaranteed |
+	#PodQOSBurstable |
+	#PodQOSBestEffort
 
 // PodQOSGuaranteed is the Guaranteed qos class.
-PodQOSGuaranteed :: PodQOSClass & "Guaranteed"
+#PodQOSGuaranteed: #PodQOSClass & "Guaranteed"
 
 // PodQOSBurstable is the Burstable qos class.
-PodQOSBurstable :: PodQOSClass & "Burstable"
+#PodQOSBurstable: #PodQOSClass & "Burstable"
 
 // PodQOSBestEffort is the BestEffort qos class.
-PodQOSBestEffort :: PodQOSClass & "BestEffort"
+#PodQOSBestEffort: #PodQOSClass & "BestEffort"
 
 // PodDNSConfig defines the DNS parameters of a pod in addition to
 // those generated from DNSPolicy.
-PodDNSConfig :: {
+#PodDNSConfig: {
 	// A list of DNS name server IP addresses.
 	// This will be appended to the base nameservers generated from DNSPolicy.
 	// Duplicated nameservers will be removed.
@@ -3633,11 +3633,11 @@
 	// Duplicated entries will be removed. Resolution options given in Options
 	// will override those that appear in the base DNSPolicy.
 	// +optional
-	options?: [...PodDNSConfigOption] @go(Options,[]PodDNSConfigOption) @protobuf(3,bytes,rep)
+	options?: [...#PodDNSConfigOption] @go(Options,[]PodDNSConfigOption) @protobuf(3,bytes,rep)
 }
 
 // PodDNSConfigOption defines DNS resolver options of a pod.
-PodDNSConfigOption :: {
+#PodDNSConfigOption: {
 	// Required.
 	name?: string @go(Name) @protobuf(1,bytes,opt)
 
@@ -3648,7 +3648,7 @@
 // IP address information for entries in the (plural) PodIPs field.
 // Each entry includes:
 //    IP: An IP address allocated to the pod. Routable at least within the cluster.
-PodIP :: {
+#PodIP: {
 	// ip is an IP address (IPv4 or IPv6) assigned to the pod
 	ip?: string @go(IP) @protobuf(1,bytes,opt)
 }
@@ -3657,7 +3657,7 @@
 // EphemeralContainer. This separate type allows easy conversion from EphemeralContainer
 // to Container and allows separate documentation for the fields of EphemeralContainer.
 // When a new field is added to Container it must be added here as well.
-EphemeralContainerCommon :: {
+#EphemeralContainerCommon: {
 	// Name of the ephemeral container specified as a DNS_LABEL.
 	// This name must be unique among all containers, init containers and ephemeral containers.
 	name: string @go(Name) @protobuf(1,bytes,opt)
@@ -3696,7 +3696,7 @@
 	workingDir?: string @go(WorkingDir) @protobuf(5,bytes,opt)
 
 	// Ports are not allowed for ephemeral containers.
-	ports?: [...ContainerPort] @go(Ports,[]ContainerPort) @protobuf(6,bytes,rep)
+	ports?: [...#ContainerPort] @go(Ports,[]ContainerPort) @protobuf(6,bytes,rep)
 
 	// List of sources to populate environment variables in the container.
 	// The keys defined within a source must be a C_IDENTIFIER. All invalid keys
@@ -3705,48 +3705,48 @@
 	// Values defined by an Env with a duplicate key will take precedence.
 	// Cannot be updated.
 	// +optional
-	envFrom?: [...EnvFromSource] @go(EnvFrom,[]EnvFromSource) @protobuf(19,bytes,rep)
+	envFrom?: [...#EnvFromSource] @go(EnvFrom,[]EnvFromSource) @protobuf(19,bytes,rep)
 
 	// List of environment variables to set in the container.
 	// Cannot be updated.
 	// +optional
 	// +patchMergeKey=name
 	// +patchStrategy=merge
-	env?: [...EnvVar] @go(Env,[]EnvVar) @protobuf(7,bytes,rep)
+	env?: [...#EnvVar] @go(Env,[]EnvVar) @protobuf(7,bytes,rep)
 
 	// Resources are not allowed for ephemeral containers. Ephemeral containers use spare resources
 	// already allocated to the pod.
 	// +optional
-	resources?: ResourceRequirements @go(Resources) @protobuf(8,bytes,opt)
+	resources?: #ResourceRequirements @go(Resources) @protobuf(8,bytes,opt)
 
 	// Pod volumes to mount into the container's filesystem.
 	// Cannot be updated.
 	// +optional
 	// +patchMergeKey=mountPath
 	// +patchStrategy=merge
-	volumeMounts?: [...VolumeMount] @go(VolumeMounts,[]VolumeMount) @protobuf(9,bytes,rep)
+	volumeMounts?: [...#VolumeMount] @go(VolumeMounts,[]VolumeMount) @protobuf(9,bytes,rep)
 
 	// volumeDevices is the list of block devices to be used by the container.
 	// +patchMergeKey=devicePath
 	// +patchStrategy=merge
 	// +optional
-	volumeDevices?: [...VolumeDevice] @go(VolumeDevices,[]VolumeDevice) @protobuf(21,bytes,rep)
+	volumeDevices?: [...#VolumeDevice] @go(VolumeDevices,[]VolumeDevice) @protobuf(21,bytes,rep)
 
 	// Probes are not allowed for ephemeral containers.
 	// +optional
-	livenessProbe?: null | Probe @go(LivenessProbe,*Probe) @protobuf(10,bytes,opt)
+	livenessProbe?: null | #Probe @go(LivenessProbe,*Probe) @protobuf(10,bytes,opt)
 
 	// Probes are not allowed for ephemeral containers.
 	// +optional
-	readinessProbe?: null | Probe @go(ReadinessProbe,*Probe) @protobuf(11,bytes,opt)
+	readinessProbe?: null | #Probe @go(ReadinessProbe,*Probe) @protobuf(11,bytes,opt)
 
 	// Probes are not allowed for ephemeral containers.
 	// +optional
-	startupProbe?: null | Probe @go(StartupProbe,*Probe) @protobuf(22,bytes,opt)
+	startupProbe?: null | #Probe @go(StartupProbe,*Probe) @protobuf(22,bytes,opt)
 
 	// Lifecycle is not allowed for ephemeral containers.
 	// +optional
-	lifecycle?: null | Lifecycle @go(Lifecycle,*Lifecycle) @protobuf(12,bytes,opt)
+	lifecycle?: null | #Lifecycle @go(Lifecycle,*Lifecycle) @protobuf(12,bytes,opt)
 
 	// Optional: Path at which the file to which the container's termination message
 	// will be written is mounted into the container's filesystem.
@@ -3766,7 +3766,7 @@
 	// Defaults to File.
 	// Cannot be updated.
 	// +optional
-	terminationMessagePolicy?: TerminationMessagePolicy @go(TerminationMessagePolicy) @protobuf(20,bytes,opt,casttype=TerminationMessagePolicy)
+	terminationMessagePolicy?: #TerminationMessagePolicy @go(TerminationMessagePolicy) @protobuf(20,bytes,opt,casttype=TerminationMessagePolicy)
 
 	// Image pull policy.
 	// One of Always, Never, IfNotPresent.
@@ -3774,11 +3774,11 @@
 	// Cannot be updated.
 	// More info: https://kubernetes.io/docs/concepts/containers/images#updating-images
 	// +optional
-	imagePullPolicy?: PullPolicy @go(ImagePullPolicy) @protobuf(14,bytes,opt,casttype=PullPolicy)
+	imagePullPolicy?: #PullPolicy @go(ImagePullPolicy) @protobuf(14,bytes,opt,casttype=PullPolicy)
 
 	// SecurityContext is not allowed for ephemeral containers.
 	// +optional
-	securityContext?: null | SecurityContext @go(SecurityContext,*SecurityContext) @protobuf(15,bytes,opt)
+	securityContext?: null | #SecurityContext @go(SecurityContext,*SecurityContext) @protobuf(15,bytes,opt)
 
 	// Whether this container should allocate a buffer for stdin in the container runtime. If this
 	// is not set, reads from stdin in the container will always result in EOF.
@@ -3811,8 +3811,8 @@
 // via the pod's ephemeralcontainers subresource, and they will appear in the pod spec
 // once added.
 // This is an alpha feature enabled by the EphemeralContainers feature flag.
-EphemeralContainer :: {
-	EphemeralContainerCommon
+#EphemeralContainer: {
+	#EphemeralContainerCommon
 
 	// If set, the name of the container from PodSpec that this ephemeral container targets.
 	// The ephemeral container will be run in the namespaces (IPC, PID, etc) of this container.
@@ -3825,7 +3825,7 @@
 // PodStatus represents information about the status of a pod. Status may trail the actual
 // state of a system, especially if the node that hosts the pod cannot contact the control
 // plane.
-PodStatus :: {
+#PodStatus: {
 	// The phase of a Pod is a simple, high-level summary of where the Pod is in its lifecycle.
 	// The conditions array, the reason and message fields, and the individual container status
 	// arrays contain more detail about the pod's status.
@@ -3845,14 +3845,14 @@
 	//
 	// More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-phase
 	// +optional
-	phase?: PodPhase @go(Phase) @protobuf(1,bytes,opt,casttype=PodPhase)
+	phase?: #PodPhase @go(Phase) @protobuf(1,bytes,opt,casttype=PodPhase)
 
 	// Current service state of pod.
 	// More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-conditions
 	// +optional
 	// +patchMergeKey=type
 	// +patchStrategy=merge
-	conditions?: [...PodCondition] @go(Conditions,[]PodCondition) @protobuf(2,bytes,rep)
+	conditions?: [...#PodCondition] @go(Conditions,[]PodCondition) @protobuf(2,bytes,rep)
 
 	// A human readable message indicating details about why the pod is in this condition.
 	// +optional
@@ -3888,45 +3888,45 @@
 	// +optional
 	// +patchStrategy=merge
 	// +patchMergeKey=ip
-	podIPs?: [...PodIP] @go(PodIPs,[]PodIP) @protobuf(12,bytes,rep)
+	podIPs?: [...#PodIP] @go(PodIPs,[]PodIP) @protobuf(12,bytes,rep)
 
 	// RFC 3339 date and time at which the object was acknowledged by the Kubelet.
 	// This is before the Kubelet pulled the container image(s) for the pod.
 	// +optional
-	startTime?: null | metav1.Time @go(StartTime,*metav1.Time) @protobuf(7,bytes,opt)
+	startTime?: null | metav1.#Time @go(StartTime,*metav1.Time) @protobuf(7,bytes,opt)
 
 	// The list has one entry per init container in the manifest. The most recent successful
 	// init container will have ready = true, the most recently started container will have
 	// startTime set.
 	// More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-and-container-status
-	initContainerStatuses?: [...ContainerStatus] @go(InitContainerStatuses,[]ContainerStatus) @protobuf(10,bytes,rep)
+	initContainerStatuses?: [...#ContainerStatus] @go(InitContainerStatuses,[]ContainerStatus) @protobuf(10,bytes,rep)
 
 	// The list has one entry per container in the manifest. Each entry is currently the output
 	// of `docker inspect`.
 	// More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-and-container-status
 	// +optional
-	containerStatuses?: [...ContainerStatus] @go(ContainerStatuses,[]ContainerStatus) @protobuf(8,bytes,rep)
+	containerStatuses?: [...#ContainerStatus] @go(ContainerStatuses,[]ContainerStatus) @protobuf(8,bytes,rep)
 
 	// The Quality of Service (QOS) classification assigned to the pod based on resource requirements
 	// See PodQOSClass type for available QOS classes
 	// More info: https://git.k8s.io/community/contributors/design-proposals/node/resource-qos.md
 	// +optional
-	qosClass?: PodQOSClass @go(QOSClass) @protobuf(9,bytes,rep)
+	qosClass?: #PodQOSClass @go(QOSClass) @protobuf(9,bytes,rep)
 
 	// Status for any ephemeral containers that have run in this pod.
 	// This field is alpha-level and is only populated by servers that enable the EphemeralContainers feature.
 	// +optional
-	ephemeralContainerStatuses?: [...ContainerStatus] @go(EphemeralContainerStatuses,[]ContainerStatus) @protobuf(13,bytes,rep)
+	ephemeralContainerStatuses?: [...#ContainerStatus] @go(EphemeralContainerStatuses,[]ContainerStatus) @protobuf(13,bytes,rep)
 }
 
 // PodStatusResult is a wrapper for PodStatus returned by kubelet that can be encode/decoded
-PodStatusResult :: {
-	metav1.TypeMeta
+#PodStatusResult: {
+	metav1.#TypeMeta
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// Most recently observed status of the pod.
 	// This data may not be up to date.
@@ -3934,23 +3934,23 @@
 	// Read-only.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 	// +optional
-	status?: PodStatus @go(Status) @protobuf(2,bytes,opt)
+	status?: #PodStatus @go(Status) @protobuf(2,bytes,opt)
 }
 
 // Pod is a collection of containers that can run on a host. This resource is created
 // by clients and scheduled onto hosts.
-Pod :: {
-	metav1.TypeMeta
+#Pod: {
+	metav1.#TypeMeta
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// Specification of the desired behavior of the pod.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 	// +optional
-	spec?: PodSpec @go(Spec) @protobuf(2,bytes,opt)
+	spec?: #PodSpec @go(Spec) @protobuf(2,bytes,opt)
 
 	// Most recently observed status of the pod.
 	// This data may not be up to date.
@@ -3958,66 +3958,66 @@
 	// Read-only.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 	// +optional
-	status?: PodStatus @go(Status) @protobuf(3,bytes,opt)
+	status?: #PodStatus @go(Status) @protobuf(3,bytes,opt)
 }
 
 // PodList is a list of Pods.
-PodList :: {
-	metav1.TypeMeta
+#PodList: {
+	metav1.#TypeMeta
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
-	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// List of pods.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md
-	items: [...Pod] @go(Items,[]Pod) @protobuf(2,bytes,rep)
+	items: [...#Pod] @go(Items,[]Pod) @protobuf(2,bytes,rep)
 }
 
 // PodTemplateSpec describes the data a pod should have when created from a template
-PodTemplateSpec :: {
+#PodTemplateSpec: {
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// Specification of the desired behavior of the pod.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 	// +optional
-	spec?: PodSpec @go(Spec) @protobuf(2,bytes,opt)
+	spec?: #PodSpec @go(Spec) @protobuf(2,bytes,opt)
 }
 
 // PodTemplate describes a template for creating copies of a predefined pod.
-PodTemplate :: {
-	metav1.TypeMeta
+#PodTemplate: {
+	metav1.#TypeMeta
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// Template defines the pods that will be created from this pod template.
 	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 	// +optional
-	template?: PodTemplateSpec @go(Template) @protobuf(2,bytes,opt)
+	template?: #PodTemplateSpec @go(Template) @protobuf(2,bytes,opt)
 }
 
 // PodTemplateList is a list of PodTemplates.
-PodTemplateList :: {
-	metav1.TypeMeta
+#PodTemplateList: {
+	metav1.#TypeMeta
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
-	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// List of pod templates
-	items: [...PodTemplate] @go(Items,[]PodTemplate) @protobuf(2,bytes,rep)
+	items: [...#PodTemplate] @go(Items,[]PodTemplate) @protobuf(2,bytes,rep)
 }
 
 // ReplicationControllerSpec is the specification of a replication controller.
-ReplicationControllerSpec :: {
+#ReplicationControllerSpec: {
 	// Replicas is the number of desired replicas.
 	// This is a pointer to distinguish between explicit zero and unspecified.
 	// Defaults to 1.
@@ -4043,12 +4043,12 @@
 	// insufficient replicas are detected. This takes precedence over a TemplateRef.
 	// More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#pod-template
 	// +optional
-	template?: null | PodTemplateSpec @go(Template,*PodTemplateSpec) @protobuf(3,bytes,opt)
+	template?: null | #PodTemplateSpec @go(Template,*PodTemplateSpec) @protobuf(3,bytes,opt)
 }
 
 // ReplicationControllerStatus represents the current status of a replication
 // controller.
-ReplicationControllerStatus :: {
+#ReplicationControllerStatus: {
 	// Replicas is the most recently oberved number of replicas.
 	// More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#what-is-a-replicationcontroller
 	replicas: int32 @go(Replicas) @protobuf(1,varint,opt)
@@ -4073,30 +4073,30 @@
 	// +optional
 	// +patchMergeKey=type
 	// +patchStrategy=merge
-	conditions?: [...ReplicationControllerCondition] @go(Conditions,[]ReplicationControllerCondition) @protobuf(6,bytes,rep)
+	conditions?: [...#ReplicationControllerCondition] @go(Conditions,[]ReplicationControllerCondition) @protobuf(6,bytes,rep)
 }
 
-ReplicationControllerConditionType :: string // enumReplicationControllerConditionType
+#ReplicationControllerConditionType: string // #enumReplicationControllerConditionType
 
-enumReplicationControllerConditionType ::
-	ReplicationControllerReplicaFailure
+#enumReplicationControllerConditionType:
+	#ReplicationControllerReplicaFailure
 
 // ReplicationControllerReplicaFailure is added in a replication controller when one of its pods
 // fails to be created due to insufficient quota, limit ranges, pod security policy, node selectors,
 // etc. or deleted due to kubelet being down or finalizers are failing.
-ReplicationControllerReplicaFailure :: ReplicationControllerConditionType & "ReplicaFailure"
+#ReplicationControllerReplicaFailure: #ReplicationControllerConditionType & "ReplicaFailure"
 
 // ReplicationControllerCondition describes the state of a replication controller at a certain point.
-ReplicationControllerCondition :: {
+#ReplicationControllerCondition: {
 	// Type of replication controller condition.
-	type: ReplicationControllerConditionType @go(Type) @protobuf(1,bytes,opt,casttype=ReplicationControllerConditionType)
+	type: #ReplicationControllerConditionType @go(Type) @protobuf(1,bytes,opt,casttype=ReplicationControllerConditionType)
 
 	// Status of the condition, one of True, False, Unknown.
-	status: ConditionStatus @go(Status) @protobuf(2,bytes,opt,casttype=ConditionStatus)
+	status: #ConditionStatus @go(Status) @protobuf(2,bytes,opt,casttype=ConditionStatus)
 
 	// The last time the condition transitioned from one status to another.
 	// +optional
-	lastTransitionTime?: metav1.Time @go(LastTransitionTime) @protobuf(3,bytes,opt)
+	lastTransitionTime?: metav1.#Time @go(LastTransitionTime) @protobuf(3,bytes,opt)
 
 	// The reason for the condition's last transition.
 	// +optional
@@ -4108,19 +4108,19 @@
 }
 
 // ReplicationController represents the configuration of a replication controller.
-ReplicationController :: {
-	metav1.TypeMeta
+#ReplicationController: {
+	metav1.#TypeMeta
 
 	// If the Labels of a ReplicationController are empty, they are defaulted to
 	// be the same as the Pod(s) that the replication controller manages.
 	// Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// Spec defines the specification of the desired behavior of the replication controller.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 	// +optional
-	spec?: ReplicationControllerSpec @go(Spec) @protobuf(2,bytes,opt)
+	spec?: #ReplicationControllerSpec @go(Spec) @protobuf(2,bytes,opt)
 
 	// Status is the most recently observed status of the replication controller.
 	// This data may be out of date by some window of time.
@@ -4128,47 +4128,47 @@
 	// Read-only.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 	// +optional
-	status?: ReplicationControllerStatus @go(Status) @protobuf(3,bytes,opt)
+	status?: #ReplicationControllerStatus @go(Status) @protobuf(3,bytes,opt)
 }
 
 // ReplicationControllerList is a collection of replication controllers.
-ReplicationControllerList :: {
-	metav1.TypeMeta
+#ReplicationControllerList: {
+	metav1.#TypeMeta
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
-	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// List of replication controllers.
 	// More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller
-	items: [...ReplicationController] @go(Items,[]ReplicationController) @protobuf(2,bytes,rep)
+	items: [...#ReplicationController] @go(Items,[]ReplicationController) @protobuf(2,bytes,rep)
 }
 
 // Session Affinity Type string
-ServiceAffinity :: string // enumServiceAffinity
+#ServiceAffinity: string // #enumServiceAffinity
 
-enumServiceAffinity ::
-	ServiceAffinityClientIP |
-	ServiceAffinityNone
+#enumServiceAffinity:
+	#ServiceAffinityClientIP |
+	#ServiceAffinityNone
 
 // ServiceAffinityClientIP is the Client IP based.
-ServiceAffinityClientIP :: ServiceAffinity & "ClientIP"
+#ServiceAffinityClientIP: #ServiceAffinity & "ClientIP"
 
 // ServiceAffinityNone - no session affinity.
-ServiceAffinityNone :: ServiceAffinity & "None"
+#ServiceAffinityNone: #ServiceAffinity & "None"
 
-DefaultClientIPServiceAffinitySeconds :: int32 & 10800
+#DefaultClientIPServiceAffinitySeconds: int32 & 10800
 
 // SessionAffinityConfig represents the configurations of session affinity.
-SessionAffinityConfig :: {
+#SessionAffinityConfig: {
 	// clientIP contains the configurations of Client IP based session affinity.
 	// +optional
-	clientIP?: null | ClientIPConfig @go(ClientIP,*ClientIPConfig) @protobuf(1,bytes,opt)
+	clientIP?: null | #ClientIPConfig @go(ClientIP,*ClientIPConfig) @protobuf(1,bytes,opt)
 }
 
 // ClientIPConfig represents the configurations of Client IP based session affinity.
-ClientIPConfig :: {
+#ClientIPConfig: {
 	// timeoutSeconds specifies the seconds of ClientIP type session sticky time.
 	// The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP".
 	// Default value is 10800(for 3 hours).
@@ -4177,64 +4177,64 @@
 }
 
 // Service Type string describes ingress methods for a service
-ServiceType :: string // enumServiceType
+#ServiceType: string // #enumServiceType
 
-enumServiceType ::
-	ServiceTypeClusterIP |
-	ServiceTypeNodePort |
-	ServiceTypeLoadBalancer |
-	ServiceTypeExternalName
+#enumServiceType:
+	#ServiceTypeClusterIP |
+	#ServiceTypeNodePort |
+	#ServiceTypeLoadBalancer |
+	#ServiceTypeExternalName
 
 // ServiceTypeClusterIP means a service will only be accessible inside the
 // cluster, via the cluster IP.
-ServiceTypeClusterIP :: ServiceType & "ClusterIP"
+#ServiceTypeClusterIP: #ServiceType & "ClusterIP"
 
 // ServiceTypeNodePort means a service will be exposed on one port of
 // every node, in addition to 'ClusterIP' type.
-ServiceTypeNodePort :: ServiceType & "NodePort"
+#ServiceTypeNodePort: #ServiceType & "NodePort"
 
 // ServiceTypeLoadBalancer means a service will be exposed via an
 // external load balancer (if the cloud provider supports it), in addition
 // to 'NodePort' type.
-ServiceTypeLoadBalancer :: ServiceType & "LoadBalancer"
+#ServiceTypeLoadBalancer: #ServiceType & "LoadBalancer"
 
 // ServiceTypeExternalName means a service consists of only a reference to
 // an external name that kubedns or equivalent will return as a CNAME
 // record, with no exposing or proxying of any pods involved.
-ServiceTypeExternalName :: ServiceType & "ExternalName"
+#ServiceTypeExternalName: #ServiceType & "ExternalName"
 
 // Service External Traffic Policy Type string
-ServiceExternalTrafficPolicyType :: string // enumServiceExternalTrafficPolicyType
+#ServiceExternalTrafficPolicyType: string // #enumServiceExternalTrafficPolicyType
 
-enumServiceExternalTrafficPolicyType ::
-	ServiceExternalTrafficPolicyTypeLocal |
-	ServiceExternalTrafficPolicyTypeCluster
+#enumServiceExternalTrafficPolicyType:
+	#ServiceExternalTrafficPolicyTypeLocal |
+	#ServiceExternalTrafficPolicyTypeCluster
 
 // ServiceExternalTrafficPolicyTypeLocal specifies node-local endpoints behavior.
-ServiceExternalTrafficPolicyTypeLocal :: ServiceExternalTrafficPolicyType & "Local"
+#ServiceExternalTrafficPolicyTypeLocal: #ServiceExternalTrafficPolicyType & "Local"
 
 // ServiceExternalTrafficPolicyTypeCluster specifies node-global (legacy) behavior.
-ServiceExternalTrafficPolicyTypeCluster :: ServiceExternalTrafficPolicyType & "Cluster"
+#ServiceExternalTrafficPolicyTypeCluster: #ServiceExternalTrafficPolicyType & "Cluster"
 
 // ServiceStatus represents the current status of a service.
-ServiceStatus :: {
+#ServiceStatus: {
 	// LoadBalancer contains the current status of the load-balancer,
 	// if one is present.
 	// +optional
-	loadBalancer?: LoadBalancerStatus @go(LoadBalancer) @protobuf(1,bytes,opt)
+	loadBalancer?: #LoadBalancerStatus @go(LoadBalancer) @protobuf(1,bytes,opt)
 }
 
 // LoadBalancerStatus represents the status of a load-balancer.
-LoadBalancerStatus :: {
+#LoadBalancerStatus: {
 	// Ingress is a list containing ingress points for the load-balancer.
 	// Traffic intended for the service should be sent to these ingress points.
 	// +optional
-	ingress?: [...LoadBalancerIngress] @go(Ingress,[]LoadBalancerIngress) @protobuf(1,bytes,rep)
+	ingress?: [...#LoadBalancerIngress] @go(Ingress,[]LoadBalancerIngress) @protobuf(1,bytes,rep)
 }
 
 // LoadBalancerIngress represents the status of a load-balancer ingress point:
 // traffic intended for the service should be sent to an ingress point.
-LoadBalancerIngress :: {
+#LoadBalancerIngress: {
 	// IP is set for load-balancer ingress points that are IP based
 	// (typically GCE or OpenStack load-balancers)
 	// +optional
@@ -4248,23 +4248,23 @@
 
 // IPFamily represents the IP Family (IPv4 or IPv6). This type is used
 // to express the family of an IP expressed by a type (i.e. service.Spec.IPFamily)
-IPFamily :: string // enumIPFamily
+#IPFamily: string // #enumIPFamily
 
-enumIPFamily ::
-	IPv4Protocol |
-	IPv6Protocol
+#enumIPFamily:
+	#IPv4Protocol |
+	#IPv6Protocol
 
 // IPv4Protocol indicates that this IP is IPv4 protocol
-IPv4Protocol :: IPFamily & "IPv4"
+#IPv4Protocol: #IPFamily & "IPv4"
 
 // IPv6Protocol indicates that this IP is IPv6 protocol
-IPv6Protocol :: IPFamily & "IPv6"
+#IPv6Protocol: #IPFamily & "IPv6"
 
 // MaxServiceTopologyKeys is the largest number of topology keys allowed on a service
-MaxServiceTopologyKeys :: 16
+#MaxServiceTopologyKeys: 16
 
 // ServiceSpec describes the attributes that a user creates on a service.
-ServiceSpec :: {
+#ServiceSpec: {
 	// The list of ports that are exposed by this service.
 	// More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies
 	// +patchMergeKey=port
@@ -4272,7 +4272,7 @@
 	// +listType=map
 	// +listMapKey=port
 	// +listMapKey=protocol
-	ports?: [...ServicePort] @go(Ports,[]ServicePort) @protobuf(1,bytes,rep)
+	ports?: [...#ServicePort] @go(Ports,[]ServicePort) @protobuf(1,bytes,rep)
 
 	// Route service traffic to pods with label keys and values matching this
 	// selector. If empty or not present, the service is assumed to have an
@@ -4310,7 +4310,7 @@
 	// to the clusterIP.
 	// More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
 	// +optional
-	type?: ServiceType @go(Type) @protobuf(4,bytes,opt,casttype=ServiceType)
+	type?: #ServiceType @go(Type) @protobuf(4,bytes,opt,casttype=ServiceType)
 
 	// externalIPs is a list of IP addresses for which nodes in the cluster
 	// will also accept traffic for this service.  These IPs are not managed by
@@ -4326,7 +4326,7 @@
 	// Defaults to None.
 	// More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies
 	// +optional
-	sessionAffinity?: ServiceAffinity @go(SessionAffinity) @protobuf(7,bytes,opt,casttype=ServiceAffinity)
+	sessionAffinity?: #ServiceAffinity @go(SessionAffinity) @protobuf(7,bytes,opt,casttype=ServiceAffinity)
 
 	// Only applies to Service Type: LoadBalancer
 	// LoadBalancer will get created with the IP specified in this field.
@@ -4357,7 +4357,7 @@
 	// "Cluster" obscures the client source IP and may cause a second hop to
 	// another node, but should have good overall load-spreading.
 	// +optional
-	externalTrafficPolicy?: ServiceExternalTrafficPolicyType @go(ExternalTrafficPolicy) @protobuf(11,bytes,opt)
+	externalTrafficPolicy?: #ServiceExternalTrafficPolicyType @go(ExternalTrafficPolicy) @protobuf(11,bytes,opt)
 
 	// healthCheckNodePort specifies the healthcheck nodePort for the service.
 	// If not specified, HealthCheckNodePort is created by the service api
@@ -4378,7 +4378,7 @@
 
 	// sessionAffinityConfig contains the configurations of session affinity.
 	// +optional
-	sessionAffinityConfig?: null | SessionAffinityConfig @go(SessionAffinityConfig,*SessionAffinityConfig) @protobuf(14,bytes,opt)
+	sessionAffinityConfig?: null | #SessionAffinityConfig @go(SessionAffinityConfig,*SessionAffinityConfig) @protobuf(14,bytes,opt)
 
 	// ipFamily specifies whether this Service has a preference for a particular IP family (e.g. IPv4 vs.
 	// IPv6).  If a specific IP family is requested, the clusterIP field will be allocated from that family, if it is
@@ -4388,7 +4388,7 @@
 	// this family.  This field is immutable after creation. Assigning a ServiceIPFamily not available in the
 	// cluster (e.g. IPv6 in IPv4 only cluster) is an error condition and will fail during clusterIP assignment.
 	// +optional
-	ipFamily?: null | IPFamily @go(IPFamily,*IPFamily) @protobuf(15,bytes,opt,Configcasttype=IPFamily)
+	ipFamily?: null | #IPFamily @go(IPFamily,*IPFamily) @protobuf(15,bytes,opt,Configcasttype=IPFamily)
 
 	// topologyKeys is a preference-order list of topology keys which
 	// implementations of services should use to preferentially sort endpoints
@@ -4407,7 +4407,7 @@
 }
 
 // ServicePort contains information on service's port.
-ServicePort :: {
+#ServicePort: {
 	// The name of this port within the service. This must be a DNS_LABEL.
 	// All ports within a ServiceSpec must have unique names. When considering
 	// the endpoints for a Service, this must match the 'name' field in the
@@ -4419,7 +4419,7 @@
 	// The IP protocol for this port. Supports "TCP", "UDP", and "SCTP".
 	// Default is TCP.
 	// +optional
-	protocol?: Protocol @go(Protocol) @protobuf(2,bytes,opt,casttype=Protocol)
+	protocol?: #Protocol @go(Protocol) @protobuf(2,bytes,opt,casttype=Protocol)
 
 	// The application protocol for this port.
 	// This field follows standard Kubernetes label syntax.
@@ -4443,7 +4443,7 @@
 	// omitted or set equal to the 'port' field.
 	// More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service
 	// +optional
-	targetPort?: intstr.IntOrString @go(TargetPort) @protobuf(4,bytes,opt)
+	targetPort?: intstr.#IntOrString @go(TargetPort) @protobuf(4,bytes,opt)
 
 	// The port on each node on which this service is exposed when type=NodePort or LoadBalancer.
 	// Usually assigned by the system. If specified, it will be allocated to the service
@@ -4457,69 +4457,69 @@
 // Service is a named abstraction of software service (for example, mysql) consisting of local port
 // (for example 3306) that the proxy listens on, and the selector that determines which pods
 // will answer requests sent through the proxy.
-Service :: {
-	metav1.TypeMeta
+#Service: {
+	metav1.#TypeMeta
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// Spec defines the behavior of a service.
 	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 	// +optional
-	spec?: ServiceSpec @go(Spec) @protobuf(2,bytes,opt)
+	spec?: #ServiceSpec @go(Spec) @protobuf(2,bytes,opt)
 
 	// Most recently observed status of the service.
 	// Populated by the system.
 	// Read-only.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 	// +optional
-	status?: ServiceStatus @go(Status) @protobuf(3,bytes,opt)
+	status?: #ServiceStatus @go(Status) @protobuf(3,bytes,opt)
 }
 
 // ClusterIPNone - do not assign a cluster IP
 // no proxying required and no environment variables should be created for pods
-ClusterIPNone :: "None"
+#ClusterIPNone: "None"
 
 // ServiceList holds a list of services.
-ServiceList :: {
-	metav1.TypeMeta
+#ServiceList: {
+	metav1.#TypeMeta
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
-	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// List of services
-	items: [...Service] @go(Items,[]Service) @protobuf(2,bytes,rep)
+	items: [...#Service] @go(Items,[]Service) @protobuf(2,bytes,rep)
 }
 
 // ServiceAccount binds together:
 // * a name, understood by users, and perhaps by peripheral systems, for an identity
 // * a principal that can be authenticated and authorized
 // * a set of secrets
-ServiceAccount :: {
-	metav1.TypeMeta
+#ServiceAccount: {
+	metav1.#TypeMeta
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// Secrets is the list of secrets allowed to be used by pods running using this ServiceAccount.
 	// More info: https://kubernetes.io/docs/concepts/configuration/secret
 	// +optional
 	// +patchMergeKey=name
 	// +patchStrategy=merge
-	secrets?: [...ObjectReference] @go(Secrets,[]ObjectReference) @protobuf(2,bytes,rep)
+	secrets?: [...#ObjectReference] @go(Secrets,[]ObjectReference) @protobuf(2,bytes,rep)
 
 	// ImagePullSecrets is a list of references to secrets in the same namespace to use for pulling any images
 	// in pods that reference this ServiceAccount. ImagePullSecrets are distinct from Secrets because Secrets
 	// can be mounted in the pod, but ImagePullSecrets are only accessed by the kubelet.
 	// More info: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
 	// +optional
-	imagePullSecrets?: [...LocalObjectReference] @go(ImagePullSecrets,[]LocalObjectReference) @protobuf(3,bytes,rep)
+	imagePullSecrets?: [...#LocalObjectReference] @go(ImagePullSecrets,[]LocalObjectReference) @protobuf(3,bytes,rep)
 
 	// AutomountServiceAccountToken indicates whether pods running as this service account should have an API token automatically mounted.
 	// Can be overridden at the pod level.
@@ -4528,17 +4528,17 @@
 }
 
 // ServiceAccountList is a list of ServiceAccount objects
-ServiceAccountList :: {
-	metav1.TypeMeta
+#ServiceAccountList: {
+	metav1.#TypeMeta
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
-	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// List of ServiceAccounts.
 	// More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
-	items: [...ServiceAccount] @go(Items,[]ServiceAccount) @protobuf(2,bytes,rep)
+	items: [...#ServiceAccount] @go(Items,[]ServiceAccount) @protobuf(2,bytes,rep)
 }
 
 // Endpoints is a collection of endpoints that implement the actual service. Example:
@@ -4553,13 +4553,13 @@
 //       Ports: [{"name": "a", "port": 93}, {"name": "b", "port": 76}]
 //     },
 //  ]
-Endpoints :: {
-	metav1.TypeMeta
+#Endpoints: {
+	metav1.#TypeMeta
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// The set of all endpoints is the union of all subsets. Addresses are placed into
 	// subsets according to the IPs they share. A single address with multiple ports,
@@ -4569,7 +4569,7 @@
 	// NotReadyAddresses in the same subset.
 	// Sets of addresses and ports that comprise a service.
 	// +optional
-	subsets?: [...EndpointSubset] @go(Subsets,[]EndpointSubset) @protobuf(2,bytes,rep)
+	subsets?: [...#EndpointSubset] @go(Subsets,[]EndpointSubset) @protobuf(2,bytes,rep)
 }
 
 // EndpointSubset is a group of addresses with a common set of ports. The
@@ -4582,25 +4582,25 @@
 // The resulting set of endpoints can be viewed as:
 //     a: [ 10.10.1.1:8675, 10.10.2.2:8675 ],
 //     b: [ 10.10.1.1:309, 10.10.2.2:309 ]
-EndpointSubset :: {
+#EndpointSubset: {
 	// IP addresses which offer the related ports that are marked as ready. These endpoints
 	// should be considered safe for load balancers and clients to utilize.
 	// +optional
-	addresses?: [...EndpointAddress] @go(Addresses,[]EndpointAddress) @protobuf(1,bytes,rep)
+	addresses?: [...#EndpointAddress] @go(Addresses,[]EndpointAddress) @protobuf(1,bytes,rep)
 
 	// IP addresses which offer the related ports but are not currently marked as ready
 	// because they have not yet finished starting, have recently failed a readiness check,
 	// or have recently failed a liveness check.
 	// +optional
-	notReadyAddresses?: [...EndpointAddress] @go(NotReadyAddresses,[]EndpointAddress) @protobuf(2,bytes,rep)
+	notReadyAddresses?: [...#EndpointAddress] @go(NotReadyAddresses,[]EndpointAddress) @protobuf(2,bytes,rep)
 
 	// Port numbers available on the related IP addresses.
 	// +optional
-	ports?: [...EndpointPort] @go(Ports,[]EndpointPort) @protobuf(3,bytes,rep)
+	ports?: [...#EndpointPort] @go(Ports,[]EndpointPort) @protobuf(3,bytes,rep)
 }
 
 // EndpointAddress is a tuple that describes single IP address.
-EndpointAddress :: {
+#EndpointAddress: {
 	// The IP of this endpoint.
 	// May not be loopback (127.0.0.0/8), link-local (169.254.0.0/16),
 	// or link-local multicast ((224.0.0.0/24).
@@ -4619,11 +4619,11 @@
 
 	// Reference to object providing the endpoint.
 	// +optional
-	targetRef?: null | ObjectReference @go(TargetRef,*ObjectReference) @protobuf(2,bytes,opt)
+	targetRef?: null | #ObjectReference @go(TargetRef,*ObjectReference) @protobuf(2,bytes,opt)
 }
 
 // EndpointPort is a tuple that describes a single port.
-EndpointPort :: {
+#EndpointPort: {
 	// The name of this port.  This must match the 'name' field in the
 	// corresponding ServicePort.
 	// Must be a DNS_LABEL.
@@ -4638,7 +4638,7 @@
 	// Must be UDP, TCP, or SCTP.
 	// Default is TCP.
 	// +optional
-	protocol?: Protocol @go(Protocol) @protobuf(3,bytes,opt,casttype=Protocol)
+	protocol?: #Protocol @go(Protocol) @protobuf(3,bytes,opt,casttype=Protocol)
 
 	// The application protocol for this port.
 	// This field follows standard Kubernetes label syntax.
@@ -4652,20 +4652,20 @@
 }
 
 // EndpointsList is a list of endpoints.
-EndpointsList :: {
-	metav1.TypeMeta
+#EndpointsList: {
+	metav1.#TypeMeta
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
-	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// List of endpoints.
-	items: [...Endpoints] @go(Items,[]Endpoints) @protobuf(2,bytes,rep)
+	items: [...#Endpoints] @go(Items,[]Endpoints) @protobuf(2,bytes,rep)
 }
 
 // NodeSpec describes the attributes that a node is created with.
-NodeSpec :: {
+#NodeSpec: {
 	// PodCIDR represents the pod IP range assigned to the node.
 	// +optional
 	podCIDR?: string @go(PodCIDR) @protobuf(1,bytes,opt)
@@ -4688,12 +4688,12 @@
 
 	// If specified, the node's taints.
 	// +optional
-	taints?: [...Taint] @go(Taints,[]Taint) @protobuf(5,bytes,opt)
+	taints?: [...#Taint] @go(Taints,[]Taint) @protobuf(5,bytes,opt)
 
 	// If specified, the source to get node configuration from
 	// The DynamicKubeletConfig feature gate must be enabled for the Kubelet to use this field
 	// +optional
-	configSource?: null | NodeConfigSource @go(ConfigSource,*NodeConfigSource) @protobuf(6,bytes,opt)
+	configSource?: null | #NodeConfigSource @go(ConfigSource,*NodeConfigSource) @protobuf(6,bytes,opt)
 
 	// Deprecated. Not all kubelets will set this field. Remove field after 1.13.
 	// see: https://issues.k8s.io/61966
@@ -4702,13 +4702,13 @@
 }
 
 // NodeConfigSource specifies a source of node configuration. Exactly one subfield (excluding metadata) must be non-nil.
-NodeConfigSource :: {
+#NodeConfigSource: {
 	// ConfigMap is a reference to a Node's ConfigMap
-	configMap?: null | ConfigMapNodeConfigSource @go(ConfigMap,*ConfigMapNodeConfigSource) @protobuf(2,bytes,opt)
+	configMap?: null | #ConfigMapNodeConfigSource @go(ConfigMap,*ConfigMapNodeConfigSource) @protobuf(2,bytes,opt)
 }
 
 // ConfigMapNodeConfigSource contains the information to reference a ConfigMap as a config source for the Node.
-ConfigMapNodeConfigSource :: {
+#ConfigMapNodeConfigSource: {
 	// Namespace is the metadata.namespace of the referenced ConfigMap.
 	// This field is required in all cases.
 	namespace: string @go(Namespace) @protobuf(1,bytes,opt)
@@ -4720,7 +4720,7 @@
 	// UID is the metadata.UID of the referenced ConfigMap.
 	// This field is forbidden in Node.Spec, and required in Node.Status.
 	// +optional
-	uid?: types.UID @go(UID) @protobuf(3,bytes,opt)
+	uid?: types.#UID @go(UID) @protobuf(3,bytes,opt)
 
 	// ResourceVersion is the metadata.ResourceVersion of the referenced ConfigMap.
 	// This field is forbidden in Node.Spec, and required in Node.Status.
@@ -4733,20 +4733,20 @@
 }
 
 // DaemonEndpoint contains information about a single Daemon endpoint.
-DaemonEndpoint :: {
+#DaemonEndpoint: {
 	// Port number of the given endpoint.
 	Port: int32 @protobuf(1,varint,opt)
 }
 
 // NodeDaemonEndpoints lists ports opened by daemons running on the Node.
-NodeDaemonEndpoints :: {
+#NodeDaemonEndpoints: {
 	// Endpoint on which Kubelet is listening.
 	// +optional
-	kubeletEndpoint?: DaemonEndpoint @go(KubeletEndpoint) @protobuf(1,bytes,opt)
+	kubeletEndpoint?: #DaemonEndpoint @go(KubeletEndpoint) @protobuf(1,bytes,opt)
 }
 
 // NodeSystemInfo is a set of ids/uuids to uniquely identify the node.
-NodeSystemInfo :: {
+#NodeSystemInfo: {
 	// MachineID reported by the node. For unique machine identification
 	// in the cluster this field is preferred. Learn more from man(5)
 	// machine-id: http://man7.org/linux/man-pages/man5/machine-id.5.html
@@ -4783,7 +4783,7 @@
 }
 
 // NodeConfigStatus describes the status of the config assigned by Node.Spec.ConfigSource.
-NodeConfigStatus :: {
+#NodeConfigStatus: {
 	// Assigned reports the checkpointed config the node will try to use.
 	// When Node.Spec.ConfigSource is updated, the node checkpoints the associated
 	// config payload to local disk, along with a record indicating intended
@@ -4793,14 +4793,14 @@
 	// it tries to make the Assigned config the Active config by loading and
 	// validating the checkpointed payload identified by Assigned.
 	// +optional
-	assigned?: null | NodeConfigSource @go(Assigned,*NodeConfigSource) @protobuf(1,bytes,opt)
+	assigned?: null | #NodeConfigSource @go(Assigned,*NodeConfigSource) @protobuf(1,bytes,opt)
 
 	// Active reports the checkpointed config the node is actively using.
 	// Active will represent either the current version of the Assigned config,
 	// or the current LastKnownGood config, depending on whether attempting to use the
 	// Assigned config results in an error.
 	// +optional
-	active?: null | NodeConfigSource @go(Active,*NodeConfigSource) @protobuf(2,bytes,opt)
+	active?: null | #NodeConfigSource @go(Active,*NodeConfigSource) @protobuf(2,bytes,opt)
 
 	// LastKnownGood reports the checkpointed config the node will fall back to
 	// when it encounters an error attempting to use the Assigned config.
@@ -4814,7 +4814,7 @@
 	// You should not make assumptions about the node's method of determining config stability
 	// and correctness, as this may change or become configurable in the future.
 	// +optional
-	lastKnownGood?: null | NodeConfigSource @go(LastKnownGood,*NodeConfigSource) @protobuf(3,bytes,opt)
+	lastKnownGood?: null | #NodeConfigSource @go(LastKnownGood,*NodeConfigSource) @protobuf(3,bytes,opt)
 
 	// Error describes any problems reconciling the Spec.ConfigSource to the Active config.
 	// Errors may occur, for example, attempting to checkpoint Spec.ConfigSource to the local Assigned
@@ -4833,29 +4833,29 @@
 }
 
 // NodeStatus is information about the current status of a node.
-NodeStatus :: {
+#NodeStatus: {
 	// Capacity represents the total resources of a node.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#capacity
 	// +optional
-	capacity?: ResourceList @go(Capacity) @protobuf(1,bytes,rep,casttype=ResourceList,castkey=ResourceName)
+	capacity?: #ResourceList @go(Capacity) @protobuf(1,bytes,rep,casttype=ResourceList,castkey=ResourceName)
 
 	// Allocatable represents the resources of a node that are available for scheduling.
 	// Defaults to Capacity.
 	// +optional
-	allocatable?: ResourceList @go(Allocatable) @protobuf(2,bytes,rep,casttype=ResourceList,castkey=ResourceName)
+	allocatable?: #ResourceList @go(Allocatable) @protobuf(2,bytes,rep,casttype=ResourceList,castkey=ResourceName)
 
 	// NodePhase is the recently observed lifecycle phase of the node.
 	// More info: https://kubernetes.io/docs/concepts/nodes/node/#phase
 	// The field is never populated, and now is deprecated.
 	// +optional
-	phase?: NodePhase @go(Phase) @protobuf(3,bytes,opt,casttype=NodePhase)
+	phase?: #NodePhase @go(Phase) @protobuf(3,bytes,opt,casttype=NodePhase)
 
 	// Conditions is an array of current observed node conditions.
 	// More info: https://kubernetes.io/docs/concepts/nodes/node/#condition
 	// +optional
 	// +patchMergeKey=type
 	// +patchStrategy=merge
-	conditions?: [...NodeCondition] @go(Conditions,[]NodeCondition) @protobuf(4,bytes,rep)
+	conditions?: [...#NodeCondition] @go(Conditions,[]NodeCondition) @protobuf(4,bytes,rep)
 
 	// List of addresses reachable to the node.
 	// Queried from cloud provider, if available.
@@ -4866,40 +4866,40 @@
 	// +optional
 	// +patchMergeKey=type
 	// +patchStrategy=merge
-	addresses?: [...NodeAddress] @go(Addresses,[]NodeAddress) @protobuf(5,bytes,rep)
+	addresses?: [...#NodeAddress] @go(Addresses,[]NodeAddress) @protobuf(5,bytes,rep)
 
 	// Endpoints of daemons running on the Node.
 	// +optional
-	daemonEndpoints?: NodeDaemonEndpoints @go(DaemonEndpoints) @protobuf(6,bytes,opt)
+	daemonEndpoints?: #NodeDaemonEndpoints @go(DaemonEndpoints) @protobuf(6,bytes,opt)
 
 	// Set of ids/uuids to uniquely identify the node.
 	// More info: https://kubernetes.io/docs/concepts/nodes/node/#info
 	// +optional
-	nodeInfo?: NodeSystemInfo @go(NodeInfo) @protobuf(7,bytes,opt)
+	nodeInfo?: #NodeSystemInfo @go(NodeInfo) @protobuf(7,bytes,opt)
 
 	// List of container images on this node
 	// +optional
-	images?: [...ContainerImage] @go(Images,[]ContainerImage) @protobuf(8,bytes,rep)
+	images?: [...#ContainerImage] @go(Images,[]ContainerImage) @protobuf(8,bytes,rep)
 
 	// List of attachable volumes in use (mounted) by the node.
 	// +optional
-	volumesInUse?: [...UniqueVolumeName] @go(VolumesInUse,[]UniqueVolumeName) @protobuf(9,bytes,rep)
+	volumesInUse?: [...#UniqueVolumeName] @go(VolumesInUse,[]UniqueVolumeName) @protobuf(9,bytes,rep)
 
 	// List of volumes that are attached to the node.
 	// +optional
-	volumesAttached?: [...AttachedVolume] @go(VolumesAttached,[]AttachedVolume) @protobuf(10,bytes,rep)
+	volumesAttached?: [...#AttachedVolume] @go(VolumesAttached,[]AttachedVolume) @protobuf(10,bytes,rep)
 
 	// Status of the config assigned to the node via the dynamic Kubelet config feature.
 	// +optional
-	config?: null | NodeConfigStatus @go(Config,*NodeConfigStatus) @protobuf(11,bytes,opt)
+	config?: null | #NodeConfigStatus @go(Config,*NodeConfigStatus) @protobuf(11,bytes,opt)
 }
 
-UniqueVolumeName :: string
+#UniqueVolumeName: string
 
 // AttachedVolume describes a volume attached to a node
-AttachedVolume :: {
+#AttachedVolume: {
 	// Name of the attached volume
-	name: UniqueVolumeName @go(Name) @protobuf(1,bytes,rep)
+	name: #UniqueVolumeName @go(Name) @protobuf(1,bytes,rep)
 
 	// DevicePath represents the device path where the volume should be available
 	devicePath: string @go(DevicePath) @protobuf(2,bytes,rep)
@@ -4908,21 +4908,21 @@
 // AvoidPods describes pods that should avoid this node. This is the value for a
 // Node annotation with key scheduler.alpha.kubernetes.io/preferAvoidPods and
 // will eventually become a field of NodeStatus.
-AvoidPods :: {
+#AvoidPods: {
 	// Bounded-sized list of signatures of pods that should avoid this node, sorted
 	// in timestamp order from oldest to newest. Size of the slice is unspecified.
 	// +optional
-	preferAvoidPods?: [...PreferAvoidPodsEntry] @go(PreferAvoidPods,[]PreferAvoidPodsEntry) @protobuf(1,bytes,rep)
+	preferAvoidPods?: [...#PreferAvoidPodsEntry] @go(PreferAvoidPods,[]PreferAvoidPodsEntry) @protobuf(1,bytes,rep)
 }
 
 // Describes a class of pods that should avoid this node.
-PreferAvoidPodsEntry :: {
+#PreferAvoidPodsEntry: {
 	// The class of pods.
-	podSignature: PodSignature @go(PodSignature) @protobuf(1,bytes,opt)
+	podSignature: #PodSignature @go(PodSignature) @protobuf(1,bytes,opt)
 
 	// Time at which this entry was added to the list.
 	// +optional
-	evictionTime?: metav1.Time @go(EvictionTime) @protobuf(2,bytes,opt)
+	evictionTime?: metav1.#Time @go(EvictionTime) @protobuf(2,bytes,opt)
 
 	// (brief) reason why this entry was added to the list.
 	// +optional
@@ -4935,14 +4935,14 @@
 
 // Describes the class of pods that should avoid this node.
 // Exactly one field should be set.
-PodSignature :: {
+#PodSignature: {
 	// Reference to controller whose pods should avoid this node.
 	// +optional
-	podController?: null | metav1.OwnerReference @go(PodController,*metav1.OwnerReference) @protobuf(1,bytes,opt)
+	podController?: null | metav1.#OwnerReference @go(PodController,*metav1.OwnerReference) @protobuf(1,bytes,opt)
 }
 
 // Describe a container image
-ContainerImage :: {
+#ContainerImage: {
 	// Names by which this image is known.
 	// e.g. ["k8s.gcr.io/hyperkube:v1.0.7", "dockerhub.io/google_containers/hyperkube:v1.0.7"]
 	names: [...string] @go(Names,[]string) @protobuf(1,bytes,rep)
@@ -4952,61 +4952,61 @@
 	sizeBytes?: int64 @go(SizeBytes) @protobuf(2,varint,opt)
 }
 
-NodePhase :: string // enumNodePhase
+#NodePhase: string // #enumNodePhase
 
-enumNodePhase ::
-	NodePending |
-	NodeRunning |
-	NodeTerminated
+#enumNodePhase:
+	#NodePending |
+	#NodeRunning |
+	#NodeTerminated
 
 // NodePending means the node has been created/added by the system, but not configured.
-NodePending :: NodePhase & "Pending"
+#NodePending: #NodePhase & "Pending"
 
 // NodeRunning means the node has been configured and has Kubernetes components running.
-NodeRunning :: NodePhase & "Running"
+#NodeRunning: #NodePhase & "Running"
 
 // NodeTerminated means the node has been removed from the cluster.
-NodeTerminated :: NodePhase & "Terminated"
+#NodeTerminated: #NodePhase & "Terminated"
 
-NodeConditionType :: string // enumNodeConditionType
+#NodeConditionType: string // #enumNodeConditionType
 
-enumNodeConditionType ::
-	NodeReady |
-	NodeMemoryPressure |
-	NodeDiskPressure |
-	NodePIDPressure |
-	NodeNetworkUnavailable
+#enumNodeConditionType:
+	#NodeReady |
+	#NodeMemoryPressure |
+	#NodeDiskPressure |
+	#NodePIDPressure |
+	#NodeNetworkUnavailable
 
 // NodeReady means kubelet is healthy and ready to accept pods.
-NodeReady :: NodeConditionType & "Ready"
+#NodeReady: #NodeConditionType & "Ready"
 
 // NodeMemoryPressure means the kubelet is under pressure due to insufficient available memory.
-NodeMemoryPressure :: NodeConditionType & "MemoryPressure"
+#NodeMemoryPressure: #NodeConditionType & "MemoryPressure"
 
 // NodeDiskPressure means the kubelet is under pressure due to insufficient available disk.
-NodeDiskPressure :: NodeConditionType & "DiskPressure"
+#NodeDiskPressure: #NodeConditionType & "DiskPressure"
 
 // NodePIDPressure means the kubelet is under pressure due to insufficient available PID.
-NodePIDPressure :: NodeConditionType & "PIDPressure"
+#NodePIDPressure: #NodeConditionType & "PIDPressure"
 
 // NodeNetworkUnavailable means that network for the node is not correctly configured.
-NodeNetworkUnavailable :: NodeConditionType & "NetworkUnavailable"
+#NodeNetworkUnavailable: #NodeConditionType & "NetworkUnavailable"
 
 // NodeCondition contains condition information for a node.
-NodeCondition :: {
+#NodeCondition: {
 	// Type of node condition.
-	type: NodeConditionType @go(Type) @protobuf(1,bytes,opt,casttype=NodeConditionType)
+	type: #NodeConditionType @go(Type) @protobuf(1,bytes,opt,casttype=NodeConditionType)
 
 	// Status of the condition, one of True, False, Unknown.
-	status: ConditionStatus @go(Status) @protobuf(2,bytes,opt,casttype=ConditionStatus)
+	status: #ConditionStatus @go(Status) @protobuf(2,bytes,opt,casttype=ConditionStatus)
 
 	// Last time we got an update on a given condition.
 	// +optional
-	lastHeartbeatTime?: metav1.Time @go(LastHeartbeatTime) @protobuf(3,bytes,opt)
+	lastHeartbeatTime?: metav1.#Time @go(LastHeartbeatTime) @protobuf(3,bytes,opt)
 
 	// Last time the condition transit from one status to another.
 	// +optional
-	lastTransitionTime?: metav1.Time @go(LastTransitionTime) @protobuf(4,bytes,opt)
+	lastTransitionTime?: metav1.#Time @go(LastTransitionTime) @protobuf(4,bytes,opt)
 
 	// (brief) reason for the condition's last transition.
 	// +optional
@@ -5017,196 +5017,196 @@
 	message?: string @go(Message) @protobuf(6,bytes,opt)
 }
 
-NodeAddressType :: string // enumNodeAddressType
+#NodeAddressType: string // #enumNodeAddressType
 
-enumNodeAddressType ::
-	NodeHostName |
-	NodeExternalIP |
-	NodeInternalIP |
-	NodeExternalDNS |
-	NodeInternalDNS
+#enumNodeAddressType:
+	#NodeHostName |
+	#NodeExternalIP |
+	#NodeInternalIP |
+	#NodeExternalDNS |
+	#NodeInternalDNS
 
-NodeHostName ::    NodeAddressType & "Hostname"
-NodeExternalIP ::  NodeAddressType & "ExternalIP"
-NodeInternalIP ::  NodeAddressType & "InternalIP"
-NodeExternalDNS :: NodeAddressType & "ExternalDNS"
-NodeInternalDNS :: NodeAddressType & "InternalDNS"
+#NodeHostName:    #NodeAddressType & "Hostname"
+#NodeExternalIP:  #NodeAddressType & "ExternalIP"
+#NodeInternalIP:  #NodeAddressType & "InternalIP"
+#NodeExternalDNS: #NodeAddressType & "ExternalDNS"
+#NodeInternalDNS: #NodeAddressType & "InternalDNS"
 
 // NodeAddress contains information for the node's address.
-NodeAddress :: {
+#NodeAddress: {
 	// Node address type, one of Hostname, ExternalIP or InternalIP.
-	type: NodeAddressType @go(Type) @protobuf(1,bytes,opt,casttype=NodeAddressType)
+	type: #NodeAddressType @go(Type) @protobuf(1,bytes,opt,casttype=NodeAddressType)
 
 	// The node address.
 	address: string @go(Address) @protobuf(2,bytes,opt)
 }
 
 // ResourceName is the name identifying various resources in a ResourceList.
-ResourceName :: string // enumResourceName
+#ResourceName: string // #enumResourceName
 
-enumResourceName ::
-	ResourceCPU |
-	ResourceMemory |
-	ResourceStorage |
-	ResourceEphemeralStorage |
-	ResourcePods |
-	ResourceServices |
-	ResourceReplicationControllers |
-	ResourceQuotas |
-	ResourceSecrets |
-	ResourceConfigMaps |
-	ResourcePersistentVolumeClaims |
-	ResourceServicesNodePorts |
-	ResourceServicesLoadBalancers |
-	ResourceRequestsCPU |
-	ResourceRequestsMemory |
-	ResourceRequestsStorage |
-	ResourceRequestsEphemeralStorage |
-	ResourceLimitsCPU |
-	ResourceLimitsMemory |
-	ResourceLimitsEphemeralStorage
+#enumResourceName:
+	#ResourceCPU |
+	#ResourceMemory |
+	#ResourceStorage |
+	#ResourceEphemeralStorage |
+	#ResourcePods |
+	#ResourceServices |
+	#ResourceReplicationControllers |
+	#ResourceQuotas |
+	#ResourceSecrets |
+	#ResourceConfigMaps |
+	#ResourcePersistentVolumeClaims |
+	#ResourceServicesNodePorts |
+	#ResourceServicesLoadBalancers |
+	#ResourceRequestsCPU |
+	#ResourceRequestsMemory |
+	#ResourceRequestsStorage |
+	#ResourceRequestsEphemeralStorage |
+	#ResourceLimitsCPU |
+	#ResourceLimitsMemory |
+	#ResourceLimitsEphemeralStorage
 
 // CPU, in cores. (500m = .5 cores)
-ResourceCPU :: ResourceName & "cpu"
+#ResourceCPU: #ResourceName & "cpu"
 
 // Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
-ResourceMemory :: ResourceName & "memory"
+#ResourceMemory: #ResourceName & "memory"
 
 // Volume size, in bytes (e,g. 5Gi = 5GiB = 5 * 1024 * 1024 * 1024)
-ResourceStorage :: ResourceName & "storage"
+#ResourceStorage: #ResourceName & "storage"
 
 // Local ephemeral storage, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
 // The resource name for ResourceEphemeralStorage is alpha and it can change across releases.
-ResourceEphemeralStorage :: ResourceName & "ephemeral-storage"
+#ResourceEphemeralStorage: #ResourceName & "ephemeral-storage"
 
 // Default namespace prefix.
-ResourceDefaultNamespacePrefix :: "kubernetes.io/"
+#ResourceDefaultNamespacePrefix: "kubernetes.io/"
 
 // Name prefix for huge page resources (alpha).
-ResourceHugePagesPrefix :: "hugepages-"
+#ResourceHugePagesPrefix: "hugepages-"
 
 // Name prefix for storage resource limits
-ResourceAttachableVolumesPrefix :: "attachable-volumes-"
+#ResourceAttachableVolumesPrefix: "attachable-volumes-"
 
 // ResourceList is a set of (resource name, quantity) pairs.
-ResourceList :: {[string]: resource.Quantity}
+#ResourceList: {[string]: resource.#Quantity}
 
 // Node is a worker node in Kubernetes.
 // Each node will have a unique identifier in the cache (i.e. in etcd).
-Node :: {
-	metav1.TypeMeta
+#Node: {
+	metav1.#TypeMeta
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// Spec defines the behavior of a node.
 	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 	// +optional
-	spec?: NodeSpec @go(Spec) @protobuf(2,bytes,opt)
+	spec?: #NodeSpec @go(Spec) @protobuf(2,bytes,opt)
 
 	// Most recently observed status of the node.
 	// Populated by the system.
 	// Read-only.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 	// +optional
-	status?: NodeStatus @go(Status) @protobuf(3,bytes,opt)
+	status?: #NodeStatus @go(Status) @protobuf(3,bytes,opt)
 }
 
 // NodeList is the whole list of all Nodes which have been registered with master.
-NodeList :: {
-	metav1.TypeMeta
+#NodeList: {
+	metav1.#TypeMeta
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
-	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// List of nodes
-	items: [...Node] @go(Items,[]Node) @protobuf(2,bytes,rep)
+	items: [...#Node] @go(Items,[]Node) @protobuf(2,bytes,rep)
 }
 
 // FinalizerName is the name identifying a finalizer during namespace lifecycle.
-FinalizerName :: string // enumFinalizerName
+#FinalizerName: string // #enumFinalizerName
 
-enumFinalizerName ::
-	FinalizerKubernetes
+#enumFinalizerName:
+	#FinalizerKubernetes
 
-FinalizerKubernetes :: FinalizerName & "kubernetes"
+#FinalizerKubernetes: #FinalizerName & "kubernetes"
 
 // NamespaceSpec describes the attributes on a Namespace.
-NamespaceSpec :: {
+#NamespaceSpec: {
 	// Finalizers is an opaque list of values that must be empty to permanently remove object from storage.
 	// More info: https://kubernetes.io/docs/tasks/administer-cluster/namespaces/
 	// +optional
-	finalizers?: [...FinalizerName] @go(Finalizers,[]FinalizerName) @protobuf(1,bytes,rep,casttype=FinalizerName)
+	finalizers?: [...#FinalizerName] @go(Finalizers,[]FinalizerName) @protobuf(1,bytes,rep,casttype=FinalizerName)
 }
 
 // NamespaceStatus is information about the current status of a Namespace.
-NamespaceStatus :: {
+#NamespaceStatus: {
 	// Phase is the current lifecycle phase of the namespace.
 	// More info: https://kubernetes.io/docs/tasks/administer-cluster/namespaces/
 	// +optional
-	phase?: NamespacePhase @go(Phase) @protobuf(1,bytes,opt,casttype=NamespacePhase)
+	phase?: #NamespacePhase @go(Phase) @protobuf(1,bytes,opt,casttype=NamespacePhase)
 
 	// Represents the latest available observations of a namespace's current state.
 	// +optional
 	// +patchMergeKey=type
 	// +patchStrategy=merge
-	conditions?: [...NamespaceCondition] @go(Conditions,[]NamespaceCondition) @protobuf(2,bytes,rep)
+	conditions?: [...#NamespaceCondition] @go(Conditions,[]NamespaceCondition) @protobuf(2,bytes,rep)
 }
 
-NamespacePhase :: string // enumNamespacePhase
+#NamespacePhase: string // #enumNamespacePhase
 
-enumNamespacePhase ::
-	NamespaceActive |
-	NamespaceTerminating
+#enumNamespacePhase:
+	#NamespaceActive |
+	#NamespaceTerminating
 
 // NamespaceActive means the namespace is available for use in the system
-NamespaceActive :: NamespacePhase & "Active"
+#NamespaceActive: #NamespacePhase & "Active"
 
 // NamespaceTerminating means the namespace is undergoing graceful termination
-NamespaceTerminating :: NamespacePhase & "Terminating"
+#NamespaceTerminating: #NamespacePhase & "Terminating"
 
 // NamespaceTerminatingCause is returned as a defaults.cause item when a change is
 // forbidden due to the namespace being terminated.
-NamespaceTerminatingCause :: metav1.CauseType & "NamespaceTerminating"
+#NamespaceTerminatingCause: metav1.#CauseType & "NamespaceTerminating"
 
-NamespaceConditionType :: string // enumNamespaceConditionType
+#NamespaceConditionType: string // #enumNamespaceConditionType
 
-enumNamespaceConditionType ::
-	NamespaceDeletionDiscoveryFailure |
-	NamespaceDeletionContentFailure |
-	NamespaceDeletionGVParsingFailure |
-	NamespaceContentRemaining |
-	NamespaceFinalizersRemaining
+#enumNamespaceConditionType:
+	#NamespaceDeletionDiscoveryFailure |
+	#NamespaceDeletionContentFailure |
+	#NamespaceDeletionGVParsingFailure |
+	#NamespaceContentRemaining |
+	#NamespaceFinalizersRemaining
 
 // NamespaceDeletionDiscoveryFailure contains information about namespace deleter errors during resource discovery.
-NamespaceDeletionDiscoveryFailure :: NamespaceConditionType & "NamespaceDeletionDiscoveryFailure"
+#NamespaceDeletionDiscoveryFailure: #NamespaceConditionType & "NamespaceDeletionDiscoveryFailure"
 
 // NamespaceDeletionContentFailure contains information about namespace deleter errors during deletion of resources.
-NamespaceDeletionContentFailure :: NamespaceConditionType & "NamespaceDeletionContentFailure"
+#NamespaceDeletionContentFailure: #NamespaceConditionType & "NamespaceDeletionContentFailure"
 
 // NamespaceDeletionGVParsingFailure contains information about namespace deleter errors parsing GV for legacy types.
-NamespaceDeletionGVParsingFailure :: NamespaceConditionType & "NamespaceDeletionGroupVersionParsingFailure"
+#NamespaceDeletionGVParsingFailure: #NamespaceConditionType & "NamespaceDeletionGroupVersionParsingFailure"
 
 // NamespaceContentRemaining contains information about resources remaining in a namespace.
-NamespaceContentRemaining :: NamespaceConditionType & "NamespaceContentRemaining"
+#NamespaceContentRemaining: #NamespaceConditionType & "NamespaceContentRemaining"
 
 // NamespaceFinalizersRemaining contains information about which finalizers are on resources remaining in a namespace.
-NamespaceFinalizersRemaining :: NamespaceConditionType & "NamespaceFinalizersRemaining"
+#NamespaceFinalizersRemaining: #NamespaceConditionType & "NamespaceFinalizersRemaining"
 
 // NamespaceCondition contains details about state of namespace.
-NamespaceCondition :: {
+#NamespaceCondition: {
 	// Type of namespace controller condition.
-	type: NamespaceConditionType @go(Type) @protobuf(1,bytes,opt,casttype=NamespaceConditionType)
+	type: #NamespaceConditionType @go(Type) @protobuf(1,bytes,opt,casttype=NamespaceConditionType)
 
 	// Status of the condition, one of True, False, Unknown.
-	status: ConditionStatus @go(Status) @protobuf(2,bytes,opt,casttype=ConditionStatus)
+	status: #ConditionStatus @go(Status) @protobuf(2,bytes,opt,casttype=ConditionStatus)
 
 	// +optional
-	lastTransitionTime?: metav1.Time @go(LastTransitionTime) @protobuf(4,bytes,opt)
+	lastTransitionTime?: metav1.#Time @go(LastTransitionTime) @protobuf(4,bytes,opt)
 
 	// +optional
 	reason?: string @go(Reason) @protobuf(5,bytes,opt)
@@ -5217,79 +5217,79 @@
 
 // Namespace provides a scope for Names.
 // Use of multiple namespaces is optional.
-Namespace :: {
-	metav1.TypeMeta
+#Namespace: {
+	metav1.#TypeMeta
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// Spec defines the behavior of the Namespace.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 	// +optional
-	spec?: NamespaceSpec @go(Spec) @protobuf(2,bytes,opt)
+	spec?: #NamespaceSpec @go(Spec) @protobuf(2,bytes,opt)
 
 	// Status describes the current status of a Namespace.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 	// +optional
-	status?: NamespaceStatus @go(Status) @protobuf(3,bytes,opt)
+	status?: #NamespaceStatus @go(Status) @protobuf(3,bytes,opt)
 }
 
 // NamespaceList is a list of Namespaces.
-NamespaceList :: {
-	metav1.TypeMeta
+#NamespaceList: {
+	metav1.#TypeMeta
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
-	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// Items is the list of Namespace objects in the list.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
-	items: [...Namespace] @go(Items,[]Namespace) @protobuf(2,bytes,rep)
+	items: [...#Namespace] @go(Items,[]Namespace) @protobuf(2,bytes,rep)
 }
 
 // Binding ties one object to another; for example, a pod is bound to a node by a scheduler.
 // Deprecated in 1.7, please use the bindings subresource of pods instead.
-Binding :: {
-	metav1.TypeMeta
+#Binding: {
+	metav1.#TypeMeta
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// The target object that you want to bind to the standard object.
-	target: ObjectReference @go(Target) @protobuf(2,bytes,opt)
+	target: #ObjectReference @go(Target) @protobuf(2,bytes,opt)
 }
 
 // A list of ephemeral containers used with the Pod ephemeralcontainers subresource.
-EphemeralContainers :: {
-	metav1.TypeMeta
+#EphemeralContainers: {
+	metav1.#TypeMeta
 
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// A list of ephemeral containers associated with this pod. New ephemeral containers
 	// may be appended to this list, but existing ephemeral containers may not be removed
 	// or modified.
 	// +patchMergeKey=name
 	// +patchStrategy=merge
-	ephemeralContainers: [...EphemeralContainer] @go(EphemeralContainers,[]EphemeralContainer) @protobuf(2,bytes,rep)
+	ephemeralContainers: [...#EphemeralContainer] @go(EphemeralContainers,[]EphemeralContainer) @protobuf(2,bytes,rep)
 }
 
 // Preconditions must be fulfilled before an operation (update, delete, etc.) is carried out.
 // +k8s:openapi-gen=false
-Preconditions :: {
+#Preconditions: {
 	// Specifies the target UID.
 	// +optional
-	uid?: null | types.UID @go(UID,*types.UID) @protobuf(1,bytes,opt,casttype=k8s.io/apimachinery/pkg/types.UID)
+	uid?: null | types.#UID @go(UID,*types.UID) @protobuf(1,bytes,opt,casttype=k8s.io/apimachinery/pkg/types.UID)
 }
 
 // PodLogOptions is the query options for a Pod's logs REST call.
-PodLogOptions :: {
-	metav1.TypeMeta
+#PodLogOptions: {
+	metav1.#TypeMeta
 
 	// The container for which to stream logs. Defaults to only container if there is one container in the pod.
 	// +optional
@@ -5315,7 +5315,7 @@
 	// If this value is in the future, no logs will be returned.
 	// Only one of sinceSeconds or sinceTime may be specified.
 	// +optional
-	sinceTime?: null | metav1.Time @go(SinceTime,*metav1.Time) @protobuf(5,bytes,opt)
+	sinceTime?: null | metav1.#Time @go(SinceTime,*metav1.Time) @protobuf(5,bytes,opt)
 
 	// If true, add an RFC3339 or RFC3339Nano timestamp at the beginning of every line
 	// of log output. Defaults to false.
@@ -5347,8 +5347,8 @@
 // ---
 // TODO: merge w/ PodExecOptions below for stdin, stdout, etc
 // and also when we cut V2, we should export a "StreamOptions" or somesuch that contains Stdin, Stdout, Stder and TTY
-PodAttachOptions :: {
-	metav1.TypeMeta
+#PodAttachOptions: {
+	metav1.#TypeMeta
 
 	// Stdin if true, redirects the standard input stream of the pod for this call.
 	// Defaults to false.
@@ -5382,8 +5382,8 @@
 // ---
 // TODO: This is largely identical to PodAttachOptions above, make sure they stay in sync and see about merging
 // and also when we cut V2, we should export a "StreamOptions" or somesuch that contains Stdin, Stdout, Stder and TTY
-PodExecOptions :: {
-	metav1.TypeMeta
+#PodExecOptions: {
+	metav1.#TypeMeta
 
 	// Redirect the standard input stream of the pod for this call.
 	// Defaults to false.
@@ -5420,8 +5420,8 @@
 // ports (comma separated) to forward over.
 // Port forwarding over SPDY does not use these options. It requires the port
 // to be passed in the `port` header as part of request.
-PodPortForwardOptions :: {
-	metav1.TypeMeta
+#PodPortForwardOptions: {
+	metav1.#TypeMeta
 
 	// List of ports to forward
 	// Required when using WebSockets
@@ -5430,8 +5430,8 @@
 }
 
 // PodProxyOptions is the query options to a Pod's proxy call.
-PodProxyOptions :: {
-	metav1.TypeMeta
+#PodProxyOptions: {
+	metav1.#TypeMeta
 
 	// Path is the URL path to use for the current proxy request to pod.
 	// +optional
@@ -5439,8 +5439,8 @@
 }
 
 // NodeProxyOptions is the query options to a Node's proxy call.
-NodeProxyOptions :: {
-	metav1.TypeMeta
+#NodeProxyOptions: {
+	metav1.#TypeMeta
 
 	// Path is the URL path to use for the current proxy request to node.
 	// +optional
@@ -5448,8 +5448,8 @@
 }
 
 // ServiceProxyOptions is the query options to a Service's proxy call.
-ServiceProxyOptions :: {
-	metav1.TypeMeta
+#ServiceProxyOptions: {
+	metav1.#TypeMeta
 
 	// Path is the part of URLs that include service endpoints, suffixes,
 	// and parameters to use for the current proxy request to service.
@@ -5476,7 +5476,7 @@
 // Instead of using this type, create a locally provided and used type that is well-focused on your reference.
 // For example, ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533 .
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-ObjectReference :: {
+#ObjectReference: {
 	// Kind of the referent.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -5495,7 +5495,7 @@
 	// UID of the referent.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
 	// +optional
-	uid?: types.UID @go(UID) @protobuf(4,bytes,opt,casttype=k8s.io/apimachinery/pkg/types.UID)
+	uid?: types.#UID @go(UID) @protobuf(4,bytes,opt,casttype=k8s.io/apimachinery/pkg/types.UID)
 
 	// API version of the referent.
 	// +optional
@@ -5520,7 +5520,7 @@
 
 // LocalObjectReference contains enough information to let you locate the
 // referenced object inside the same namespace.
-LocalObjectReference :: {
+#LocalObjectReference: {
 	// Name of the referent.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
 	// TODO: Add other useful fields. apiVersion, kind, uid?
@@ -5530,7 +5530,7 @@
 
 // TypedLocalObjectReference contains enough information to let you locate the
 // typed referenced object inside the same namespace.
-TypedLocalObjectReference :: {
+#TypedLocalObjectReference: {
 	// APIGroup is the group for the resource being referenced.
 	// If APIGroup is not specified, the specified Kind must be in the core API group.
 	// For any other third-party types, APIGroup is required.
@@ -5545,16 +5545,16 @@
 }
 
 // SerializedReference is a reference to serialized object.
-SerializedReference :: {
-	metav1.TypeMeta
+#SerializedReference: {
+	metav1.#TypeMeta
 
 	// The reference to an object in the system.
 	// +optional
-	reference?: ObjectReference @go(Reference) @protobuf(1,bytes,opt)
+	reference?: #ObjectReference @go(Reference) @protobuf(1,bytes,opt)
 }
 
 // EventSource contains information for an event.
-EventSource :: {
+#EventSource: {
 	// Component from which the event is generated.
 	// +optional
 	component?: string @go(Component) @protobuf(1,bytes,opt)
@@ -5565,21 +5565,21 @@
 }
 
 // Information only and will not cause any problems
-EventTypeNormal :: "Normal"
+#EventTypeNormal: "Normal"
 
 // These events are to warn that something might go wrong
-EventTypeWarning :: "Warning"
+#EventTypeWarning: "Warning"
 
 // Event is a report of an event somewhere in the cluster.
-Event :: {
-	metav1.TypeMeta
+#Event: {
+	metav1.#TypeMeta
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-	metadata: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// The object that this event is about.
-	involvedObject: ObjectReference @go(InvolvedObject) @protobuf(2,bytes,opt)
+	involvedObject: #ObjectReference @go(InvolvedObject) @protobuf(2,bytes,opt)
 
 	// This should be a short, machine understandable string that gives the reason
 	// for the transition into the object's current status.
@@ -5594,15 +5594,15 @@
 
 	// The component reporting this event. Should be a short machine understandable string.
 	// +optional
-	source?: EventSource @go(Source) @protobuf(5,bytes,opt)
+	source?: #EventSource @go(Source) @protobuf(5,bytes,opt)
 
 	// The time at which the event was first recorded. (Time of server receipt is in TypeMeta.)
 	// +optional
-	firstTimestamp?: metav1.Time @go(FirstTimestamp) @protobuf(6,bytes,opt)
+	firstTimestamp?: metav1.#Time @go(FirstTimestamp) @protobuf(6,bytes,opt)
 
 	// The time at which the most recent occurrence of this event was recorded.
 	// +optional
-	lastTimestamp?: metav1.Time @go(LastTimestamp) @protobuf(7,bytes,opt)
+	lastTimestamp?: metav1.#Time @go(LastTimestamp) @protobuf(7,bytes,opt)
 
 	// The number of times this event has occurred.
 	// +optional
@@ -5614,11 +5614,11 @@
 
 	// Time when this Event was first observed.
 	// +optional
-	eventTime?: metav1.MicroTime @go(EventTime) @protobuf(10,bytes,opt)
+	eventTime?: metav1.#MicroTime @go(EventTime) @protobuf(10,bytes,opt)
 
 	// Data about the Event series this event represents or nil if it's a singleton Event.
 	// +optional
-	series?: null | EventSeries @go(Series,*EventSeries) @protobuf(11,bytes,opt)
+	series?: null | #EventSeries @go(Series,*EventSeries) @protobuf(11,bytes,opt)
 
 	// What action was taken/failed regarding to the Regarding object.
 	// +optional
@@ -5626,7 +5626,7 @@
 
 	// Optional secondary object for more complex actions.
 	// +optional
-	related?: null | ObjectReference @go(Related,*ObjectReference) @protobuf(13,bytes,opt)
+	related?: null | #ObjectReference @go(Related,*ObjectReference) @protobuf(13,bytes,opt)
 
 	// Name of the controller that emitted this Event, e.g. `kubernetes.io/kubelet`.
 	// +optional
@@ -5639,239 +5639,239 @@
 
 // EventSeries contain information on series of events, i.e. thing that was/is happening
 // continuously for some time.
-EventSeries :: {
+#EventSeries: {
 	// Number of occurrences in this series up to the last heartbeat time
 	count?: int32 @go(Count) @protobuf(1,varint)
 
 	// Time of the last occurrence observed
-	lastObservedTime?: metav1.MicroTime @go(LastObservedTime) @protobuf(2,bytes)
+	lastObservedTime?: metav1.#MicroTime @go(LastObservedTime) @protobuf(2,bytes)
 
 	// State of this Series: Ongoing or Finished
 	// Deprecated. Planned removal for 1.18
-	state?: EventSeriesState @go(State) @protobuf(3,bytes)
+	state?: #EventSeriesState @go(State) @protobuf(3,bytes)
 }
 
-EventSeriesState :: string // enumEventSeriesState
+#EventSeriesState: string // #enumEventSeriesState
 
-enumEventSeriesState ::
-	EventSeriesStateOngoing |
-	EventSeriesStateFinished |
-	EventSeriesStateUnknown
+#enumEventSeriesState:
+	#EventSeriesStateOngoing |
+	#EventSeriesStateFinished |
+	#EventSeriesStateUnknown
 
-EventSeriesStateOngoing ::  EventSeriesState & "Ongoing"
-EventSeriesStateFinished :: EventSeriesState & "Finished"
-EventSeriesStateUnknown ::  EventSeriesState & "Unknown"
+#EventSeriesStateOngoing:  #EventSeriesState & "Ongoing"
+#EventSeriesStateFinished: #EventSeriesState & "Finished"
+#EventSeriesStateUnknown:  #EventSeriesState & "Unknown"
 
 // EventList is a list of events.
-EventList :: {
-	metav1.TypeMeta
+#EventList: {
+	metav1.#TypeMeta
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
-	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// List of events
-	items: [...Event] @go(Items,[]Event) @protobuf(2,bytes,rep)
+	items: [...#Event] @go(Items,[]Event) @protobuf(2,bytes,rep)
 }
 
 // List holds a list of objects, which may not be known by the server.
-List :: metav1.List
+#List: metav1.#List
 
 // LimitType is a type of object that is limited
-LimitType :: string // enumLimitType
+#LimitType: string // #enumLimitType
 
-enumLimitType ::
-	LimitTypePod |
-	LimitTypeContainer |
-	LimitTypePersistentVolumeClaim
+#enumLimitType:
+	#LimitTypePod |
+	#LimitTypeContainer |
+	#LimitTypePersistentVolumeClaim
 
 // Limit that applies to all pods in a namespace
-LimitTypePod :: LimitType & "Pod"
+#LimitTypePod: #LimitType & "Pod"
 
 // Limit that applies to all containers in a namespace
-LimitTypeContainer :: LimitType & "Container"
+#LimitTypeContainer: #LimitType & "Container"
 
 // Limit that applies to all persistent volume claims in a namespace
-LimitTypePersistentVolumeClaim :: LimitType & "PersistentVolumeClaim"
+#LimitTypePersistentVolumeClaim: #LimitType & "PersistentVolumeClaim"
 
 // LimitRangeItem defines a min/max usage limit for any resource that matches on kind.
-LimitRangeItem :: {
+#LimitRangeItem: {
 	// Type of resource that this limit applies to.
-	type: LimitType @go(Type) @protobuf(1,bytes,opt,casttype=LimitType)
+	type: #LimitType @go(Type) @protobuf(1,bytes,opt,casttype=LimitType)
 
 	// Max usage constraints on this kind by resource name.
 	// +optional
-	max?: ResourceList @go(Max) @protobuf(2,bytes,rep,casttype=ResourceList,castkey=ResourceName)
+	max?: #ResourceList @go(Max) @protobuf(2,bytes,rep,casttype=ResourceList,castkey=ResourceName)
 
 	// Min usage constraints on this kind by resource name.
 	// +optional
-	min?: ResourceList @go(Min) @protobuf(3,bytes,rep,casttype=ResourceList,castkey=ResourceName)
+	min?: #ResourceList @go(Min) @protobuf(3,bytes,rep,casttype=ResourceList,castkey=ResourceName)
 
 	// Default resource requirement limit value by resource name if resource limit is omitted.
 	// +optional
-	default?: ResourceList @go(Default) @protobuf(4,bytes,rep,casttype=ResourceList,castkey=ResourceName)
+	default?: #ResourceList @go(Default) @protobuf(4,bytes,rep,casttype=ResourceList,castkey=ResourceName)
 
 	// DefaultRequest is the default resource requirement request value by resource name if resource request is omitted.
 	// +optional
-	defaultRequest?: ResourceList @go(DefaultRequest) @protobuf(5,bytes,rep,casttype=ResourceList,castkey=ResourceName)
+	defaultRequest?: #ResourceList @go(DefaultRequest) @protobuf(5,bytes,rep,casttype=ResourceList,castkey=ResourceName)
 
 	// MaxLimitRequestRatio if specified, the named resource must have a request and limit that are both non-zero where limit divided by request is less than or equal to the enumerated value; this represents the max burst for the named resource.
 	// +optional
-	maxLimitRequestRatio?: ResourceList @go(MaxLimitRequestRatio) @protobuf(6,bytes,rep,casttype=ResourceList,castkey=ResourceName)
+	maxLimitRequestRatio?: #ResourceList @go(MaxLimitRequestRatio) @protobuf(6,bytes,rep,casttype=ResourceList,castkey=ResourceName)
 }
 
 // LimitRangeSpec defines a min/max usage limit for resources that match on kind.
-LimitRangeSpec :: {
+#LimitRangeSpec: {
 	// Limits is the list of LimitRangeItem objects that are enforced.
-	limits: [...LimitRangeItem] @go(Limits,[]LimitRangeItem) @protobuf(1,bytes,rep)
+	limits: [...#LimitRangeItem] @go(Limits,[]LimitRangeItem) @protobuf(1,bytes,rep)
 }
 
 // LimitRange sets resource usage limits for each kind of resource in a Namespace.
-LimitRange :: {
-	metav1.TypeMeta
+#LimitRange: {
+	metav1.#TypeMeta
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// Spec defines the limits enforced.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 	// +optional
-	spec?: LimitRangeSpec @go(Spec) @protobuf(2,bytes,opt)
+	spec?: #LimitRangeSpec @go(Spec) @protobuf(2,bytes,opt)
 }
 
 // LimitRangeList is a list of LimitRange items.
-LimitRangeList :: {
-	metav1.TypeMeta
+#LimitRangeList: {
+	metav1.#TypeMeta
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
-	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// Items is a list of LimitRange objects.
 	// More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
-	items: [...LimitRange] @go(Items,[]LimitRange) @protobuf(2,bytes,rep)
+	items: [...#LimitRange] @go(Items,[]LimitRange) @protobuf(2,bytes,rep)
 }
 
 // Pods, number
-ResourcePods :: ResourceName & "pods"
+#ResourcePods: #ResourceName & "pods"
 
 // Services, number
-ResourceServices :: ResourceName & "services"
+#ResourceServices: #ResourceName & "services"
 
 // ReplicationControllers, number
-ResourceReplicationControllers :: ResourceName & "replicationcontrollers"
+#ResourceReplicationControllers: #ResourceName & "replicationcontrollers"
 
 // ResourceQuotas, number
-ResourceQuotas :: ResourceName & "resourcequotas"
+#ResourceQuotas: #ResourceName & "resourcequotas"
 
 // ResourceSecrets, number
-ResourceSecrets :: ResourceName & "secrets"
+#ResourceSecrets: #ResourceName & "secrets"
 
 // ResourceConfigMaps, number
-ResourceConfigMaps :: ResourceName & "configmaps"
+#ResourceConfigMaps: #ResourceName & "configmaps"
 
 // ResourcePersistentVolumeClaims, number
-ResourcePersistentVolumeClaims :: ResourceName & "persistentvolumeclaims"
+#ResourcePersistentVolumeClaims: #ResourceName & "persistentvolumeclaims"
 
 // ResourceServicesNodePorts, number
-ResourceServicesNodePorts :: ResourceName & "services.nodeports"
+#ResourceServicesNodePorts: #ResourceName & "services.nodeports"
 
 // ResourceServicesLoadBalancers, number
-ResourceServicesLoadBalancers :: ResourceName & "services.loadbalancers"
+#ResourceServicesLoadBalancers: #ResourceName & "services.loadbalancers"
 
 // CPU request, in cores. (500m = .5 cores)
-ResourceRequestsCPU :: ResourceName & "requests.cpu"
+#ResourceRequestsCPU: #ResourceName & "requests.cpu"
 
 // Memory request, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
-ResourceRequestsMemory :: ResourceName & "requests.memory"
+#ResourceRequestsMemory: #ResourceName & "requests.memory"
 
 // Storage request, in bytes
-ResourceRequestsStorage :: ResourceName & "requests.storage"
+#ResourceRequestsStorage: #ResourceName & "requests.storage"
 
 // Local ephemeral storage request, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
-ResourceRequestsEphemeralStorage :: ResourceName & "requests.ephemeral-storage"
+#ResourceRequestsEphemeralStorage: #ResourceName & "requests.ephemeral-storage"
 
 // CPU limit, in cores. (500m = .5 cores)
-ResourceLimitsCPU :: ResourceName & "limits.cpu"
+#ResourceLimitsCPU: #ResourceName & "limits.cpu"
 
 // Memory limit, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
-ResourceLimitsMemory :: ResourceName & "limits.memory"
+#ResourceLimitsMemory: #ResourceName & "limits.memory"
 
 // Local ephemeral storage limit, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
-ResourceLimitsEphemeralStorage :: ResourceName & "limits.ephemeral-storage"
+#ResourceLimitsEphemeralStorage: #ResourceName & "limits.ephemeral-storage"
 
 // HugePages request, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
 // As burst is not supported for HugePages, we would only quota its request, and ignore the limit.
-ResourceRequestsHugePagesPrefix :: "requests.hugepages-"
+#ResourceRequestsHugePagesPrefix: "requests.hugepages-"
 
 // Default resource requests prefix
-DefaultResourceRequestsPrefix :: "requests."
+#DefaultResourceRequestsPrefix: "requests."
 
 // A ResourceQuotaScope defines a filter that must match each object tracked by a quota
-ResourceQuotaScope :: string // enumResourceQuotaScope
+#ResourceQuotaScope: string // #enumResourceQuotaScope
 
-enumResourceQuotaScope ::
-	ResourceQuotaScopeTerminating |
-	ResourceQuotaScopeNotTerminating |
-	ResourceQuotaScopeBestEffort |
-	ResourceQuotaScopeNotBestEffort |
-	ResourceQuotaScopePriorityClass
+#enumResourceQuotaScope:
+	#ResourceQuotaScopeTerminating |
+	#ResourceQuotaScopeNotTerminating |
+	#ResourceQuotaScopeBestEffort |
+	#ResourceQuotaScopeNotBestEffort |
+	#ResourceQuotaScopePriorityClass
 
 // Match all pod objects where spec.activeDeadlineSeconds
-ResourceQuotaScopeTerminating :: ResourceQuotaScope & "Terminating"
+#ResourceQuotaScopeTerminating: #ResourceQuotaScope & "Terminating"
 
 // Match all pod objects where !spec.activeDeadlineSeconds
-ResourceQuotaScopeNotTerminating :: ResourceQuotaScope & "NotTerminating"
+#ResourceQuotaScopeNotTerminating: #ResourceQuotaScope & "NotTerminating"
 
 // Match all pod objects that have best effort quality of service
-ResourceQuotaScopeBestEffort :: ResourceQuotaScope & "BestEffort"
+#ResourceQuotaScopeBestEffort: #ResourceQuotaScope & "BestEffort"
 
 // Match all pod objects that do not have best effort quality of service
-ResourceQuotaScopeNotBestEffort :: ResourceQuotaScope & "NotBestEffort"
+#ResourceQuotaScopeNotBestEffort: #ResourceQuotaScope & "NotBestEffort"
 
 // Match all pod objects that have priority class mentioned
-ResourceQuotaScopePriorityClass :: ResourceQuotaScope & "PriorityClass"
+#ResourceQuotaScopePriorityClass: #ResourceQuotaScope & "PriorityClass"
 
 // ResourceQuotaSpec defines the desired hard limits to enforce for Quota.
-ResourceQuotaSpec :: {
+#ResourceQuotaSpec: {
 	// hard is the set of desired hard limits for each named resource.
 	// More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
 	// +optional
-	hard?: ResourceList @go(Hard) @protobuf(1,bytes,rep,casttype=ResourceList,castkey=ResourceName)
+	hard?: #ResourceList @go(Hard) @protobuf(1,bytes,rep,casttype=ResourceList,castkey=ResourceName)
 
 	// A collection of filters that must match each object tracked by a quota.
 	// If not specified, the quota matches all objects.
 	// +optional
-	scopes?: [...ResourceQuotaScope] @go(Scopes,[]ResourceQuotaScope) @protobuf(2,bytes,rep,casttype=ResourceQuotaScope)
+	scopes?: [...#ResourceQuotaScope] @go(Scopes,[]ResourceQuotaScope) @protobuf(2,bytes,rep,casttype=ResourceQuotaScope)
 
 	// scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota
 	// but expressed using ScopeSelectorOperator in combination with possible values.
 	// For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.
 	// +optional
-	scopeSelector?: null | ScopeSelector @go(ScopeSelector,*ScopeSelector) @protobuf(3,bytes,opt)
+	scopeSelector?: null | #ScopeSelector @go(ScopeSelector,*ScopeSelector) @protobuf(3,bytes,opt)
 }
 
 // A scope selector represents the AND of the selectors represented
 // by the scoped-resource selector requirements.
-ScopeSelector :: {
+#ScopeSelector: {
 	// A list of scope selector requirements by scope of the resources.
 	// +optional
-	matchExpressions?: [...ScopedResourceSelectorRequirement] @go(MatchExpressions,[]ScopedResourceSelectorRequirement) @protobuf(1,bytes,rep)
+	matchExpressions?: [...#ScopedResourceSelectorRequirement] @go(MatchExpressions,[]ScopedResourceSelectorRequirement) @protobuf(1,bytes,rep)
 }
 
 // A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator
 // that relates the scope name and values.
-ScopedResourceSelectorRequirement :: {
+#ScopedResourceSelectorRequirement: {
 	// The name of the scope that the selector applies to.
-	scopeName: ResourceQuotaScope @go(ScopeName) @protobuf(1,bytes,opt)
+	scopeName: #ResourceQuotaScope @go(ScopeName) @protobuf(1,bytes,opt)
 
 	// Represents a scope's relationship to a set of values.
 	// Valid operators are In, NotIn, Exists, DoesNotExist.
-	operator: ScopeSelectorOperator @go(Operator) @protobuf(2,bytes,opt,casttype=ScopedResourceSelectorOperator)
+	operator: #ScopeSelectorOperator @go(Operator) @protobuf(2,bytes,opt,casttype=ScopedResourceSelectorOperator)
 
 	// An array of string values. If the operator is In or NotIn,
 	// the values array must be non-empty. If the operator is Exists or DoesNotExist,
@@ -5883,74 +5883,74 @@
 
 // A scope selector operator is the set of operators that can be used in
 // a scope selector requirement.
-ScopeSelectorOperator :: string // enumScopeSelectorOperator
+#ScopeSelectorOperator: string // #enumScopeSelectorOperator
 
-enumScopeSelectorOperator ::
-	ScopeSelectorOpIn |
-	ScopeSelectorOpNotIn |
-	ScopeSelectorOpExists |
-	ScopeSelectorOpDoesNotExist
+#enumScopeSelectorOperator:
+	#ScopeSelectorOpIn |
+	#ScopeSelectorOpNotIn |
+	#ScopeSelectorOpExists |
+	#ScopeSelectorOpDoesNotExist
 
-ScopeSelectorOpIn ::           ScopeSelectorOperator & "In"
-ScopeSelectorOpNotIn ::        ScopeSelectorOperator & "NotIn"
-ScopeSelectorOpExists ::       ScopeSelectorOperator & "Exists"
-ScopeSelectorOpDoesNotExist :: ScopeSelectorOperator & "DoesNotExist"
+#ScopeSelectorOpIn:           #ScopeSelectorOperator & "In"
+#ScopeSelectorOpNotIn:        #ScopeSelectorOperator & "NotIn"
+#ScopeSelectorOpExists:       #ScopeSelectorOperator & "Exists"
+#ScopeSelectorOpDoesNotExist: #ScopeSelectorOperator & "DoesNotExist"
 
 // ResourceQuotaStatus defines the enforced hard limits and observed use.
-ResourceQuotaStatus :: {
+#ResourceQuotaStatus: {
 	// Hard is the set of enforced hard limits for each named resource.
 	// More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
 	// +optional
-	hard?: ResourceList @go(Hard) @protobuf(1,bytes,rep,casttype=ResourceList,castkey=ResourceName)
+	hard?: #ResourceList @go(Hard) @protobuf(1,bytes,rep,casttype=ResourceList,castkey=ResourceName)
 
 	// Used is the current observed total usage of the resource in the namespace.
 	// +optional
-	used?: ResourceList @go(Used) @protobuf(2,bytes,rep,casttype=ResourceList,castkey=ResourceName)
+	used?: #ResourceList @go(Used) @protobuf(2,bytes,rep,casttype=ResourceList,castkey=ResourceName)
 }
 
 // ResourceQuota sets aggregate quota restrictions enforced per namespace
-ResourceQuota :: {
-	metav1.TypeMeta
+#ResourceQuota: {
+	metav1.#TypeMeta
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// Spec defines the desired quota.
 	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 	// +optional
-	spec?: ResourceQuotaSpec @go(Spec) @protobuf(2,bytes,opt)
+	spec?: #ResourceQuotaSpec @go(Spec) @protobuf(2,bytes,opt)
 
 	// Status defines the actual enforced quota and its current usage.
 	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
 	// +optional
-	status?: ResourceQuotaStatus @go(Status) @protobuf(3,bytes,opt)
+	status?: #ResourceQuotaStatus @go(Status) @protobuf(3,bytes,opt)
 }
 
 // ResourceQuotaList is a list of ResourceQuota items.
-ResourceQuotaList :: {
-	metav1.TypeMeta
+#ResourceQuotaList: {
+	metav1.#TypeMeta
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
-	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// Items is a list of ResourceQuota objects.
 	// More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
-	items: [...ResourceQuota] @go(Items,[]ResourceQuota) @protobuf(2,bytes,rep)
+	items: [...#ResourceQuota] @go(Items,[]ResourceQuota) @protobuf(2,bytes,rep)
 }
 
 // Secret holds secret data of a certain type. The total bytes of the values in
 // the Data field must be less than MaxSecretSize bytes.
-Secret :: {
-	metav1.TypeMeta
+#Secret: {
+	metav1.#TypeMeta
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// Immutable, if set to true, ensures that data stored in the Secret cannot
 	// be updated (only object metadata can be modified).
@@ -5977,25 +5977,25 @@
 
 	// Used to facilitate programmatic handling of secret data.
 	// +optional
-	type?: SecretType @go(Type) @protobuf(3,bytes,opt,casttype=SecretType)
+	type?: #SecretType @go(Type) @protobuf(3,bytes,opt,casttype=SecretType)
 }
 
-MaxSecretSize :: 1048576
+#MaxSecretSize: 1048576
 
-SecretType :: string // enumSecretType
+#SecretType: string // #enumSecretType
 
-enumSecretType ::
-	SecretTypeOpaque |
-	SecretTypeServiceAccountToken |
-	SecretTypeDockercfg |
-	SecretTypeDockerConfigJson |
-	SecretTypeBasicAuth |
-	SecretTypeSSHAuth |
-	SecretTypeTLS |
-	SecretTypeBootstrapToken
+#enumSecretType:
+	#SecretTypeOpaque |
+	#SecretTypeServiceAccountToken |
+	#SecretTypeDockercfg |
+	#SecretTypeDockerConfigJson |
+	#SecretTypeBasicAuth |
+	#SecretTypeSSHAuth |
+	#SecretTypeTLS |
+	#SecretTypeBootstrapToken
 
 // SecretTypeOpaque is the default. Arbitrary user-defined data
-SecretTypeOpaque :: SecretType & "Opaque"
+#SecretTypeOpaque: #SecretType & "Opaque"
 
 // SecretTypeServiceAccountToken contains a token that identifies a service account to the API
 //
@@ -6003,65 +6003,65 @@
 // - Secret.Annotations["kubernetes.io/service-account.name"] - the name of the ServiceAccount the token identifies
 // - Secret.Annotations["kubernetes.io/service-account.uid"] - the UID of the ServiceAccount the token identifies
 // - Secret.Data["token"] - a token that identifies the service account to the API
-SecretTypeServiceAccountToken :: SecretType & "kubernetes.io/service-account-token"
+#SecretTypeServiceAccountToken: #SecretType & "kubernetes.io/service-account-token"
 
 // ServiceAccountNameKey is the key of the required annotation for SecretTypeServiceAccountToken secrets
-ServiceAccountNameKey :: "kubernetes.io/service-account.name"
+#ServiceAccountNameKey: "kubernetes.io/service-account.name"
 
 // ServiceAccountUIDKey is the key of the required annotation for SecretTypeServiceAccountToken secrets
-ServiceAccountUIDKey :: "kubernetes.io/service-account.uid"
+#ServiceAccountUIDKey: "kubernetes.io/service-account.uid"
 
 // ServiceAccountTokenKey is the key of the required data for SecretTypeServiceAccountToken secrets
-ServiceAccountTokenKey :: "token"
+#ServiceAccountTokenKey: "token"
 
 // ServiceAccountKubeconfigKey is the key of the optional kubeconfig data for SecretTypeServiceAccountToken secrets
-ServiceAccountKubeconfigKey :: "kubernetes.kubeconfig"
+#ServiceAccountKubeconfigKey: "kubernetes.kubeconfig"
 
 // ServiceAccountRootCAKey is the key of the optional root certificate authority for SecretTypeServiceAccountToken secrets
-ServiceAccountRootCAKey :: "ca.crt"
+#ServiceAccountRootCAKey: "ca.crt"
 
 // ServiceAccountNamespaceKey is the key of the optional namespace to use as the default for namespaced API calls
-ServiceAccountNamespaceKey :: "namespace"
+#ServiceAccountNamespaceKey: "namespace"
 
 // SecretTypeDockercfg contains a dockercfg file that follows the same format rules as ~/.dockercfg
 //
 // Required fields:
 // - Secret.Data[".dockercfg"] - a serialized ~/.dockercfg file
-SecretTypeDockercfg :: SecretType & "kubernetes.io/dockercfg"
+#SecretTypeDockercfg: #SecretType & "kubernetes.io/dockercfg"
 
 // DockerConfigKey is the key of the required data for SecretTypeDockercfg secrets
-DockerConfigKey :: ".dockercfg"
+#DockerConfigKey: ".dockercfg"
 
 // SecretTypeDockerConfigJson contains a dockercfg file that follows the same format rules as ~/.docker/config.json
 //
 // Required fields:
 // - Secret.Data[".dockerconfigjson"] - a serialized ~/.docker/config.json file
-SecretTypeDockerConfigJson :: SecretType & "kubernetes.io/dockerconfigjson"
+#SecretTypeDockerConfigJson: #SecretType & "kubernetes.io/dockerconfigjson"
 
 // DockerConfigJsonKey is the key of the required data for SecretTypeDockerConfigJson secrets
-DockerConfigJsonKey :: ".dockerconfigjson"
+#DockerConfigJsonKey: ".dockerconfigjson"
 
 // SecretTypeBasicAuth contains data needed for basic authentication.
 //
 // Required at least one of fields:
 // - Secret.Data["username"] - username used for authentication
 // - Secret.Data["password"] - password or token needed for authentication
-SecretTypeBasicAuth :: SecretType & "kubernetes.io/basic-auth"
+#SecretTypeBasicAuth: #SecretType & "kubernetes.io/basic-auth"
 
 // BasicAuthUsernameKey is the key of the username for SecretTypeBasicAuth secrets
-BasicAuthUsernameKey :: "username"
+#BasicAuthUsernameKey: "username"
 
 // BasicAuthPasswordKey is the key of the password or token for SecretTypeBasicAuth secrets
-BasicAuthPasswordKey :: "password"
+#BasicAuthPasswordKey: "password"
 
 // SecretTypeSSHAuth contains data needed for SSH authetication.
 //
 // Required field:
 // - Secret.Data["ssh-privatekey"] - private SSH key needed for authentication
-SecretTypeSSHAuth :: SecretType & "kubernetes.io/ssh-auth"
+#SecretTypeSSHAuth: #SecretType & "kubernetes.io/ssh-auth"
 
 // SSHAuthPrivateKey is the key of the required SSH private key for SecretTypeSSHAuth secrets
-SSHAuthPrivateKey :: "ssh-privatekey"
+#SSHAuthPrivateKey: "ssh-privatekey"
 
 // SecretTypeTLS contains information about a TLS client or server secret. It
 // is primarily used with TLS termination of the Ingress resource, but may be
@@ -6071,41 +6071,41 @@
 // - Secret.Data["tls.key"] - TLS private key.
 //   Secret.Data["tls.crt"] - TLS certificate.
 // TODO: Consider supporting different formats, specifying CA/destinationCA.
-SecretTypeTLS :: SecretType & "kubernetes.io/tls"
+#SecretTypeTLS: #SecretType & "kubernetes.io/tls"
 
 // TLSCertKey is the key for tls certificates in a TLS secert.
-TLSCertKey :: "tls.crt"
+#TLSCertKey: "tls.crt"
 
 // TLSPrivateKeyKey is the key for the private key field in a TLS secret.
-TLSPrivateKeyKey :: "tls.key"
+#TLSPrivateKeyKey: "tls.key"
 
 // SecretTypeBootstrapToken is used during the automated bootstrap process (first
 // implemented by kubeadm). It stores tokens that are used to sign well known
 // ConfigMaps. They are used for authn.
-SecretTypeBootstrapToken :: SecretType & "bootstrap.kubernetes.io/token"
+#SecretTypeBootstrapToken: #SecretType & "bootstrap.kubernetes.io/token"
 
 // SecretList is a list of Secret.
-SecretList :: {
-	metav1.TypeMeta
+#SecretList: {
+	metav1.#TypeMeta
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
-	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// Items is a list of secret objects.
 	// More info: https://kubernetes.io/docs/concepts/configuration/secret
-	items: [...Secret] @go(Items,[]Secret) @protobuf(2,bytes,rep)
+	items: [...#Secret] @go(Items,[]Secret) @protobuf(2,bytes,rep)
 }
 
 // ConfigMap holds configuration data for pods to consume.
-ConfigMap :: {
-	metav1.TypeMeta
+#ConfigMap: {
+	metav1.#TypeMeta
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// Immutable, if set to true, ensures that data stored in the ConfigMap cannot
 	// be updated (only object metadata can be modified).
@@ -6135,34 +6135,34 @@
 }
 
 // ConfigMapList is a resource containing a list of ConfigMap objects.
-ConfigMapList :: {
-	metav1.TypeMeta
+#ConfigMapList: {
+	metav1.#TypeMeta
 
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// Items is the list of ConfigMaps.
-	items: [...ConfigMap] @go(Items,[]ConfigMap) @protobuf(2,bytes,rep)
+	items: [...#ConfigMap] @go(Items,[]ConfigMap) @protobuf(2,bytes,rep)
 }
 
 // Type and constants for component health validation.
-ComponentConditionType :: string // enumComponentConditionType
+#ComponentConditionType: string // #enumComponentConditionType
 
-enumComponentConditionType ::
-	ComponentHealthy
+#enumComponentConditionType:
+	#ComponentHealthy
 
-ComponentHealthy :: ComponentConditionType & "Healthy"
+#ComponentHealthy: #ComponentConditionType & "Healthy"
 
 // Information about the condition of a component.
-ComponentCondition :: {
+#ComponentCondition: {
 	// Type of condition for a component.
 	// Valid value: "Healthy"
-	type: ComponentConditionType @go(Type) @protobuf(1,bytes,opt,casttype=ComponentConditionType)
+	type: #ComponentConditionType @go(Type) @protobuf(1,bytes,opt,casttype=ComponentConditionType)
 
 	// Status of the condition for a component.
 	// Valid values for "Healthy": "True", "False", or "Unknown".
-	status: ConditionStatus @go(Status) @protobuf(2,bytes,opt,casttype=ConditionStatus)
+	status: #ConditionStatus @go(Status) @protobuf(2,bytes,opt,casttype=ConditionStatus)
 
 	// Message about the condition for a component.
 	// For example, information about a health check.
@@ -6176,40 +6176,40 @@
 }
 
 // ComponentStatus (and ComponentStatusList) holds the cluster validation info.
-ComponentStatus :: {
-	metav1.TypeMeta
+#ComponentStatus: {
+	metav1.#TypeMeta
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// List of component conditions observed
 	// +optional
 	// +patchMergeKey=type
 	// +patchStrategy=merge
-	conditions?: [...ComponentCondition] @go(Conditions,[]ComponentCondition) @protobuf(2,bytes,rep)
+	conditions?: [...#ComponentCondition] @go(Conditions,[]ComponentCondition) @protobuf(2,bytes,rep)
 }
 
 // Status of all the conditions for the component as a list of ComponentStatus objects.
-ComponentStatusList :: {
-	metav1.TypeMeta
+#ComponentStatusList: {
+	metav1.#TypeMeta
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
-	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// List of ComponentStatus objects.
-	items: [...ComponentStatus] @go(Items,[]ComponentStatus) @protobuf(2,bytes,rep)
+	items: [...#ComponentStatus] @go(Items,[]ComponentStatus) @protobuf(2,bytes,rep)
 }
 
 // DownwardAPIVolumeSource represents a volume containing downward API info.
 // Downward API volumes support ownership management and SELinux relabeling.
-DownwardAPIVolumeSource :: {
+#DownwardAPIVolumeSource: {
 	// Items is a list of downward API volume file
 	// +optional
-	items?: [...DownwardAPIVolumeFile] @go(Items,[]DownwardAPIVolumeFile) @protobuf(1,bytes,rep)
+	items?: [...#DownwardAPIVolumeFile] @go(Items,[]DownwardAPIVolumeFile) @protobuf(1,bytes,rep)
 
 	// Optional: mode bits to use on created files by default. Must be a
 	// value between 0 and 0777. Defaults to 0644.
@@ -6220,21 +6220,21 @@
 	defaultMode?: null | int32 @go(DefaultMode,*int32) @protobuf(2,varint,opt)
 }
 
-DownwardAPIVolumeSourceDefaultMode :: int32 & 0o644
+#DownwardAPIVolumeSourceDefaultMode: int32 & 0o644
 
 // DownwardAPIVolumeFile represents information to create the file containing the pod field
-DownwardAPIVolumeFile :: {
+#DownwardAPIVolumeFile: {
 	// Required: Path is  the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'
 	path: string @go(Path) @protobuf(1,bytes,opt)
 
 	// Required: Selects a field of the pod: only annotations, labels, name and namespace are supported.
 	// +optional
-	fieldRef?: null | ObjectFieldSelector @go(FieldRef,*ObjectFieldSelector) @protobuf(2,bytes,opt)
+	fieldRef?: null | #ObjectFieldSelector @go(FieldRef,*ObjectFieldSelector) @protobuf(2,bytes,opt)
 
 	// Selects a resource of the container: only resources limits and requests
 	// (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.
 	// +optional
-	resourceFieldRef?: null | ResourceFieldSelector @go(ResourceFieldRef,*ResourceFieldSelector) @protobuf(3,bytes,opt)
+	resourceFieldRef?: null | #ResourceFieldSelector @go(ResourceFieldRef,*ResourceFieldSelector) @protobuf(3,bytes,opt)
 
 	// Optional: mode bits to use on this file, must be a value between 0
 	// and 0777. If not specified, the volume defaultMode will be used.
@@ -6247,20 +6247,20 @@
 // Represents downward API info for projecting into a projected volume.
 // Note that this is identical to a downwardAPI volume source without the default
 // mode.
-DownwardAPIProjection :: {
+#DownwardAPIProjection: {
 	// Items is a list of DownwardAPIVolume file
 	// +optional
-	items?: [...DownwardAPIVolumeFile] @go(Items,[]DownwardAPIVolumeFile) @protobuf(1,bytes,rep)
+	items?: [...#DownwardAPIVolumeFile] @go(Items,[]DownwardAPIVolumeFile) @protobuf(1,bytes,rep)
 }
 
 // SecurityContext holds security configuration that will be applied to a container.
 // Some fields are present in both SecurityContext and PodSecurityContext.  When both
 // are set, the values in SecurityContext take precedence.
-SecurityContext :: {
+#SecurityContext: {
 	// The capabilities to add/drop when running containers.
 	// Defaults to the default set of capabilities granted by the container runtime.
 	// +optional
-	capabilities?: null | Capabilities @go(Capabilities,*Capabilities) @protobuf(1,bytes,opt)
+	capabilities?: null | #Capabilities @go(Capabilities,*Capabilities) @protobuf(1,bytes,opt)
 
 	// Run container in privileged mode.
 	// Processes in privileged containers are essentially equivalent to root on the host.
@@ -6273,13 +6273,13 @@
 	// container.  May also be set in PodSecurityContext.  If set in both SecurityContext and
 	// PodSecurityContext, the value specified in SecurityContext takes precedence.
 	// +optional
-	seLinuxOptions?: null | SELinuxOptions @go(SELinuxOptions,*SELinuxOptions) @protobuf(3,bytes,opt)
+	seLinuxOptions?: null | #SELinuxOptions @go(SELinuxOptions,*SELinuxOptions) @protobuf(3,bytes,opt)
 
 	// The Windows specific settings applied to all containers.
 	// If unspecified, the options from the PodSecurityContext will be used.
 	// If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
 	// +optional
-	windowsOptions?: null | WindowsSecurityContextOptions @go(WindowsOptions,*WindowsSecurityContextOptions) @protobuf(10,bytes,opt)
+	windowsOptions?: null | #WindowsSecurityContextOptions @go(WindowsOptions,*WindowsSecurityContextOptions) @protobuf(10,bytes,opt)
 
 	// The UID to run the entrypoint of the container process.
 	// Defaults to user specified in image metadata if unspecified.
@@ -6323,27 +6323,27 @@
 	// readonly paths and masked paths.
 	// This requires the ProcMountType feature flag to be enabled.
 	// +optional
-	procMount?: null | ProcMountType @go(ProcMount,*ProcMountType) @protobuf(9,bytes,opt)
+	procMount?: null | #ProcMountType @go(ProcMount,*ProcMountType) @protobuf(9,bytes,opt)
 }
 
-ProcMountType :: string // enumProcMountType
+#ProcMountType: string // #enumProcMountType
 
-enumProcMountType ::
-	DefaultProcMount |
-	UnmaskedProcMount
+#enumProcMountType:
+	#DefaultProcMount |
+	#UnmaskedProcMount
 
 // DefaultProcMount uses the container runtime defaults for readonly and masked
 // paths for /proc.  Most container runtimes mask certain paths in /proc to avoid
 // accidental security exposure of special devices or information.
-DefaultProcMount :: ProcMountType & "Default"
+#DefaultProcMount: #ProcMountType & "Default"
 
 // UnmaskedProcMount bypasses the default masking behavior of the container
 // runtime and ensures the newly created /proc the container stays in tact with
 // no modifications.
-UnmaskedProcMount :: ProcMountType & "Unmasked"
+#UnmaskedProcMount: #ProcMountType & "Unmasked"
 
 // SELinuxOptions are the labels to be applied to the container
-SELinuxOptions :: {
+#SELinuxOptions: {
 	// User is a SELinux user label that applies to the container.
 	// +optional
 	user?: string @go(User) @protobuf(1,bytes,opt)
@@ -6362,7 +6362,7 @@
 }
 
 // WindowsSecurityContextOptions contain Windows-specific options and credentials.
-WindowsSecurityContextOptions :: {
+#WindowsSecurityContextOptions: {
 	// GMSACredentialSpecName is the name of the GMSA credential spec to use.
 	// +optional
 	gmsaCredentialSpecName?: null | string @go(GMSACredentialSpecName,*string) @protobuf(1,bytes,opt)
@@ -6382,13 +6382,13 @@
 }
 
 // RangeAllocation is not a public type.
-RangeAllocation :: {
-	metav1.TypeMeta
+#RangeAllocation: {
+	metav1.#TypeMeta
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
 	// Range is string that identifies the range represented by 'data'.
 	range: string @go(Range) @protobuf(2,bytes,opt)
@@ -6398,16 +6398,16 @@
 }
 
 // "default-scheduler" is the name of default scheduler.
-DefaultSchedulerName :: "default-scheduler"
+#DefaultSchedulerName: "default-scheduler"
 
 // RequiredDuringScheduling affinity is not symmetric, but there is an implicit PreferredDuringScheduling affinity rule
 // corresponding to every RequiredDuringScheduling affinity rule.
 // When the --hard-pod-affinity-weight scheduler flag is not specified,
 // DefaultHardPodAffinityWeight defines the weight of the implicit PreferredDuringScheduling affinity rule.
-DefaultHardPodAffinitySymmetricWeight :: int32 & 1
+#DefaultHardPodAffinitySymmetricWeight: int32 & 1
 
 // Sysctl defines a kernel parameter to be set
-Sysctl :: {
+#Sysctl: {
 	// Name of a property to set
 	name: string @go(Name) @protobuf(1,bytes,opt)
 
@@ -6417,50 +6417,50 @@
 
 // NodeResources is an object for conveying resource information about a node.
 // see http://releases.k8s.io/HEAD/docs/design/resources.md for more details.
-NodeResources :: {
+#NodeResources: {
 	// Capacity represents the available resources of a node
-	Capacity: ResourceList @protobuf(1,bytes,rep,name=capacity,casttype=ResourceList,castkey=ResourceName)
+	Capacity: #ResourceList @protobuf(1,bytes,rep,name=capacity,casttype=ResourceList,castkey=ResourceName)
 }
 
 // Enable stdin for remote command execution
-ExecStdinParam :: "input"
+#ExecStdinParam: "input"
 
 // Enable stdout for remote command execution
-ExecStdoutParam :: "output"
+#ExecStdoutParam: "output"
 
 // Enable stderr for remote command execution
-ExecStderrParam :: "error"
+#ExecStderrParam: "error"
 
 // Enable TTY for remote command execution
-ExecTTYParam :: "tty"
+#ExecTTYParam: "tty"
 
 // Command to run for remote command execution
-ExecCommandParam :: "command"
+#ExecCommandParam: "command"
 
 // Name of header that specifies stream type
-StreamType :: "streamType"
+#StreamType: "streamType"
 
 // Value for streamType header for stdin stream
-StreamTypeStdin :: "stdin"
+#StreamTypeStdin: "stdin"
 
 // Value for streamType header for stdout stream
-StreamTypeStdout :: "stdout"
+#StreamTypeStdout: "stdout"
 
 // Value for streamType header for stderr stream
-StreamTypeStderr :: "stderr"
+#StreamTypeStderr: "stderr"
 
 // Value for streamType header for data stream
-StreamTypeData :: "data"
+#StreamTypeData: "data"
 
 // Value for streamType header for error stream
-StreamTypeError :: "error"
+#StreamTypeError: "error"
 
 // Value for streamType header for terminal resize stream
-StreamTypeResize :: "resize"
+#StreamTypeResize: "resize"
 
 // Name of header that specifies the port being forwarded
-PortHeader :: "port"
+#PortHeader: "port"
 
 // Name of header that specifies a request ID used to associate the error
 // and data streams for a single forwarded connection
-PortForwardRequestIDHeader :: "requestID"
+#PortForwardRequestIDHeader: "requestID"
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/well_known_labels_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/well_known_labels_go_gen.cue
index 33525fd..87febc7 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/well_known_labels_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/well_known_labels_go_gen.cue
@@ -4,31 +4,31 @@
 
 package v1
 
-LabelHostname ::                "kubernetes.io/hostname"
-LabelZoneFailureDomain ::       "failure-domain.beta.kubernetes.io/zone"
-LabelZoneRegion ::              "failure-domain.beta.kubernetes.io/region"
-LabelZoneFailureDomainStable :: "topology.kubernetes.io/zone"
-LabelZoneRegionStable ::        "topology.kubernetes.io/region"
-LabelInstanceType ::            "beta.kubernetes.io/instance-type"
-LabelInstanceTypeStable ::      "node.kubernetes.io/instance-type"
-LabelOSStable ::                "kubernetes.io/os"
-LabelArchStable ::              "kubernetes.io/arch"
+#LabelHostname:                "kubernetes.io/hostname"
+#LabelZoneFailureDomain:       "failure-domain.beta.kubernetes.io/zone"
+#LabelZoneRegion:              "failure-domain.beta.kubernetes.io/region"
+#LabelZoneFailureDomainStable: "topology.kubernetes.io/zone"
+#LabelZoneRegionStable:        "topology.kubernetes.io/region"
+#LabelInstanceType:            "beta.kubernetes.io/instance-type"
+#LabelInstanceTypeStable:      "node.kubernetes.io/instance-type"
+#LabelOSStable:                "kubernetes.io/os"
+#LabelArchStable:              "kubernetes.io/arch"
 
 // LabelWindowsBuild is used on Windows nodes to specify the Windows build number starting with v1.17.0.
 // It's in the format MajorVersion.MinorVersion.BuildNumber (for ex: 10.0.17763)
-LabelWindowsBuild :: "node.kubernetes.io/windows-build"
+#LabelWindowsBuild: "node.kubernetes.io/windows-build"
 
 // LabelNamespaceSuffixKubelet is an allowed label namespace suffix kubelets can self-set ([*.]kubelet.kubernetes.io/*)
-LabelNamespaceSuffixKubelet :: "kubelet.kubernetes.io"
+#LabelNamespaceSuffixKubelet: "kubelet.kubernetes.io"
 
 // LabelNamespaceSuffixNode is an allowed label namespace suffix kubelets can self-set ([*.]node.kubernetes.io/*)
-LabelNamespaceSuffixNode :: "node.kubernetes.io"
+#LabelNamespaceSuffixNode: "node.kubernetes.io"
 
 // LabelNamespaceNodeRestriction is a forbidden label namespace that kubelets may not self-set when the NodeRestriction admission plugin is enabled
-LabelNamespaceNodeRestriction :: "node-restriction.kubernetes.io"
+#LabelNamespaceNodeRestriction: "node-restriction.kubernetes.io"
 
 // IsHeadlessService is added by Controller to an Endpoint denoting if its parent
 // Service is Headless. The existence of this label can be used further by other
 // controllers and kube-proxy to check if the Endpoint objects should be replicated when
 // using Headless Services
-IsHeadlessService :: "service.kubernetes.io/headless"
+#IsHeadlessService: "service.kubernetes.io/headless"
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/well_known_taints_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/well_known_taints_go_gen.cue
index 7f835d1..a48c35e 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/well_known_taints_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/api/core/v1/well_known_taints_go_gen.cue
@@ -6,29 +6,29 @@
 
 // TaintNodeNotReady will be added when node is not ready
 // and removed when node becomes ready.
-TaintNodeNotReady :: "node.kubernetes.io/not-ready"
+#TaintNodeNotReady: "node.kubernetes.io/not-ready"
 
 // TaintNodeUnreachable will be added when node becomes unreachable
 // (corresponding to NodeReady status ConditionUnknown)
 // and removed when node becomes reachable (NodeReady status ConditionTrue).
-TaintNodeUnreachable :: "node.kubernetes.io/unreachable"
+#TaintNodeUnreachable: "node.kubernetes.io/unreachable"
 
 // TaintNodeUnschedulable will be added when node becomes unschedulable
 // and removed when node becomes scheduable.
-TaintNodeUnschedulable :: "node.kubernetes.io/unschedulable"
+#TaintNodeUnschedulable: "node.kubernetes.io/unschedulable"
 
 // TaintNodeMemoryPressure will be added when node has memory pressure
 // and removed when node has enough memory.
-TaintNodeMemoryPressure :: "node.kubernetes.io/memory-pressure"
+#TaintNodeMemoryPressure: "node.kubernetes.io/memory-pressure"
 
 // TaintNodeDiskPressure will be added when node has disk pressure
 // and removed when node has enough disk.
-TaintNodeDiskPressure :: "node.kubernetes.io/disk-pressure"
+#TaintNodeDiskPressure: "node.kubernetes.io/disk-pressure"
 
 // TaintNodeNetworkUnavailable will be added when node's network is unavailable
 // and removed when network becomes ready.
-TaintNodeNetworkUnavailable :: "node.kubernetes.io/network-unavailable"
+#TaintNodeNetworkUnavailable: "node.kubernetes.io/network-unavailable"
 
 // TaintNodePIDPressure will be added when node has pid pressure
 // and removed when node has enough disk.
-TaintNodePIDPressure :: "node.kubernetes.io/pid-pressure"
+#TaintNodePIDPressure: "node.kubernetes.io/pid-pressure"
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/api/resource/amount_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/api/resource/amount_go_gen.cue
index 7756e4a..706b3c8 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/api/resource/amount_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/api/resource/amount_go_gen.cue
@@ -7,25 +7,25 @@
 // Scale is used for getting and setting the base-10 scaled value.
 // Base-2 scales are omitted for mathematical simplicity.
 // See Quantity.ScaledValue for more details.
-Scale :: int32 // enumScale
+#Scale: int32 // #enumScale
 
-enumScale ::
-	Nano |
-	Micro |
-	Milli |
-	Kilo |
-	Mega |
-	Giga |
-	Tera |
-	Peta |
-	Exa
+#enumScale:
+	#Nano |
+	#Micro |
+	#Milli |
+	#Kilo |
+	#Mega |
+	#Giga |
+	#Tera |
+	#Peta |
+	#Exa
 
-Nano ::  Scale & -9
-Micro :: Scale & -6
-Milli :: Scale & -3
-Kilo ::  Scale & 3
-Mega ::  Scale & 6
-Giga ::  Scale & 9
-Tera ::  Scale & 12
-Peta ::  Scale & 15
-Exa ::   Scale & 18
+#Nano:  #Scale & -9
+#Micro: #Scale & -6
+#Milli: #Scale & -3
+#Kilo:  #Scale & 3
+#Mega:  #Scale & 6
+#Giga:  #Scale & 9
+#Tera:  #Scale & 12
+#Peta:  #Scale & 15
+#Exa:   #Scale & 18
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/api/resource/quantity_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/api/resource/quantity_go_gen.cue
index e121546..6eb9414 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/api/resource/quantity_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/api/resource/quantity_go_gen.cue
@@ -62,19 +62,19 @@
 // +protobuf.options.(gogoproto.goproto_stringer)=false
 // +k8s:deepcopy-gen=true
 // +k8s:openapi-gen=true
-Quantity :: _
+#Quantity: _
 
 // CanonicalValue allows a quantity amount to be converted to a string.
-CanonicalValue :: _
+#CanonicalValue: _
 
 // Format lists the three possible formattings of a quantity.
-Format :: string // enumFormat
+#Format: string // #enumFormat
 
-enumFormat ::
-	DecimalExponent |
-	BinarySI |
-	DecimalSI
+#enumFormat:
+	#DecimalExponent |
+	#BinarySI |
+	#DecimalSI
 
-DecimalExponent :: Format & "DecimalExponent"
-BinarySI ::        Format & "BinarySI"
-DecimalSI ::       Format & "DecimalSI"
+#DecimalExponent: #Format & "DecimalExponent"
+#BinarySI:        #Format & "BinarySI"
+#DecimalSI:       #Format & "DecimalSI"
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/duration_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/duration_go_gen.cue
index 8479f49..25ea8ec 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/duration_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/duration_go_gen.cue
@@ -7,4 +7,4 @@
 // Duration is a wrapper around time.Duration which supports correct
 // marshaling to YAML and JSON. In particular, it marshals into strings, which
 // can be used as map keys in json.
-Duration :: _
+#Duration: _
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/group_version_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/group_version_go_gen.cue
index fdc98a3..8ee2b15 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/group_version_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/group_version_go_gen.cue
@@ -8,7 +8,7 @@
 // concepts during lookup stages without having partially valid types
 //
 // +protobuf.options.(gogoproto.goproto_stringer)=false
-GroupResource :: {
+#GroupResource: {
 	group:    string @go(Group) @protobuf(1,bytes,opt)
 	resource: string @go(Resource) @protobuf(2,bytes,opt)
 }
@@ -17,7 +17,7 @@
 // to avoid automatic coersion.  It doesn't use a GroupVersion to avoid custom marshalling
 //
 // +protobuf.options.(gogoproto.goproto_stringer)=false
-GroupVersionResource :: {
+#GroupVersionResource: {
 	group:    string @go(Group) @protobuf(1,bytes,opt)
 	version:  string @go(Version) @protobuf(2,bytes,opt)
 	resource: string @go(Resource) @protobuf(3,bytes,opt)
@@ -27,7 +27,7 @@
 // concepts during lookup stages without having partially valid types
 //
 // +protobuf.options.(gogoproto.goproto_stringer)=false
-GroupKind :: {
+#GroupKind: {
 	group: string @go(Group) @protobuf(1,bytes,opt)
 	kind:  string @go(Kind) @protobuf(2,bytes,opt)
 }
@@ -36,7 +36,7 @@
 // to avoid automatic coersion.  It doesn't use a GroupVersion to avoid custom marshalling
 //
 // +protobuf.options.(gogoproto.goproto_stringer)=false
-GroupVersionKind :: {
+#GroupVersionKind: {
 	group:   string @go(Group) @protobuf(1,bytes,opt)
 	version: string @go(Version) @protobuf(2,bytes,opt)
 	kind:    string @go(Kind) @protobuf(3,bytes,opt)
@@ -45,4 +45,4 @@
 // GroupVersion contains the "group" and the "version", which uniquely identifies the API.
 //
 // +protobuf.options.(gogoproto.goproto_stringer)=false
-GroupVersion :: _
+#GroupVersion: _
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/meta_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/meta_go_gen.cue
index 9944f9e..f3c39a4 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/meta_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/meta_go_gen.cue
@@ -5,29 +5,29 @@
 package v1
 
 // TODO: move this, Object, List, and Type to a different package
-ObjectMetaAccessor :: _
+#ObjectMetaAccessor: _
 
 // Object lets you work with object metadata from any of the versioned or
 // internal API objects. Attempting to set or retrieve a field on an object that does
 // not support that field (Name, UID, Namespace on lists) will be a no-op and return
 // a default value.
-Object :: _
+#Object: _
 
 // ListMetaAccessor retrieves the list interface from an object
-ListMetaAccessor :: _
+#ListMetaAccessor: _
 
 // Common lets you work with core metadata from any of the versioned or
 // internal API objects. Attempting to set or retrieve a field on an object that does
 // not support that field will be a no-op and return a default value.
 // TODO: move this, and TypeMeta and ListMeta, to a different package
-Common :: _
+#Common: _
 
 // ListInterface lets you work with list metadata from any of the versioned or
 // internal API objects. Attempting to set or retrieve a field on an object that does
 // not support that field will be a no-op and return a default value.
 // TODO: move this, and TypeMeta and ListMeta, to a different package
-ListInterface :: _
+#ListInterface: _
 
 // Type exposes the type and APIVersion of versioned or internal API objects.
 // TODO: move this, and TypeMeta and ListMeta, to a different package
-Type :: _
+#Type: _
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_go_gen.cue
index 4097996..3c067ba 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_go_gen.cue
@@ -4,11 +4,11 @@
 
 package v1
 
-RFC3339Micro :: "2006-01-02T15:04:05.000000Z07:00"
+#RFC3339Micro: "2006-01-02T15:04:05.000000Z07:00"
 
 // MicroTime is version of Time with microsecond level precision.
 //
 // +protobuf.options.marshal=false
 // +protobuf.as=Timestamp
 // +protobuf.options.(gogoproto.goproto_stringer)=false
-MicroTime :: _
+#MicroTime: _
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/register_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/register_go_gen.cue
index edb4dbb..39d23b2 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/register_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/register_go_gen.cue
@@ -4,6 +4,6 @@
 
 package v1
 
-GroupName :: "meta.k8s.io"
+#GroupName: "meta.k8s.io"
 
-WatchEventKind :: "WatchEvent"
+#WatchEventKind: "WatchEvent"
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/time_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/time_go_gen.cue
index 52a66e8..b3c8ec2 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/time_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/time_go_gen.cue
@@ -11,4 +11,4 @@
 // +protobuf.options.marshal=false
 // +protobuf.as=Timestamp
 // +protobuf.options.(gogoproto.goproto_stringer)=false
-Time :: _
+#Time: _
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/time_proto_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/time_proto_go_gen.cue
index 0219f06..8353927 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/time_proto_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/time_proto_go_gen.cue
@@ -7,7 +7,7 @@
 // Timestamp is a struct that is equivalent to Time, but intended for
 // protobuf marshalling/unmarshalling. It is generated into a serialization
 // that matches Time. Do not use in Go structs.
-Timestamp :: {
+#Timestamp: {
 	// Represents seconds of UTC time since Unix epoch
 	// 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
 	// 9999-12-31T23:59:59Z inclusive.
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/types_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/types_go_gen.cue
index 866ab4e..997841d 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/types_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/types_go_gen.cue
@@ -23,7 +23,7 @@
 // Structures that are versioned or persisted should inline TypeMeta.
 //
 // +k8s:deepcopy-gen=false
-TypeMeta :: {
+#TypeMeta: {
 	// Kind is a string value representing the REST resource this object represents.
 	// Servers may infer this from the endpoint the client submits requests to.
 	// Cannot be updated.
@@ -42,7 +42,7 @@
 
 // ListMeta describes metadata that synthetic resources must have, including lists and
 // various status objects. A resource may have only one of {ObjectMeta, ListMeta}.
-ListMeta :: {
+#ListMeta: {
 	// selfLink is a URL representing this object.
 	// Populated by the system.
 	// Read-only.
@@ -84,12 +84,12 @@
 	remainingItemCount?: null | int64 @go(RemainingItemCount,*int64) @protobuf(4,bytes,opt)
 }
 
-FinalizerOrphanDependents :: "orphan"
-FinalizerDeleteDependents :: "foregroundDeletion"
+#FinalizerOrphanDependents: "orphan"
+#FinalizerDeleteDependents: "foregroundDeletion"
 
 // ObjectMeta is metadata that all persisted resources must have, which includes all objects
 // users must create.
-ObjectMeta :: {
+#ObjectMeta: {
 	// Name must be unique within a namespace. Is required when creating resources, although
 	// some resources may allow a client to request the generation of an appropriate name
 	// automatically. Name is primarily intended for creation idempotence and configuration
@@ -146,7 +146,7 @@
 	// Read-only.
 	// More info: http://kubernetes.io/docs/user-guide/identifiers#uids
 	// +optional
-	uid?: types.UID @go(UID) @protobuf(5,bytes,opt,casttype=k8s.io/kubernetes/pkg/types.UID)
+	uid?: types.#UID @go(UID) @protobuf(5,bytes,opt,casttype=k8s.io/kubernetes/pkg/types.UID)
 
 	// An opaque value that represents the internal version of this object that can
 	// be used by clients to determine when objects have changed. May be used for optimistic
@@ -175,7 +175,7 @@
 	// Null for lists.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	creationTimestamp?: Time @go(CreationTimestamp) @protobuf(8,bytes,opt)
+	creationTimestamp?: #Time @go(CreationTimestamp) @protobuf(8,bytes,opt)
 
 	// DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This
 	// field is set by the server when a graceful deletion is requested by the user, and is not
@@ -196,7 +196,7 @@
 	// Read-only.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	deletionTimestamp?: null | Time @go(DeletionTimestamp,*Time) @protobuf(9,bytes,opt)
+	deletionTimestamp?: null | #Time @go(DeletionTimestamp,*Time) @protobuf(9,bytes,opt)
 
 	// Number of seconds allowed for this object to gracefully terminate before
 	// it will be removed from the system. Only set when deletionTimestamp is also set.
@@ -226,7 +226,7 @@
 	// +optional
 	// +patchMergeKey=uid
 	// +patchStrategy=merge
-	ownerReferences?: [...OwnerReference] @go(OwnerReferences,[]OwnerReference) @protobuf(13,bytes,rep)
+	ownerReferences?: [...#OwnerReference] @go(OwnerReferences,[]OwnerReference) @protobuf(13,bytes,rep)
 
 	// Must be empty before the object is deleted from the registry. Each entry
 	// is an identifier for the responsible component that will remove the entry
@@ -260,28 +260,28 @@
 	// workflow used when modifying the object.
 	//
 	// +optional
-	managedFields?: [...ManagedFieldsEntry] @go(ManagedFields,[]ManagedFieldsEntry) @protobuf(17,bytes,rep)
+	managedFields?: [...#ManagedFieldsEntry] @go(ManagedFields,[]ManagedFieldsEntry) @protobuf(17,bytes,rep)
 }
 
 // NamespaceDefault means the object is in the default namespace which is applied when not specified by clients
-NamespaceDefault :: "default"
+#NamespaceDefault: "default"
 
 // NamespaceAll is the default argument to specify on a context when you want to list or filter resources across all namespaces
-NamespaceAll :: ""
+#NamespaceAll: ""
 
 // NamespaceNone is the argument for a context when there is no namespace.
-NamespaceNone :: ""
+#NamespaceNone: ""
 
 // NamespaceSystem is the system namespace where we place system components.
-NamespaceSystem :: "kube-system"
+#NamespaceSystem: "kube-system"
 
 // NamespacePublic is the namespace where we place public info (ConfigMaps)
-NamespacePublic :: "kube-public"
+#NamespacePublic: "kube-public"
 
 // OwnerReference contains enough information to let you identify an owning
 // object. An owning object must be in the same namespace as the dependent, or
 // be cluster-scoped, so there is no namespace field.
-OwnerReference :: {
+#OwnerReference: {
 	// API version of the referent.
 	apiVersion: string @go(APIVersion) @protobuf(5,bytes,opt)
 
@@ -295,7 +295,7 @@
 
 	// UID of the referent.
 	// More info: http://kubernetes.io/docs/user-guide/identifiers#uids
-	uid: types.UID @go(UID) @protobuf(4,bytes,opt,casttype=k8s.io/apimachinery/pkg/types.UID)
+	uid: types.#UID @go(UID) @protobuf(4,bytes,opt,casttype=k8s.io/apimachinery/pkg/types.UID)
 
 	// If true, this reference points to the managing controller.
 	// +optional
@@ -312,8 +312,8 @@
 }
 
 // ListOptions is the query options to a standard REST list call.
-ListOptions :: {
-	TypeMeta
+#ListOptions: {
+	#TypeMeta
 
 	// A selector to restrict the list of returned objects by their labels.
 	// Defaults to everything.
@@ -392,8 +392,8 @@
 
 // ExportOptions is the query options to the standard REST get call.
 // Deprecated. Planned for removal in 1.18.
-ExportOptions :: {
-	TypeMeta
+#ExportOptions: {
+	#TypeMeta
 
 	// Should this value be exported.  Export strips fields that a user can not specify.
 	// Deprecated. Planned for removal in 1.18.
@@ -405,8 +405,8 @@
 }
 
 // GetOptions is the standard query options to the standard REST get call.
-GetOptions :: {
-	TypeMeta
+#GetOptions: {
+	#TypeMeta
 
 	// When specified:
 	// - if unset, then the result is returned from remote storage based on quorum-read flag;
@@ -417,34 +417,34 @@
 
 // DeletionPropagation decides if a deletion will propagate to the dependents of
 // the object, and how the garbage collector will handle the propagation.
-DeletionPropagation :: string // enumDeletionPropagation
+#DeletionPropagation: string // #enumDeletionPropagation
 
-enumDeletionPropagation ::
-	DeletePropagationOrphan |
-	DeletePropagationBackground |
-	DeletePropagationForeground
+#enumDeletionPropagation:
+	#DeletePropagationOrphan |
+	#DeletePropagationBackground |
+	#DeletePropagationForeground
 
 // Orphans the dependents.
-DeletePropagationOrphan :: DeletionPropagation & "Orphan"
+#DeletePropagationOrphan: #DeletionPropagation & "Orphan"
 
 // Deletes the object from the key-value store, the garbage collector will
 // delete the dependents in the background.
-DeletePropagationBackground :: DeletionPropagation & "Background"
+#DeletePropagationBackground: #DeletionPropagation & "Background"
 
 // The object exists in the key-value store until the garbage collector
 // deletes all the dependents whose ownerReference.blockOwnerDeletion=true
 // from the key-value store.  API sever will put the "foregroundDeletion"
 // finalizer on the object, and sets its deletionTimestamp.  This policy is
 // cascading, i.e., the dependents will be deleted with Foreground.
-DeletePropagationForeground :: DeletionPropagation & "Foreground"
+#DeletePropagationForeground: #DeletionPropagation & "Foreground"
 
 // DryRunAll means to complete all processing stages, but don't
 // persist changes to storage.
-DryRunAll :: "All"
+#DryRunAll: "All"
 
 // DeleteOptions may be provided when deleting an API object.
-DeleteOptions :: {
-	TypeMeta
+#DeleteOptions: {
+	#TypeMeta
 
 	// The duration in seconds before the object should be deleted. Value must be non-negative integer.
 	// The value zero indicates delete immediately. If this value is nil, the default grace period for the
@@ -457,7 +457,7 @@
 	// returned.
 	// +k8s:conversion-gen=false
 	// +optional
-	preconditions?: null | Preconditions @go(Preconditions,*Preconditions) @protobuf(2,bytes,opt)
+	preconditions?: null | #Preconditions @go(Preconditions,*Preconditions) @protobuf(2,bytes,opt)
 
 	// Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7.
 	// Should the dependent objects be orphaned. If true/false, the "orphan"
@@ -475,7 +475,7 @@
 	// 'Foreground' - a cascading policy that deletes all dependents in the
 	// foreground.
 	// +optional
-	propagationPolicy?: null | DeletionPropagation @go(PropagationPolicy,*DeletionPropagation) @protobuf(4,varint,opt)
+	propagationPolicy?: null | #DeletionPropagation @go(PropagationPolicy,*DeletionPropagation) @protobuf(4,varint,opt)
 
 	// When present, indicates that modifications should not be
 	// persisted. An invalid or unrecognized dryRun directive will
@@ -487,8 +487,8 @@
 }
 
 // CreateOptions may be provided when creating an API object.
-CreateOptions :: {
-	TypeMeta
+#CreateOptions: {
+	#TypeMeta
 
 	// When present, indicates that modifications should not be
 	// persisted. An invalid or unrecognized dryRun directive will
@@ -508,8 +508,8 @@
 
 // PatchOptions may be provided when patching an API object.
 // PatchOptions is meant to be a superset of UpdateOptions.
-PatchOptions :: {
-	TypeMeta
+#PatchOptions: {
+	#TypeMeta
 
 	// When present, indicates that modifications should not be
 	// persisted. An invalid or unrecognized dryRun directive will
@@ -538,8 +538,8 @@
 
 // UpdateOptions may be provided when updating an API object.
 // All fields in UpdateOptions should also be present in PatchOptions.
-UpdateOptions :: {
-	TypeMeta
+#UpdateOptions: {
+	#TypeMeta
 
 	// When present, indicates that modifications should not be
 	// persisted. An invalid or unrecognized dryRun directive will
@@ -558,10 +558,10 @@
 }
 
 // Preconditions must be fulfilled before an operation (update, delete, etc.) is carried out.
-Preconditions :: {
+#Preconditions: {
 	// Specifies the target UID.
 	// +optional
-	uid?: null | types.UID @go(UID,*types.UID) @protobuf(1,bytes,opt,casttype=k8s.io/apimachinery/pkg/types.UID)
+	uid?: null | types.#UID @go(UID,*types.UID) @protobuf(1,bytes,opt,casttype=k8s.io/apimachinery/pkg/types.UID)
 
 	// Specifies the target ResourceVersion
 	// +optional
@@ -569,13 +569,13 @@
 }
 
 // Status is a return value for calls that don't return other objects.
-Status :: {
-	TypeMeta
+#Status: {
+	#TypeMeta
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
-	metadata?: ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: #ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// Status of the operation.
 	// One of: "Success" or "Failure".
@@ -592,14 +592,14 @@
 	// is no information available. A Reason clarifies an HTTP status
 	// code but does not override it.
 	// +optional
-	reason?: StatusReason @go(Reason) @protobuf(4,bytes,opt,casttype=StatusReason)
+	reason?: #StatusReason @go(Reason) @protobuf(4,bytes,opt,casttype=StatusReason)
 
 	// Extended data associated with the reason.  Each reason may define its
 	// own extended details. This field is optional and the data returned
 	// is not guaranteed to conform to any schema except that defined by
 	// the reason type.
 	// +optional
-	details?: null | StatusDetails @go(Details,*StatusDetails) @protobuf(5,bytes,opt)
+	details?: null | #StatusDetails @go(Details,*StatusDetails) @protobuf(5,bytes,opt)
 
 	// Suggested HTTP return code for this status, 0 if not set.
 	// +optional
@@ -612,7 +612,7 @@
 // must ignore fields that do not match the defined type of each attribute,
 // and should assume that any attribute may be empty, invalid, or under
 // defined.
-StatusDetails :: {
+#StatusDetails: {
 	// The name attribute of the resource associated with the status StatusReason
 	// (when there is a single name which can be described).
 	// +optional
@@ -632,12 +632,12 @@
 	// (when there is a single resource which can be described).
 	// More info: http://kubernetes.io/docs/user-guide/identifiers#uids
 	// +optional
-	uid?: types.UID @go(UID) @protobuf(6,bytes,opt,casttype=k8s.io/apimachinery/pkg/types.UID)
+	uid?: types.#UID @go(UID) @protobuf(6,bytes,opt,casttype=k8s.io/apimachinery/pkg/types.UID)
 
 	// The Causes array includes more details associated with the StatusReason
 	// failure. Not all StatusReasons may provide detailed causes.
 	// +optional
-	causes?: [...StatusCause] @go(Causes,[]StatusCause) @protobuf(4,bytes,rep)
+	causes?: [...#StatusCause] @go(Causes,[]StatusCause) @protobuf(4,bytes,rep)
 
 	// If specified, the time in seconds before the operation should be retried. Some errors may indicate
 	// the client must take an alternate action - for those errors this field may indicate how long to wait
@@ -646,47 +646,47 @@
 	retryAfterSeconds?: int32 @go(RetryAfterSeconds) @protobuf(5,varint,opt)
 }
 
-StatusSuccess :: "Success"
-StatusFailure :: "Failure"
+#StatusSuccess: "Success"
+#StatusFailure: "Failure"
 
 // StatusReason is an enumeration of possible failure causes.  Each StatusReason
 // must map to a single HTTP status code, but multiple reasons may map
 // to the same HTTP status code.
 // TODO: move to apiserver
-StatusReason :: string // enumStatusReason
+#StatusReason: string // #enumStatusReason
 
-enumStatusReason ::
-	StatusReasonUnknown |
-	StatusReasonUnauthorized |
-	StatusReasonForbidden |
-	StatusReasonNotFound |
-	StatusReasonAlreadyExists |
-	StatusReasonConflict |
-	StatusReasonGone |
-	StatusReasonInvalid |
-	StatusReasonServerTimeout |
-	StatusReasonTimeout |
-	StatusReasonTooManyRequests |
-	StatusReasonBadRequest |
-	StatusReasonMethodNotAllowed |
-	StatusReasonNotAcceptable |
-	StatusReasonRequestEntityTooLarge |
-	StatusReasonUnsupportedMediaType |
-	StatusReasonInternalError |
-	StatusReasonExpired |
-	StatusReasonServiceUnavailable
+#enumStatusReason:
+	#StatusReasonUnknown |
+	#StatusReasonUnauthorized |
+	#StatusReasonForbidden |
+	#StatusReasonNotFound |
+	#StatusReasonAlreadyExists |
+	#StatusReasonConflict |
+	#StatusReasonGone |
+	#StatusReasonInvalid |
+	#StatusReasonServerTimeout |
+	#StatusReasonTimeout |
+	#StatusReasonTooManyRequests |
+	#StatusReasonBadRequest |
+	#StatusReasonMethodNotAllowed |
+	#StatusReasonNotAcceptable |
+	#StatusReasonRequestEntityTooLarge |
+	#StatusReasonUnsupportedMediaType |
+	#StatusReasonInternalError |
+	#StatusReasonExpired |
+	#StatusReasonServiceUnavailable
 
 // StatusReasonUnknown means the server has declined to indicate a specific reason.
 // The details field may contain other information about this error.
 // Status code 500.
-StatusReasonUnknown :: StatusReason & ""
+#StatusReasonUnknown: #StatusReason & ""
 
 // StatusReasonUnauthorized means the server can be reached and understood the request, but requires
 // the user to present appropriate authorization credentials (identified by the WWW-Authenticate header)
 // in order for the action to be completed. If the user has specified credentials on the request, the
 // server considers them insufficient.
 // Status code 401
-StatusReasonUnauthorized :: StatusReason & "Unauthorized"
+#StatusReasonUnauthorized: #StatusReason & "Unauthorized"
 
 // StatusReasonForbidden means the server can be reached and understood the request, but refuses
 // to take any further action.  It is the result of the server being configured to deny access for some reason
@@ -697,7 +697,7 @@
 //                   resource.
 //   "id"   string - the identifier of the forbidden resource
 // Status code 403
-StatusReasonForbidden :: StatusReason & "Forbidden"
+#StatusReasonForbidden: #StatusReason & "Forbidden"
 
 // StatusReasonNotFound means one or more resources required for this operation
 // could not be found.
@@ -707,26 +707,26 @@
 //                   resource.
 //   "id"   string - the identifier of the missing resource
 // Status code 404
-StatusReasonNotFound :: StatusReason & "NotFound"
+#StatusReasonNotFound: #StatusReason & "NotFound"
 
 // StatusReasonAlreadyExists means the resource you are creating already exists.
 // Details (optional):
 //   "kind" string - the kind attribute of the conflicting resource
 //   "id"   string - the identifier of the conflicting resource
 // Status code 409
-StatusReasonAlreadyExists :: StatusReason & "AlreadyExists"
+#StatusReasonAlreadyExists: #StatusReason & "AlreadyExists"
 
 // StatusReasonConflict means the requested operation cannot be completed
 // due to a conflict in the operation. The client may need to alter the
 // request. Each resource may define custom details that indicate the
 // nature of the conflict.
 // Status code 409
-StatusReasonConflict :: StatusReason & "Conflict"
+#StatusReasonConflict: #StatusReason & "Conflict"
 
 // StatusReasonGone means the item is no longer available at the server and no
 // forwarding address is known.
 // Status code 410
-StatusReasonGone :: StatusReason & "Gone"
+#StatusReasonGone: #StatusReason & "Gone"
 
 // StatusReasonInvalid means the requested create or update operation cannot be
 // completed due to invalid data provided as part of the request. The client may
@@ -739,7 +739,7 @@
 //                   provided resource that was invalid.  The code, message, and
 //                   field attributes will be set.
 // Status code 422
-StatusReasonInvalid :: StatusReason & "Invalid"
+#StatusReasonInvalid: #StatusReason & "Invalid"
 
 // StatusReasonServerTimeout means the server can be reached and understood the request,
 // but cannot complete the action in a reasonable time. The client should retry the request.
@@ -751,7 +751,7 @@
 //   "id"   string - the operation that is being attempted.
 //   "retryAfterSeconds" int32 - the number of seconds before the operation should be retried
 // Status code 500
-StatusReasonServerTimeout :: StatusReason & "ServerTimeout"
+#StatusReasonServerTimeout: #StatusReason & "ServerTimeout"
 
 // StatusReasonTimeout means that the request could not be completed within the given time.
 // Clients can get this response only when they specified a timeout param in the request,
@@ -761,7 +761,7 @@
 // Details (optional):
 //   "retryAfterSeconds" int32 - the number of seconds before the operation should be retried
 // Status code 504
-StatusReasonTimeout :: StatusReason & "Timeout"
+#StatusReasonTimeout: #StatusReason & "Timeout"
 
 // StatusReasonTooManyRequests means the server experienced too many requests within a
 // given window and that the client must wait to perform the action again. A client may
@@ -770,63 +770,63 @@
 // Details (optional):
 //   "retryAfterSeconds" int32 - the number of seconds before the operation should be retried
 // Status code 429
-StatusReasonTooManyRequests :: StatusReason & "TooManyRequests"
+#StatusReasonTooManyRequests: #StatusReason & "TooManyRequests"
 
 // StatusReasonBadRequest means that the request itself was invalid, because the request
 // doesn't make any sense, for example deleting a read-only object.  This is different than
 // StatusReasonInvalid above which indicates that the API call could possibly succeed, but the
 // data was invalid.  API calls that return BadRequest can never succeed.
 // Status code 400
-StatusReasonBadRequest :: StatusReason & "BadRequest"
+#StatusReasonBadRequest: #StatusReason & "BadRequest"
 
 // StatusReasonMethodNotAllowed means that the action the client attempted to perform on the
 // resource was not supported by the code - for instance, attempting to delete a resource that
 // can only be created. API calls that return MethodNotAllowed can never succeed.
 // Status code 405
-StatusReasonMethodNotAllowed :: StatusReason & "MethodNotAllowed"
+#StatusReasonMethodNotAllowed: #StatusReason & "MethodNotAllowed"
 
 // StatusReasonNotAcceptable means that the accept types indicated by the client were not acceptable
 // to the server - for instance, attempting to receive protobuf for a resource that supports only json and yaml.
 // API calls that return NotAcceptable can never succeed.
 // Status code 406
-StatusReasonNotAcceptable :: StatusReason & "NotAcceptable"
+#StatusReasonNotAcceptable: #StatusReason & "NotAcceptable"
 
 // StatusReasonRequestEntityTooLarge means that the request entity is too large.
 // Status code 413
-StatusReasonRequestEntityTooLarge :: StatusReason & "RequestEntityTooLarge"
+#StatusReasonRequestEntityTooLarge: #StatusReason & "RequestEntityTooLarge"
 
 // StatusReasonUnsupportedMediaType means that the content type sent by the client is not acceptable
 // to the server - for instance, attempting to send protobuf for a resource that supports only json and yaml.
 // API calls that return UnsupportedMediaType can never succeed.
 // Status code 415
-StatusReasonUnsupportedMediaType :: StatusReason & "UnsupportedMediaType"
+#StatusReasonUnsupportedMediaType: #StatusReason & "UnsupportedMediaType"
 
 // StatusReasonInternalError indicates that an internal error occurred, it is unexpected
 // and the outcome of the call is unknown.
 // Details (optional):
 //   "causes" - The original error
 // Status code 500
-StatusReasonInternalError :: StatusReason & "InternalError"
+#StatusReasonInternalError: #StatusReason & "InternalError"
 
 // StatusReasonExpired indicates that the request is invalid because the content you are requesting
 // has expired and is no longer available. It is typically associated with watches that can't be
 // serviced.
 // Status code 410 (gone)
-StatusReasonExpired :: StatusReason & "Expired"
+#StatusReasonExpired: #StatusReason & "Expired"
 
 // StatusReasonServiceUnavailable means that the request itself was valid,
 // but the requested service is unavailable at this time.
 // Retrying the request after some time might succeed.
 // Status code 503
-StatusReasonServiceUnavailable :: StatusReason & "ServiceUnavailable"
+#StatusReasonServiceUnavailable: #StatusReason & "ServiceUnavailable"
 
 // StatusCause provides more information about an api.Status failure, including
 // cases when multiple errors are encountered.
-StatusCause :: {
+#StatusCause: {
 	// A machine-readable description of the cause of the error. If this value is
 	// empty there is no information available.
 	// +optional
-	reason?: CauseType @go(Type) @protobuf(1,bytes,opt,casttype=CauseType)
+	reason?: #CauseType @go(Type) @protobuf(1,bytes,opt,casttype=CauseType)
 
 	// A human-readable description of the cause of the error.  This field may be
 	// presented as-is to a reader.
@@ -849,57 +849,57 @@
 // CauseType is a machine readable value providing more detail about what
 // occurred in a status response. An operation may have multiple causes for a
 // status (whether Failure or Success).
-CauseType :: string // enumCauseType
+#CauseType: string // #enumCauseType
 
-enumCauseType ::
-	CauseTypeFieldValueNotFound |
-	CauseTypeFieldValueRequired |
-	CauseTypeFieldValueDuplicate |
-	CauseTypeFieldValueInvalid |
-	CauseTypeFieldValueNotSupported |
-	CauseTypeUnexpectedServerResponse |
-	CauseTypeFieldManagerConflict
+#enumCauseType:
+	#CauseTypeFieldValueNotFound |
+	#CauseTypeFieldValueRequired |
+	#CauseTypeFieldValueDuplicate |
+	#CauseTypeFieldValueInvalid |
+	#CauseTypeFieldValueNotSupported |
+	#CauseTypeUnexpectedServerResponse |
+	#CauseTypeFieldManagerConflict
 
 // CauseTypeFieldValueNotFound is used to report failure to find a requested value
 // (e.g. looking up an ID).
-CauseTypeFieldValueNotFound :: CauseType & "FieldValueNotFound"
+#CauseTypeFieldValueNotFound: #CauseType & "FieldValueNotFound"
 
 // CauseTypeFieldValueRequired is used to report required values that are not
 // provided (e.g. empty strings, null values, or empty arrays).
-CauseTypeFieldValueRequired :: CauseType & "FieldValueRequired"
+#CauseTypeFieldValueRequired: #CauseType & "FieldValueRequired"
 
 // CauseTypeFieldValueDuplicate is used to report collisions of values that must be
 // unique (e.g. unique IDs).
-CauseTypeFieldValueDuplicate :: CauseType & "FieldValueDuplicate"
+#CauseTypeFieldValueDuplicate: #CauseType & "FieldValueDuplicate"
 
 // CauseTypeFieldValueInvalid is used to report malformed values (e.g. failed regex
 // match).
-CauseTypeFieldValueInvalid :: CauseType & "FieldValueInvalid"
+#CauseTypeFieldValueInvalid: #CauseType & "FieldValueInvalid"
 
 // CauseTypeFieldValueNotSupported is used to report valid (as per formatting rules)
 // values that can not be handled (e.g. an enumerated string).
-CauseTypeFieldValueNotSupported :: CauseType & "FieldValueNotSupported"
+#CauseTypeFieldValueNotSupported: #CauseType & "FieldValueNotSupported"
 
 // CauseTypeUnexpectedServerResponse is used to report when the server responded to the client
 // without the expected return type. The presence of this cause indicates the error may be
 // due to an intervening proxy or the server software malfunctioning.
-CauseTypeUnexpectedServerResponse :: CauseType & "UnexpectedServerResponse"
+#CauseTypeUnexpectedServerResponse: #CauseType & "UnexpectedServerResponse"
 
 // FieldManagerConflict is used to report when another client claims to manage this field,
 // It should only be returned for a request using server-side apply.
-CauseTypeFieldManagerConflict :: CauseType & "FieldManagerConflict"
+#CauseTypeFieldManagerConflict: #CauseType & "FieldManagerConflict"
 
 // List holds a list of objects, which may not be known by the server.
-List :: {
-	TypeMeta
+#List: {
+	#TypeMeta
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
-	metadata?: ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: #ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// List of objects
-	items: [...runtime.RawExtension] @go(Items,[]runtime.RawExtension) @protobuf(2,bytes,rep)
+	items: [...runtime.#RawExtension] @go(Items,[]runtime.RawExtension) @protobuf(2,bytes,rep)
 }
 
 // APIVersions lists the versions that are available, to allow clients to
@@ -907,8 +907,8 @@
 //
 // +protobuf.options.(gogoproto.goproto_stringer)=false
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-APIVersions :: {
-	TypeMeta
+#APIVersions: {
+	#TypeMeta
 
 	// versions are the api versions that are available.
 	versions: [...string] @go(Versions,[]string) @protobuf(1,bytes,rep)
@@ -920,33 +920,33 @@
 	// The server returns only those CIDRs that it thinks that the client can match.
 	// For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP.
 	// Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.
-	serverAddressByClientCIDRs: [...ServerAddressByClientCIDR] @go(ServerAddressByClientCIDRs,[]ServerAddressByClientCIDR) @protobuf(2,bytes,rep)
+	serverAddressByClientCIDRs: [...#ServerAddressByClientCIDR] @go(ServerAddressByClientCIDRs,[]ServerAddressByClientCIDR) @protobuf(2,bytes,rep)
 }
 
 // APIGroupList is a list of APIGroup, to allow clients to discover the API at
 // /apis.
-APIGroupList :: {
-	TypeMeta
+#APIGroupList: {
+	#TypeMeta
 
 	// groups is a list of APIGroup.
-	groups: [...APIGroup] @go(Groups,[]APIGroup) @protobuf(1,bytes,rep)
+	groups: [...#APIGroup] @go(Groups,[]APIGroup) @protobuf(1,bytes,rep)
 }
 
 // APIGroup contains the name, the supported versions, and the preferred version
 // of a group.
-APIGroup :: {
-	TypeMeta
+#APIGroup: {
+	#TypeMeta
 
 	// name is the name of the group.
 	name: string @go(Name) @protobuf(1,bytes,opt)
 
 	// versions are the versions supported in this group.
-	versions: [...GroupVersionForDiscovery] @go(Versions,[]GroupVersionForDiscovery) @protobuf(2,bytes,rep)
+	versions: [...#GroupVersionForDiscovery] @go(Versions,[]GroupVersionForDiscovery) @protobuf(2,bytes,rep)
 
 	// preferredVersion is the version preferred by the API server, which
 	// probably is the storage version.
 	// +optional
-	preferredVersion?: GroupVersionForDiscovery @go(PreferredVersion) @protobuf(3,bytes,opt)
+	preferredVersion?: #GroupVersionForDiscovery @go(PreferredVersion) @protobuf(3,bytes,opt)
 
 	// a map of client CIDR to server address that is serving this group.
 	// This is to help clients reach servers in the most network-efficient way possible.
@@ -956,11 +956,11 @@
 	// For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP.
 	// Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.
 	// +optional
-	serverAddressByClientCIDRs?: [...ServerAddressByClientCIDR] @go(ServerAddressByClientCIDRs,[]ServerAddressByClientCIDR) @protobuf(4,bytes,rep)
+	serverAddressByClientCIDRs?: [...#ServerAddressByClientCIDR] @go(ServerAddressByClientCIDRs,[]ServerAddressByClientCIDR) @protobuf(4,bytes,rep)
 }
 
 // ServerAddressByClientCIDR helps the client to determine the server address that they should use, depending on the clientCIDR that they match.
-ServerAddressByClientCIDR :: {
+#ServerAddressByClientCIDR: {
 	// The CIDR with which clients can match their IP to figure out the server address that they should use.
 	clientCIDR: string @go(ClientCIDR) @protobuf(1,bytes,opt)
 
@@ -971,7 +971,7 @@
 
 // GroupVersion contains the "group/version" and "version" string of a version.
 // It is made a struct to keep extensibility.
-GroupVersionForDiscovery :: {
+#GroupVersionForDiscovery: {
 	// groupVersion specifies the API group and version in the form "group/version"
 	groupVersion: string @go(GroupVersion) @protobuf(1,bytes,opt)
 
@@ -981,7 +981,7 @@
 }
 
 // APIResource specifies the name of a resource and whether it is namespaced.
-APIResource :: {
+#APIResource: {
 	// name is the plural name of the resource.
 	name: string @go(Name) @protobuf(1,bytes,opt)
 
@@ -1006,7 +1006,7 @@
 
 	// verbs is a list of supported kube verbs (this includes get, list, watch, create,
 	// update, patch, delete, deletecollection, and proxy)
-	verbs: Verbs @go(Verbs) @protobuf(4,bytes,opt)
+	verbs: #Verbs @go(Verbs) @protobuf(4,bytes,opt)
 
 	// shortNames is a list of suggested short names of the resource.
 	shortNames?: [...string] @go(ShortNames,[]string) @protobuf(5,bytes,rep)
@@ -1029,36 +1029,36 @@
 //
 // +protobuf.nullable=true
 // +protobuf.options.(gogoproto.goproto_stringer)=false
-Verbs :: [...string]
+#Verbs: [...string]
 
 // APIResourceList is a list of APIResource, it is used to expose the name of the
 // resources supported in a specific group and version, and if the resource
 // is namespaced.
-APIResourceList :: {
-	TypeMeta
+#APIResourceList: {
+	#TypeMeta
 
 	// groupVersion is the group and version this APIResourceList is for.
 	groupVersion: string @go(GroupVersion) @protobuf(1,bytes,opt)
 
 	// resources contains the name of the resources and if they are namespaced.
-	resources: [...APIResource] @go(APIResources,[]APIResource) @protobuf(2,bytes,rep)
+	resources: [...#APIResource] @go(APIResources,[]APIResource) @protobuf(2,bytes,rep)
 }
 
 // RootPaths lists the paths available at root.
 // For example: "/healthz", "/apis".
-RootPaths :: {
+#RootPaths: {
 	// paths are the paths available at root.
 	paths: [...string] @go(Paths,[]string) @protobuf(1,bytes,rep)
 }
 
 // Patch is provided to give a concrete name and type to the Kubernetes PATCH request body.
-Patch :: {
+#Patch: {
 }
 
 // A label selector is a label query over a set of resources. The result of matchLabels and
 // matchExpressions are ANDed. An empty label selector matches all objects. A null
 // label selector matches no objects.
-LabelSelector :: {
+#LabelSelector: {
 	// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
 	// map is equivalent to an element of matchExpressions, whose key field is "key", the
 	// operator is "In", and the values array contains only "value". The requirements are ANDed.
@@ -1067,12 +1067,12 @@
 
 	// matchExpressions is a list of label selector requirements. The requirements are ANDed.
 	// +optional
-	matchExpressions?: [...LabelSelectorRequirement] @go(MatchExpressions,[]LabelSelectorRequirement) @protobuf(2,bytes,rep)
+	matchExpressions?: [...#LabelSelectorRequirement] @go(MatchExpressions,[]LabelSelectorRequirement) @protobuf(2,bytes,rep)
 }
 
 // A label selector requirement is a selector that contains values, a key, and an operator that
 // relates the key and values.
-LabelSelectorRequirement :: {
+#LabelSelectorRequirement: {
 	// key is the label key that the selector applies to.
 	// +patchMergeKey=key
 	// +patchStrategy=merge
@@ -1080,7 +1080,7 @@
 
 	// operator represents a key's relationship to a set of values.
 	// Valid operators are In, NotIn, Exists and DoesNotExist.
-	operator: LabelSelectorOperator @go(Operator) @protobuf(2,bytes,opt,casttype=LabelSelectorOperator)
+	operator: #LabelSelectorOperator @go(Operator) @protobuf(2,bytes,opt,casttype=LabelSelectorOperator)
 
 	// values is an array of string values. If the operator is In or NotIn,
 	// the values array must be non-empty. If the operator is Exists or DoesNotExist,
@@ -1091,28 +1091,28 @@
 }
 
 // A label selector operator is the set of operators that can be used in a selector requirement.
-LabelSelectorOperator :: string // enumLabelSelectorOperator
+#LabelSelectorOperator: string // #enumLabelSelectorOperator
 
-enumLabelSelectorOperator ::
-	LabelSelectorOpIn |
-	LabelSelectorOpNotIn |
-	LabelSelectorOpExists |
-	LabelSelectorOpDoesNotExist
+#enumLabelSelectorOperator:
+	#LabelSelectorOpIn |
+	#LabelSelectorOpNotIn |
+	#LabelSelectorOpExists |
+	#LabelSelectorOpDoesNotExist
 
-LabelSelectorOpIn ::           LabelSelectorOperator & "In"
-LabelSelectorOpNotIn ::        LabelSelectorOperator & "NotIn"
-LabelSelectorOpExists ::       LabelSelectorOperator & "Exists"
-LabelSelectorOpDoesNotExist :: LabelSelectorOperator & "DoesNotExist"
+#LabelSelectorOpIn:           #LabelSelectorOperator & "In"
+#LabelSelectorOpNotIn:        #LabelSelectorOperator & "NotIn"
+#LabelSelectorOpExists:       #LabelSelectorOperator & "Exists"
+#LabelSelectorOpDoesNotExist: #LabelSelectorOperator & "DoesNotExist"
 
 // ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource
 // that the fieldset applies to.
-ManagedFieldsEntry :: {
+#ManagedFieldsEntry: {
 	// Manager is an identifier of the workflow managing these fields.
 	manager?: string @go(Manager) @protobuf(1,bytes,opt)
 
 	// Operation is the type of operation which lead to this ManagedFieldsEntry being created.
 	// The only valid values for this field are 'Apply' and 'Update'.
-	operation?: ManagedFieldsOperationType @go(Operation) @protobuf(2,bytes,opt,casttype=ManagedFieldsOperationType)
+	operation?: #ManagedFieldsOperationType @go(Operation) @protobuf(2,bytes,opt,casttype=ManagedFieldsOperationType)
 
 	// APIVersion defines the version of this resource that this field set
 	// applies to. The format is "group/version" just like the top-level
@@ -1122,7 +1122,7 @@
 
 	// Time is timestamp of when these fields were set. It should always be empty if Operation is 'Apply'
 	// +optional
-	time?: null | Time @go(Time,*Time) @protobuf(4,bytes,opt)
+	time?: null | #Time @go(Time,*Time) @protobuf(4,bytes,opt)
 
 	// FieldsType is the discriminator for the different fields format and version.
 	// There is currently only one possible value: "FieldsV1"
@@ -1130,18 +1130,18 @@
 
 	// FieldsV1 holds the first JSON version format as described in the "FieldsV1" type.
 	// +optional
-	fieldsV1?: null | FieldsV1 @go(FieldsV1,*FieldsV1) @protobuf(7,bytes,opt)
+	fieldsV1?: null | #FieldsV1 @go(FieldsV1,*FieldsV1) @protobuf(7,bytes,opt)
 }
 
 // ManagedFieldsOperationType is the type of operation which lead to a ManagedFieldsEntry being created.
-ManagedFieldsOperationType :: string // enumManagedFieldsOperationType
+#ManagedFieldsOperationType: string // #enumManagedFieldsOperationType
 
-enumManagedFieldsOperationType ::
-	ManagedFieldsOperationApply |
-	ManagedFieldsOperationUpdate
+#enumManagedFieldsOperationType:
+	#ManagedFieldsOperationApply |
+	#ManagedFieldsOperationUpdate
 
-ManagedFieldsOperationApply ::  ManagedFieldsOperationType & "Apply"
-ManagedFieldsOperationUpdate :: ManagedFieldsOperationType & "Update"
+#ManagedFieldsOperationApply:  #ManagedFieldsOperationType & "Apply"
+#ManagedFieldsOperationUpdate: #ManagedFieldsOperationType & "Update"
 
 // FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.
 //
@@ -1154,31 +1154,31 @@
 // If a key maps to an empty Fields value, the field that key represents is part of the set.
 //
 // The exact format is defined in sigs.k8s.io/structured-merge-diff
-FieldsV1 :: _
+#FieldsV1: _
 
 // Table is a tabular representation of a set of API resources. The server transforms the
 // object into a set of preferred columns for quickly reviewing the objects.
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +protobuf=false
-Table :: {
-	TypeMeta
+#Table: {
+	#TypeMeta
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
-	metadata?: ListMeta @go(ListMeta)
+	metadata?: #ListMeta @go(ListMeta)
 
 	// columnDefinitions describes each column in the returned items array. The number of cells per row
 	// will always match the number of column definitions.
-	columnDefinitions: [...TableColumnDefinition] @go(ColumnDefinitions,[]TableColumnDefinition)
+	columnDefinitions: [...#TableColumnDefinition] @go(ColumnDefinitions,[]TableColumnDefinition)
 
 	// rows is the list of items in the table.
-	rows: [...TableRow] @go(Rows,[]TableRow)
+	rows: [...#TableRow] @go(Rows,[]TableRow)
 }
 
 // TableColumnDefinition contains information about a column returned in the Table.
 // +protobuf=false
-TableColumnDefinition :: {
+#TableColumnDefinition: {
 	// name is a human readable name for the column.
 	name: string @go(Name)
 
@@ -1205,7 +1205,7 @@
 
 // TableRow is an individual row in a table.
 // +protobuf=false
-TableRow :: {
+#TableRow: {
 	// cells will be as wide as the column definitions array and may contain strings, numbers (float64 or
 	// int64), booleans, simple maps, lists, or null. See the type field of the column definition for a
 	// more detailed description.
@@ -1216,7 +1216,7 @@
 	// condition type is 'Completed', for a row that indicates a resource that has run to completion and
 	// can be given less visual priority.
 	// +optional
-	conditions?: [...TableRowCondition] @go(Conditions,[]TableRowCondition)
+	conditions?: [...#TableRowCondition] @go(Conditions,[]TableRowCondition)
 
 	// This field contains the requested additional information about each object based on the includeObject
 	// policy when requesting the Table. If "None", this field is empty, if "Object" this will be the
@@ -1225,20 +1225,20 @@
 	// The media type of the object will always match the enclosing list - if this as a JSON table, these
 	// will be JSON encoded objects.
 	// +optional
-	object?: runtime.RawExtension @go(Object)
+	object?: runtime.#RawExtension @go(Object)
 }
 
 // TableRowCondition allows a row to be marked with additional information.
 // +protobuf=false
-TableRowCondition :: {
+#TableRowCondition: {
 	// Type of row condition. The only defined value is 'Completed' indicating that the
 	// object this row represents has reached a completed state and may be given less visual
 	// priority than other rows. Clients are not required to honor any conditions but should
 	// be consistent where possible about handling the conditions.
-	type: RowConditionType @go(Type)
+	type: #RowConditionType @go(Type)
 
 	// Status of the condition, one of True, False, Unknown.
-	status: ConditionStatus @go(Status)
+	status: #ConditionStatus @go(Status)
 
 	// (brief) machine readable reason for the condition's last transition.
 	// +optional
@@ -1249,78 +1249,78 @@
 	message?: string @go(Message)
 }
 
-RowConditionType :: string // enumRowConditionType
+#RowConditionType: string // #enumRowConditionType
 
-enumRowConditionType ::
-	RowCompleted
+#enumRowConditionType:
+	#RowCompleted
 
 // RowCompleted means the underlying resource has reached completion and may be given less
 // visual priority than other resources.
-RowCompleted :: RowConditionType & "Completed"
+#RowCompleted: #RowConditionType & "Completed"
 
-ConditionStatus :: string // enumConditionStatus
+#ConditionStatus: string // #enumConditionStatus
 
-enumConditionStatus ::
-	ConditionTrue |
-	ConditionFalse |
-	ConditionUnknown
+#enumConditionStatus:
+	#ConditionTrue |
+	#ConditionFalse |
+	#ConditionUnknown
 
-ConditionTrue ::    ConditionStatus & "True"
-ConditionFalse ::   ConditionStatus & "False"
-ConditionUnknown :: ConditionStatus & "Unknown"
+#ConditionTrue:    #ConditionStatus & "True"
+#ConditionFalse:   #ConditionStatus & "False"
+#ConditionUnknown: #ConditionStatus & "Unknown"
 
 // IncludeObjectPolicy controls which portion of the object is returned with a Table.
-IncludeObjectPolicy :: string // enumIncludeObjectPolicy
+#IncludeObjectPolicy: string // #enumIncludeObjectPolicy
 
-enumIncludeObjectPolicy ::
-	IncludeNone |
-	IncludeMetadata |
-	IncludeObject
+#enumIncludeObjectPolicy:
+	#IncludeNone |
+	#IncludeMetadata |
+	#IncludeObject
 
 // IncludeNone returns no object.
-IncludeNone :: IncludeObjectPolicy & "None"
+#IncludeNone: #IncludeObjectPolicy & "None"
 
 // IncludeMetadata serializes the object containing only its metadata field.
-IncludeMetadata :: IncludeObjectPolicy & "Metadata"
+#IncludeMetadata: #IncludeObjectPolicy & "Metadata"
 
 // IncludeObject contains the full object.
-IncludeObject :: IncludeObjectPolicy & "Object"
+#IncludeObject: #IncludeObjectPolicy & "Object"
 
 // TableOptions are used when a Table is requested by the caller.
 // +k8s:conversion-gen:explicit-from=net/url.Values
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-TableOptions :: {
-	TypeMeta
+#TableOptions: {
+	#TypeMeta
 
 	// includeObject decides whether to include each object along with its columnar information.
 	// Specifying "None" will return no object, specifying "Object" will return the full object contents, and
 	// specifying "Metadata" (the default) will return the object's metadata in the PartialObjectMetadata kind
 	// in version v1beta1 of the meta.k8s.io API group.
-	includeObject?: IncludeObjectPolicy @go(IncludeObject) @protobuf(1,bytes,opt,casttype=IncludeObjectPolicy)
+	includeObject?: #IncludeObjectPolicy @go(IncludeObject) @protobuf(1,bytes,opt,casttype=IncludeObjectPolicy)
 }
 
 // PartialObjectMetadata is a generic representation of any object with ObjectMeta. It allows clients
 // to get access to a particular ObjectMeta schema without knowing the details of the version.
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-PartialObjectMetadata :: {
-	TypeMeta
+#PartialObjectMetadata: {
+	#TypeMeta
 
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
-	metadata?: ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
+	metadata?: #ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 }
 
 // PartialObjectMetadataList contains a list of objects containing only their metadata
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-PartialObjectMetadataList :: {
-	TypeMeta
+#PartialObjectMetadataList: {
+	#TypeMeta
 
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
-	metadata?: ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
+	metadata?: #ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 
 	// items contains each of the included items.
-	items: [...PartialObjectMetadata] @go(Items,[]PartialObjectMetadata) @protobuf(2,bytes,rep)
+	items: [...#PartialObjectMetadata] @go(Items,[]PartialObjectMetadata) @protobuf(2,bytes,rep)
 }
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/watch_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/watch_go_gen.cue
index 1874729..12f5f1b 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/watch_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/apis/meta/v1/watch_go_gen.cue
@@ -14,7 +14,7 @@
 // +protobuf=true
 // +k8s:deepcopy-gen=true
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-WatchEvent :: {
+#WatchEvent: {
 	type: string @go(Type) @protobuf(1,bytes,opt)
 
 	// Object is:
@@ -22,9 +22,9 @@
 	//  * If Type is Deleted: the state of the object immediately before deletion.
 	//  * If Type is Error: *Status is recommended; other types may make sense
 	//    depending on context.
-	object: runtime.RawExtension @go(Object) @protobuf(2,bytes,opt)
+	object: runtime.#RawExtension @go(Object) @protobuf(2,bytes,opt)
 }
 
 // InternalEvent makes watch.Event versioned
 // +protobuf=false
-InternalEvent :: watch.Event
+#InternalEvent: watch.#Event
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/codec_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/codec_go_gen.cue
index 881c325..39bbb1f 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/codec_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/codec_go_gen.cue
@@ -5,11 +5,11 @@
 package runtime
 
 // NoopEncoder converts an Decoder to a Serializer or Codec for code that expects them but only uses decoding.
-NoopEncoder :: {
-	"Decoder": Decoder
+#NoopEncoder: {
+	Decoder: #Decoder
 }
 
 // NoopDecoder converts an Encoder to a Serializer or Codec for code that expects them but only uses encoding.
-NoopDecoder :: {
-	"Encoder": Encoder
+#NoopDecoder: {
+	Encoder: #Encoder
 }
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/converter_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/converter_go_gen.cue
index 71b3fec..f49ad1e 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/converter_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/converter_go_gen.cue
@@ -6,4 +6,4 @@
 
 // UnstructuredConverter is an interface for converting between interface{}
 // and map[string]interface representation.
-UnstructuredConverter :: _
+#UnstructuredConverter: _
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/helper_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/helper_go_gen.cue
index ace575c..8d5ecee 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/helper_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/helper_go_gen.cue
@@ -5,16 +5,16 @@
 package runtime
 
 // MultiObjectTyper returns the types of objects across multiple schemes in order.
-MultiObjectTyper :: [...ObjectTyper]
+#MultiObjectTyper: [...#ObjectTyper]
 
 // WithVersionEncoder serializes an object and ensures the GVK is set.
-WithVersionEncoder :: {
-	Version:       GroupVersioner
-	"Encoder":     Encoder
-	"ObjectTyper": ObjectTyper
+#WithVersionEncoder: {
+	Version:     #GroupVersioner
+	Encoder:     #Encoder
+	ObjectTyper: #ObjectTyper
 }
 
 // WithoutVersionDecoder clears the group version kind of a deserialized object.
-WithoutVersionDecoder :: {
-	"Decoder": Decoder
+#WithoutVersionDecoder: {
+	Decoder: #Decoder
 }
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/interfaces_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/interfaces_go_gen.cue
index a673d37..f34d761 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/interfaces_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/interfaces_go_gen.cue
@@ -7,44 +7,44 @@
 // APIVersionInternal may be used if you are registering a type that should not
 // be considered stable or serialized - it is a convention only and has no
 // special behavior in this package.
-APIVersionInternal :: "__internal"
+#APIVersionInternal: "__internal"
 
 // GroupVersioner refines a set of possible conversion targets into a single option.
-GroupVersioner :: _
+#GroupVersioner: _
 
 // Identifier represents an identifier.
 // Identitier of two different objects should be equal if and only if for every
 // input the output they produce is exactly the same.
-Identifier :: string // enumIdentifier
+#Identifier: string // #enumIdentifier
 
-enumIdentifier ::
-	noopEncoderIdentifier
+#enumIdentifier:
+	_#noopEncoderIdentifier
 
 // Encoder writes objects to a serialized form
-Encoder :: _
+#Encoder: _
 
 // Decoder attempts to load an object from data.
-Decoder :: _
+#Decoder: _
 
 // Serializer is the core interface for transforming objects into a serialized format and back.
 // Implementations may choose to perform conversion of the object, but no assumptions should be made.
-Serializer :: _
+#Serializer: _
 
 // Codec is a Serializer that deals with the details of versioning objects. It offers the same
 // interface as Serializer, so this is a marker to consumers that care about the version of the objects
 // they receive.
-Codec :: Serializer
+#Codec: #Serializer
 
 // ParameterCodec defines methods for serializing and deserializing API objects to url.Values and
 // performing any necessary conversion. Unlike the normal Codec, query parameters are not self describing
 // and the desired version must be specified.
-ParameterCodec :: _
+#ParameterCodec: _
 
 // Framer is a factory for creating readers and writers that obey a particular framing pattern.
-Framer :: _
+#Framer: _
 
 // SerializerInfo contains information about a specific serialization format
-SerializerInfo :: {
+#SerializerInfo: {
 	// MediaType is the value that represents this serializer over the wire.
 	MediaType: string
 
@@ -58,90 +58,90 @@
 	EncodesAsText: bool
 
 	// Serializer is the individual object serializer for this media type.
-	"Serializer": Serializer
+	Serializer: #Serializer
 
 	// PrettySerializer, if set, can serialize this object in a form biased towards
 	// readability.
-	PrettySerializer: Serializer
+	PrettySerializer: #Serializer
 
 	// StreamSerializer, if set, describes the streaming serialization format
 	// for this media type.
-	StreamSerializer?: null | StreamSerializerInfo @go(,*StreamSerializerInfo)
+	StreamSerializer?: null | #StreamSerializerInfo @go(,*StreamSerializerInfo)
 }
 
 // StreamSerializerInfo contains information about a specific stream serialization format
-StreamSerializerInfo :: {
+#StreamSerializerInfo: {
 	// EncodesAsText indicates this serializer can be encoded to UTF-8 safely.
 	EncodesAsText: bool
 
 	// Serializer is the top level object serializer for this type when streaming
-	"Serializer": Serializer
+	Serializer: #Serializer
 
 	// Framer is the factory for retrieving streams that separate objects on the wire
-	"Framer": Framer
+	Framer: #Framer
 }
 
 // NegotiatedSerializer is an interface used for obtaining encoders, decoders, and serializers
 // for multiple supported media types. This would commonly be accepted by a server component
 // that performs HTTP content negotiation to accept multiple formats.
-NegotiatedSerializer :: _
+#NegotiatedSerializer: _
 
 // ClientNegotiator handles turning an HTTP content type into the appropriate encoder.
 // Use NewClientNegotiator or NewVersionedClientNegotiator to create this interface from
 // a NegotiatedSerializer.
-ClientNegotiator :: _
+#ClientNegotiator: _
 
 // StorageSerializer is an interface used for obtaining encoders, decoders, and serializers
 // that can read and write data at rest. This would commonly be used by client tools that must
 // read files, or server side storage interfaces that persist restful objects.
-StorageSerializer :: _
+#StorageSerializer: _
 
 // NestedObjectEncoder is an optional interface that objects may implement to be given
 // an opportunity to encode any nested Objects / RawExtensions during serialization.
-NestedObjectEncoder :: _
+#NestedObjectEncoder: _
 
 // NestedObjectDecoder is an optional interface that objects may implement to be given
 // an opportunity to decode any nested Objects / RawExtensions during serialization.
-NestedObjectDecoder :: _
+#NestedObjectDecoder: _
 
-ObjectDefaulter :: _
+#ObjectDefaulter: _
 
-ObjectVersioner :: _
+#ObjectVersioner: _
 
 // ObjectConvertor converts an object to a different version.
-ObjectConvertor :: _
+#ObjectConvertor: _
 
 // ObjectTyper contains methods for extracting the APIVersion and Kind
 // of objects.
-ObjectTyper :: _
+#ObjectTyper: _
 
 // ObjectCreater contains methods for instantiating an object by kind and version.
-ObjectCreater :: _
+#ObjectCreater: _
 
 // EquivalentResourceMapper provides information about resources that address the same underlying data as a specified resource
-EquivalentResourceMapper :: _
+#EquivalentResourceMapper: _
 
 // EquivalentResourceRegistry provides an EquivalentResourceMapper interface,
 // and allows registering known resource[/subresource] -> kind
-EquivalentResourceRegistry :: _
+#EquivalentResourceRegistry: _
 
 // ResourceVersioner provides methods for setting and retrieving
 // the resource version from an API object.
-ResourceVersioner :: _
+#ResourceVersioner: _
 
 // SelfLinker provides methods for setting and retrieving the SelfLink field of an API object.
-SelfLinker :: _
+#SelfLinker: _
 
 // Object interface must be supported by all API types registered with Scheme. Since objects in a scheme are
 // expected to be serialized to the wire, the interface an Object must provide to the Scheme allows
 // serializers to set the kind, version, and group the object is represented as. An Object may choose
 // to return a no-op ObjectKindAccessor in cases where it is not expected to be serialized.
-Object :: _
+#Object: _
 
 // CacheableObject allows an object to cache its different serializations
 // to avoid performing the same serialization multiple times.
-CacheableObject :: _
+#CacheableObject: _
 
 // Unstructured objects store values as map[string]interface{}, with only values that can be serialized
 // to JSON allowed.
-Unstructured :: _
+#Unstructured: _
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/negotiate_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/negotiate_go_gen.cue
index 50756a8..7580f46 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/negotiate_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/negotiate_go_gen.cue
@@ -6,7 +6,7 @@
 
 // NegotiateError is returned when a ClientNegotiator is unable to locate
 // a serializer for the requested operation.
-NegotiateError :: {
+#NegotiateError: {
 	ContentType: string
 	Stream:      bool
 }
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator_go_gen.cue
index 06820e8..9dfc078 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator_go_gen.cue
@@ -5,10 +5,10 @@
 package runtime
 
 // Pair of strings. We keed the name of fields and the doc
-Pair :: {
+#Pair: {
 	Name: string
 	Doc:  string
 }
 
 // KubeTypes is an array to represent all available types in a parsed file. [0] is for the type itself
-KubeTypes :: [...Pair]
+#KubeTypes: [...#Pair]
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/types_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/types_go_gen.cue
index 172de66..7a2b8e5 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/types_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/types_go_gen.cue
@@ -18,7 +18,7 @@
 // +k8s:deepcopy-gen=false
 // +protobuf=true
 // +k8s:openapi-gen=true
-TypeMeta :: {
+#TypeMeta: {
 	// +optional
 	apiVersion?: string @go(APIVersion) @protobuf(1,bytes,opt)
 
@@ -26,9 +26,9 @@
 	kind?: string @go(Kind) @protobuf(2,bytes,opt)
 }
 
-ContentTypeJSON ::     "application/json"
-ContentTypeYAML ::     "application/yaml"
-ContentTypeProtobuf :: "application/vnd.kubernetes.protobuf"
+#ContentTypeJSON:     "application/json"
+#ContentTypeYAML:     "application/yaml"
+#ContentTypeProtobuf: "application/vnd.kubernetes.protobuf"
 
 // RawExtension is used to hold extensions in external versions.
 //
@@ -75,7 +75,7 @@
 // +k8s:deepcopy-gen=true
 // +protobuf=true
 // +k8s:openapi-gen=true
-RawExtension :: _
+#RawExtension: _
 
 // Unknown allows api objects with unknown types to be passed-through. This can be used
 // to deal with the API objects from a plug-in. Unknown objects still have functioning
@@ -87,4 +87,4 @@
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +protobuf=true
 // +k8s:openapi-gen=true
-Unknown :: _
+#Unknown: _
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/types_proto_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/types_proto_go_gen.cue
index 50626df..8b8ddf8 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/types_proto_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/runtime/types_proto_go_gen.cue
@@ -4,6 +4,6 @@
 
 package runtime
 
-ProtobufMarshaller :: _
+#ProtobufMarshaller: _
 
-ProtobufReverseMarshaller :: _
+#ProtobufReverseMarshaller: _
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/types/namespacedname_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/types/namespacedname_go_gen.cue
index f308da9..7cb2745 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/types/namespacedname_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/types/namespacedname_go_gen.cue
@@ -4,9 +4,9 @@
 
 package types
 
-NamespacedName :: {
+#NamespacedName: {
 	Namespace: string
 	Name:      string
 }
 
-Separator :: 47 // '/'
+#Separator: 47 // '/'
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/types/nodename_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/types/nodename_go_gen.cue
index 5289541..c45c603 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/types/nodename_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/types/nodename_go_gen.cue
@@ -28,4 +28,4 @@
 //   For AWS, the InstanceID is not yet suitable for use as a Node.Name, so we actually use the
 //   PrivateDnsName for the Node.Name.  And this is _not_ always the same as the hostname: if
 //   we are using a custom DHCP domain it won't be.
-NodeName :: string
+#NodeName: string
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/types/patch_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/types/patch_go_gen.cue
index 76eeff8..3de5d80 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/types/patch_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/types/patch_go_gen.cue
@@ -7,15 +7,15 @@
 // Similarly to above, these are constants to support HTTP PATCH utilized by
 // both the client and server that didn't make sense for a whole package to be
 // dedicated to.
-PatchType :: string // enumPatchType
+#PatchType: string // #enumPatchType
 
-enumPatchType ::
-	JSONPatchType |
-	MergePatchType |
-	StrategicMergePatchType |
-	ApplyPatchType
+#enumPatchType:
+	#JSONPatchType |
+	#MergePatchType |
+	#StrategicMergePatchType |
+	#ApplyPatchType
 
-JSONPatchType ::           PatchType & "application/json-patch+json"
-MergePatchType ::          PatchType & "application/merge-patch+json"
-StrategicMergePatchType :: PatchType & "application/strategic-merge-patch+json"
-ApplyPatchType ::          PatchType & "application/apply-patch+yaml"
+#JSONPatchType:           #PatchType & "application/json-patch+json"
+#MergePatchType:          #PatchType & "application/merge-patch+json"
+#StrategicMergePatchType: #PatchType & "application/strategic-merge-patch+json"
+#ApplyPatchType:          #PatchType & "application/apply-patch+yaml"
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/types/uid_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/types/uid_go_gen.cue
index fbd0932..40bdd82 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/types/uid_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/types/uid_go_gen.cue
@@ -7,4 +7,4 @@
 // UID is a type that holds unique ID values, including UUIDs.  Because we
 // don't ONLY use UUIDs, this is an alias to string.  Being a type captures
 // intent and helps make sure that UIDs and names do not get conflated.
-UID :: string
+#UID: string
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/util/intstr/intstr_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/util/intstr/intstr_go_gen.cue
index 904500d..879f4d4 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/util/intstr/intstr_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/util/intstr/intstr_go_gen.cue
@@ -13,14 +13,14 @@
 // +protobuf=true
 // +protobuf.options.(gogoproto.goproto_stringer)=false
 // +k8s:openapi-gen=true
-IntOrString :: _
+#IntOrString: _
 
 // Type represents the stored type of IntOrString.
-Type :: int64 // enumType
+#Type: int64 // #enumType
 
-enumType ::
-	Int |
-	String
+#enumType:
+	#Int |
+	#String
 
-Int ::    Type & 0
-String :: Type & 1
+#Int:    #Type & 0
+#String: #Type & 1
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/filter_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/filter_go_gen.cue
index 244baae..045e8ec 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/filter_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/filter_go_gen.cue
@@ -5,6 +5,6 @@
 package watch
 
 // Recorder records all events that are sent from the watch until it is closed.
-Recorder :: {
-	"Interface": Interface
+#Recorder: {
+	Interface: #Interface
 }
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/mux_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/mux_go_gen.cue
index e37e769..46d1c89 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/mux_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/mux_go_gen.cue
@@ -6,11 +6,11 @@
 
 // FullChannelBehavior controls how the Broadcaster reacts if a watcher's watch
 // channel is full.
-FullChannelBehavior :: int // enumFullChannelBehavior
+#FullChannelBehavior: int // #enumFullChannelBehavior
 
-enumFullChannelBehavior ::
-	WaitIfChannelFull |
-	DropIfChannelFull
+#enumFullChannelBehavior:
+	#WaitIfChannelFull |
+	#DropIfChannelFull
 
-WaitIfChannelFull :: FullChannelBehavior & 0
-DropIfChannelFull :: FullChannelBehavior & 1
+#WaitIfChannelFull: #FullChannelBehavior & 0
+#DropIfChannelFull: #FullChannelBehavior & 1
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/streamwatcher_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/streamwatcher_go_gen.cue
index ac496d2..f0805cf 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/streamwatcher_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/streamwatcher_go_gen.cue
@@ -5,8 +5,8 @@
 package watch
 
 // Decoder allows StreamWatcher to watch any stream for which a Decoder can be written.
-Decoder :: _
+#Decoder: _
 
 // Reporter hides the details of how an error is turned into a runtime.Object for
 // reporting on a watch stream since this package may not import a higher level report.
-Reporter :: _
+#Reporter: _
diff --git a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/watch_go_gen.cue b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/watch_go_gen.cue
index acc7cf3..4c837a1 100644
--- a/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/watch_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/cue.mod/gen/k8s.io/apimachinery/pkg/watch/watch_go_gen.cue
@@ -7,29 +7,29 @@
 import "k8s.io/apimachinery/pkg/runtime"
 
 // Interface can be implemented by anything that knows how to watch and report changes.
-Interface :: _
+#Interface: _
 
 // EventType defines the possible types of events.
-EventType :: string // enumEventType
+#EventType: string // #enumEventType
 
-enumEventType ::
-	Added |
-	Modified |
-	Deleted |
-	Bookmark |
-	Error
+#enumEventType:
+	#Added |
+	#Modified |
+	#Deleted |
+	#Bookmark |
+	#Error
 
-Added ::           EventType & "ADDED"
-Modified ::        EventType & "MODIFIED"
-Deleted ::         EventType & "DELETED"
-Bookmark ::        EventType & "BOOKMARK"
-Error ::           EventType & "ERROR"
-DefaultChanSize :: int32 & 100
+#Added:           #EventType & "ADDED"
+#Modified:        #EventType & "MODIFIED"
+#Deleted:         #EventType & "DELETED"
+#Bookmark:        #EventType & "BOOKMARK"
+#Error:           #EventType & "ERROR"
+#DefaultChanSize: int32 & 100
 
 // Event represents a single event to a watched resource.
 // +k8s:deepcopy-gen=true
-Event :: {
-	Type: EventType
+#Event: {
+	Type: #EventType
 
 	// Object is:
 	//  * If Type is Added or Modified: the new state of the object.
@@ -40,10 +40,10 @@
 	//    nor miss any events.
 	//  * If Type is Error: *api.Status is recommended; other types may make sense
 	//    depending on context.
-	Object: runtime.Object
+	Object: runtime.#Object
 }
 
 // RaceFreeFakeWatcher lets you test anything that consumes a watch.Interface; threadsafe.
-RaceFreeFakeWatcher :: {
+#RaceFreeFakeWatcher: {
 	Stopped: bool
 }
diff --git a/doc/tutorial/kubernetes/quick/services/frontend/kube.cue b/doc/tutorial/kubernetes/quick/services/frontend/kube.cue
index 6cea719..488c771 100644
--- a/doc/tutorial/kubernetes/quick/services/frontend/kube.cue
+++ b/doc/tutorial/kubernetes/quick/services/frontend/kube.cue
@@ -1,6 +1,6 @@
 package kube
 
-Component :: "frontend"
+#Component: "frontend"
 
 deployment: [string]: spec: template: {
 	metadata: annotations: {
diff --git a/doc/tutorial/kubernetes/quick/services/infra/kube.cue b/doc/tutorial/kubernetes/quick/services/infra/kube.cue
index 3403c30..312c5b9 100644
--- a/doc/tutorial/kubernetes/quick/services/infra/kube.cue
+++ b/doc/tutorial/kubernetes/quick/services/infra/kube.cue
@@ -1,3 +1,3 @@
 package kube
 
-Component :: "infra"
+#Component: "infra"
diff --git a/doc/tutorial/kubernetes/quick/services/k8s_defs.cue b/doc/tutorial/kubernetes/quick/services/k8s_defs.cue
index c87bb23..d20358c 100644
--- a/doc/tutorial/kubernetes/quick/services/k8s_defs.cue
+++ b/doc/tutorial/kubernetes/quick/services/k8s_defs.cue
@@ -5,7 +5,7 @@
   apps_v1 "k8s.io/api/apps/v1"
 )
 
-service: [string]:     v1.Service
-deployment: [string]:  apps_v1.Deployment
-daemonSet: [string]:   apps_v1.DaemonSet
-statefulSet: [string]: apps_v1.StatefulSet
+service: [string]:     v1.#Service
+deployment: [string]:  apps_v1.#Deployment
+daemonSet: [string]:   apps_v1.#DaemonSet
+statefulSet: [string]: apps_v1.#StatefulSet
diff --git a/doc/tutorial/kubernetes/quick/services/kitchen/kube.cue b/doc/tutorial/kubernetes/quick/services/kitchen/kube.cue
index 5b77d2a..c4690b1 100644
--- a/doc/tutorial/kubernetes/quick/services/kitchen/kube.cue
+++ b/doc/tutorial/kubernetes/quick/services/kitchen/kube.cue
@@ -1,6 +1,6 @@
 package kube
 
-Component :: "kitchen"
+#Component: "kitchen"
 
 deployment: [string]: spec: template: {
 	metadata: annotations: "prometheus.io.scrape": "true"
@@ -20,10 +20,10 @@
 }
 
 deployment: [ID=_]: spec: template: spec: {
-	hasDisks :: *true | bool
+	_hasDisks: *true | bool
 
 	// field comprehension using just "if"
-	if hasDisks {
+	if _hasDisks {
 		volumes: [{
 			name: *"\(ID)-disk" | string
 			gcePersistentDisk: pdName: *"\(ID)-disk" | string
diff --git a/doc/tutorial/kubernetes/quick/services/kitchen/souschef/kube.cue b/doc/tutorial/kubernetes/quick/services/kitchen/souschef/kube.cue
index e7c178f..3d035f4 100644
--- a/doc/tutorial/kubernetes/quick/services/kitchen/souschef/kube.cue
+++ b/doc/tutorial/kubernetes/quick/services/kitchen/souschef/kube.cue
@@ -4,4 +4,4 @@
 	image: "gcr.io/myproj/souschef:v0.5.3"
 }]
 
-deployment: souschef: spec: template: spec: hasDisks :: false
+deployment: souschef: spec: template: spec: _hasDisks: false
diff --git a/doc/tutorial/kubernetes/quick/services/kube.cue b/doc/tutorial/kubernetes/quick/services/kube.cue
index fee8edb..0ffedc7 100644
--- a/doc/tutorial/kubernetes/quick/services/kube.cue
+++ b/doc/tutorial/kubernetes/quick/services/kube.cue
@@ -6,9 +6,9 @@
 	metadata: {
 		name: ID
 		labels: {
-			app:       ID        // by convention
-			domain:    "prod"    // always the same in the given files
-			component: Component // varies per directory
+			app:       ID         // by convention
+			domain:    "prod"     // always the same in the given files
+			component: #Component // varies per directory
 		}
 	}
 	spec: {
@@ -33,7 +33,7 @@
 			metadata: labels: {
 				app:       ID
 				domain:    "prod"
-				component: Component
+				component: #Component
 			}
 			// we always have one namesake container
 			spec: containers: [{name: ID}]
@@ -41,45 +41,45 @@
 	}
 }
 
-Component :: string
+#Component: string
 
 daemonSet: [ID=_]: _spec & {
 	apiVersion: "apps/v1"
 	kind:       "DaemonSet"
-	Name ::     ID
+	_name:      ID
 }
 
 statefulSet: [ID=_]: _spec & {
 	apiVersion: "apps/v1"
 	kind:       "StatefulSet"
-	Name ::     ID
+	_name:      ID
 }
 
 deployment: [ID=_]: _spec & {
 	apiVersion: "apps/v1"
 	kind:       "Deployment"
-	Name ::     ID
+	_name:      ID
 	spec: replicas: *1 | int
 }
 
 configMap: [ID=_]: {
 	metadata: name: ID
-	metadata: labels: component: Component
+	metadata: labels: component: #Component
 }
 
 _spec: {
-	Name :: string
+	_name: string
 
-	metadata: name: Name
-	metadata: labels: component: Component
+	metadata: name: _name
+	metadata: labels: component: #Component
 	spec: selector: {}
 	spec: template: {
 		metadata: labels: {
-			app:       Name
-			component: Component
+			app:       _name
+			component: #Component
 			domain:    "prod"
 		}
-		spec: containers: [{name: Name}]
+		spec: containers: [{name: _name}]
 	}
 }
 
diff --git a/doc/tutorial/kubernetes/quick/services/mon/kube.cue b/doc/tutorial/kubernetes/quick/services/mon/kube.cue
index 1db3b13..b270252 100644
--- a/doc/tutorial/kubernetes/quick/services/mon/kube.cue
+++ b/doc/tutorial/kubernetes/quick/services/mon/kube.cue
@@ -1,3 +1,3 @@
 package kube
 
-Component :: "mon"
+#Component: "mon"
diff --git a/doc/tutorial/kubernetes/quick/services/proxy/kube.cue b/doc/tutorial/kubernetes/quick/services/proxy/kube.cue
index 2c4dc2e..177d385 100644
--- a/doc/tutorial/kubernetes/quick/services/proxy/kube.cue
+++ b/doc/tutorial/kubernetes/quick/services/proxy/kube.cue
@@ -1,3 +1,3 @@
 package kube
 
-Component :: "proxy"
+#Component: "proxy"
diff --git a/doc/tutorial/kubernetes/testdata/quick.out b/doc/tutorial/kubernetes/testdata/quick.out
index a678e55..d62eb2a 100644
--- a/doc/tutorial/kubernetes/testdata/quick.out
+++ b/doc/tutorial/kubernetes/testdata/quick.out
@@ -3,9 +3,8 @@
 deployment: {}
 daemonSet: {}
 statefulSet: {}
-Component :: string
+#Component: string
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -30,15 +29,15 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {}
 deployment: {}
 daemonSet: {}
 statefulSet: {}
-Component :: "frontend"
+#Component: "frontend"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -63,6 +62,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -94,7 +94,6 @@
 }
 deployment: {
     bartender: {
-        Name ::     "bartender"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -131,13 +130,13 @@
             }
             replicas: 1
         }
+        _name: "bartender"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "frontend"
+#Component: "frontend"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -162,6 +161,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -193,7 +193,6 @@
 }
 deployment: {
     breaddispatcher: {
-        Name ::     "breaddispatcher"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -230,13 +229,13 @@
             }
             replicas: 1
         }
+        _name: "breaddispatcher"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "frontend"
+#Component: "frontend"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -261,6 +260,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -292,7 +292,6 @@
 }
 deployment: {
     host: {
-        Name ::     "host"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -329,13 +328,13 @@
             }
             replicas: 2
         }
+        _name: "host"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "frontend"
+#Component: "frontend"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -360,6 +359,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -391,7 +391,6 @@
 }
 deployment: {
     maitred: {
-        Name ::     "maitred"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -428,13 +427,13 @@
             }
             replicas: 1
         }
+        _name: "maitred"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "frontend"
+#Component: "frontend"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -459,6 +458,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -490,7 +490,6 @@
 }
 deployment: {
     valeter: {
-        Name ::     "valeter"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -527,13 +526,13 @@
             }
             replicas: 1
         }
+        _name: "valeter"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "frontend"
+#Component: "frontend"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -558,6 +557,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -589,7 +589,6 @@
 }
 deployment: {
     waiter: {
-        Name ::     "waiter"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -625,13 +624,13 @@
             }
             replicas: 5
         }
+        _name: "waiter"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "frontend"
+#Component: "frontend"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -656,6 +655,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -687,7 +687,6 @@
 }
 deployment: {
     waterdispatcher: {
-        Name ::     "waterdispatcher"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -724,13 +723,13 @@
             }
             replicas: 1
         }
+        _name: "waterdispatcher"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "frontend"
+#Component: "frontend"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -755,15 +754,15 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {}
 deployment: {}
 daemonSet: {}
 statefulSet: {}
-Component :: "infra"
+#Component: "infra"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -788,6 +787,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -819,7 +819,6 @@
 }
 deployment: {
     download: {
-        Name ::     "download"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -851,13 +850,13 @@
             }
             replicas: 1
         }
+        _name: "download"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "infra"
+#Component: "infra"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -882,6 +881,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -921,7 +921,6 @@
 daemonSet: {}
 statefulSet: {
     etcd: {
-        Name ::     "etcd"
         kind:       "StatefulSet"
         apiVersion: "apps/v1"
         metadata: {
@@ -1028,11 +1027,11 @@
             }]
             serviceName: "etcd"
         }
+        _name: "etcd"
     }
 }
-Component :: "infra"
+#Component: "infra"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -1057,6 +1056,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -1088,7 +1088,6 @@
 }
 deployment: {
     events: {
-        Name ::     "events"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -1152,13 +1151,13 @@
             }
             replicas: 2
         }
+        _name: "events"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "infra"
+#Component: "infra"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -1183,6 +1182,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -1216,7 +1216,6 @@
 }
 deployment: {
     tasks: {
-        Name ::     "tasks"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -1265,13 +1264,13 @@
             }
             replicas: 1
         }
+        _name: "tasks"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "infra"
+#Component: "infra"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -1296,6 +1295,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -1327,7 +1327,6 @@
 }
 deployment: {
     updater: {
-        Name ::     "updater"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -1370,13 +1369,13 @@
             }
             replicas: 1
         }
+        _name: "updater"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "infra"
+#Component: "infra"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -1401,6 +1400,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -1434,7 +1434,6 @@
 }
 deployment: {
     watcher: {
-        Name ::     "watcher"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -1479,13 +1478,13 @@
             }
             replicas: 1
         }
+        _name: "watcher"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "infra"
+#Component: "infra"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -1510,15 +1509,15 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {}
 deployment: {}
 daemonSet: {}
 statefulSet: {}
-Component :: "kitchen"
+#Component: "kitchen"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -1543,6 +1542,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -1574,7 +1574,6 @@
 }
 deployment: {
     caller: {
-        Name ::     "caller"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -1643,18 +1642,18 @@
                             }
                         }
                     }]
-                    hasDisks :: true
+                    _hasDisks: true
                 }
             }
             replicas: 3
         }
+        _name: "caller"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "kitchen"
+#Component: "kitchen"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -1679,6 +1678,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -1710,7 +1710,6 @@
 }
 deployment: {
     dishwasher: {
-        Name ::     "dishwasher"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -1779,18 +1778,18 @@
                             }
                         }
                     }]
-                    hasDisks :: true
+                    _hasDisks: true
                 }
             }
             replicas: 5
         }
+        _name: "dishwasher"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "kitchen"
+#Component: "kitchen"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -1815,6 +1814,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -1846,7 +1846,6 @@
 }
 deployment: {
     expiditer: {
-        Name ::     "expiditer"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -1906,18 +1905,18 @@
                             }
                         }
                     }]
-                    hasDisks :: true
+                    _hasDisks: true
                 }
             }
             replicas: 1
         }
+        _name: "expiditer"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "kitchen"
+#Component: "kitchen"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -1942,6 +1941,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -1973,7 +1973,6 @@
 }
 deployment: {
     headchef: {
-        Name ::     "headchef"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -2033,18 +2032,18 @@
                             }
                         }
                     }]
-                    hasDisks :: true
+                    _hasDisks: true
                 }
             }
             replicas: 1
         }
+        _name: "headchef"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "kitchen"
+#Component: "kitchen"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -2069,6 +2068,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -2100,7 +2100,6 @@
 }
 deployment: {
     linecook: {
-        Name ::     "linecook"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -2160,18 +2159,18 @@
                             }
                         }
                     }]
-                    hasDisks :: true
+                    _hasDisks: true
                 }
             }
             replicas: 1
         }
+        _name: "linecook"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "kitchen"
+#Component: "kitchen"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -2196,6 +2195,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -2227,7 +2227,6 @@
 }
 deployment: {
     pastrychef: {
-        Name ::     "pastrychef"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -2287,18 +2286,18 @@
                             }
                         }
                     }]
-                    hasDisks :: true
+                    _hasDisks: true
                 }
             }
             replicas: 1
         }
+        _name: "pastrychef"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "kitchen"
+#Component: "kitchen"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -2323,6 +2322,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -2354,7 +2354,6 @@
 }
 deployment: {
     souschef: {
-        Name ::     "souschef"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -2393,18 +2392,18 @@
                             }
                         }
                     }]
-                    hasDisks :: false
+                    _hasDisks: false
                 }
             }
             replicas: 1
         }
+        _name: "souschef"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "kitchen"
+#Component: "kitchen"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -2429,15 +2428,15 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {}
 deployment: {}
 daemonSet: {}
 statefulSet: {}
-Component :: "mon"
+#Component: "mon"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -2462,6 +2461,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {
     alertmanager: {
@@ -2528,7 +2528,6 @@
 }
 deployment: {
     alertmanager: {
-        Name ::     "alertmanager"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -2583,13 +2582,13 @@
             }
             replicas: 1
         }
+        _name: "alertmanager"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "mon"
+#Component: "mon"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -2614,6 +2613,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -2645,7 +2645,6 @@
 }
 deployment: {
     grafana: {
-        Name ::     "grafana"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -2709,13 +2708,13 @@
             }
             replicas: 1
         }
+        _name: "grafana"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "mon"
+#Component: "mon"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -2740,6 +2739,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -2777,7 +2777,6 @@
 deployment: {}
 daemonSet: {
     "node-exporter": {
-        Name ::     "node-exporter"
         kind:       "DaemonSet"
         apiVersion: "apps/v1"
         metadata: {
@@ -2844,12 +2843,12 @@
                 }
             }
         }
+        _name: "node-exporter"
     }
 }
 statefulSet: {}
-Component :: "mon"
+#Component: "mon"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -2874,6 +2873,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {
     prometheus: {
@@ -3152,7 +3152,6 @@
 }
 deployment: {
     prometheus: {
-        Name ::     "prometheus"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -3211,13 +3210,13 @@
                 }
             }
         }
+        _name: "prometheus"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "mon"
+#Component: "mon"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -3242,15 +3241,15 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {}
 deployment: {}
 daemonSet: {}
 statefulSet: {}
-Component :: "proxy"
+#Component: "proxy"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -3275,6 +3274,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {
     authproxy: {
@@ -3372,7 +3372,6 @@
 }
 deployment: {
     authproxy: {
-        Name ::     "authproxy"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -3415,13 +3414,13 @@
             }
             replicas: 1
         }
+        _name: "authproxy"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "proxy"
+#Component: "proxy"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -3446,6 +3445,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {}
 service: {
@@ -3479,7 +3479,6 @@
 }
 deployment: {
     goget: {
-        Name ::     "goget"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -3521,13 +3520,13 @@
             }
             replicas: 1
         }
+        _name: "goget"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "proxy"
+#Component: "proxy"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -3552,6 +3551,7 @@
             }
         }
     }
+    _name: string
 }
 configMap: {
     nginx: {
@@ -3757,7 +3757,6 @@
 }
 deployment: {
     nginx: {
-        Name ::     "nginx"
         kind:       "Deployment"
         apiVersion: "apps/v1"
         metadata: {
@@ -3811,13 +3810,13 @@
             }
             replicas: 1
         }
+        _name: "nginx"
     }
 }
 daemonSet: {}
 statefulSet: {}
-Component :: "proxy"
+#Component: "proxy"
 _spec: {
-    Name :: string
     metadata: {
         name: string
         labels: {
@@ -3842,4 +3841,5 @@
             }
         }
     }
+    _name: string
 }
\ No newline at end of file