cmd/cue: update get to use definitions

This also involves updates to the Kubernetes tutorial

Closes #83

Change-Id: I02e52cbf21efd6ba15ac87bb5db852e2b9f115ec
Reviewed-on: https://cue-review.googlesource.com/c/cue/+/3046
Reviewed-by: Marcel van Lohuizen <mpvl@google.com>
diff --git a/cmd/cue/cmd/get_go.go b/cmd/cue/cmd/get_go.go
index 20ce3cf..f9f5821 100644
--- a/cmd/cue/cmd/get_go.go
+++ b/cmd/cue/cmd/get_go.go
@@ -33,6 +33,7 @@
 
 	"cuelang.org/go/cue/format"
 	"cuelang.org/go/cue/parser"
+	cuetoken "cuelang.org/go/cue/token"
 	"cuelang.org/go/internal"
 	"github.com/spf13/cobra"
 	"golang.org/x/tools/go/packages"
@@ -40,8 +41,9 @@
 
 // TODO:
 // Document:
+// - Use ast package.
 // - how to deal with "oneOf" or sum types?
-// - generate cue files for cuego definitions?
+// - generate cue files for cue field tags?
 // - cue go get or cue get go
 // - include generation report in doc_gen.cue or report.txt.
 //   Possible enums:
@@ -574,7 +576,7 @@
 					// TODO: add the underlying tag as a Go tag once we have
 					// proper string escaping for CUE.
 					e.printDoc(x.Doc, true)
-					fmt.Fprintf(e.w, "%s: %s", name, altType)
+					fmt.Fprintf(e.w, "%s :: %s", name, altType)
 					added = true
 					break
 				}
@@ -589,12 +591,12 @@
 
 				if s := e.altType(types.NewPointer(typ)); s != "" {
 					e.printDoc(x.Doc, true)
-					fmt.Fprint(e.w, name, ": ", s)
+					fmt.Fprint(e.w, name, " :: ", s)
 					break
 				}
 				// TODO: only print original type if value is not marked as enum.
 				underlying := e.pkg.TypesInfo.TypeOf(v.Type)
-				e.printField(name, false, underlying, x.Doc, true)
+				e.printField(name, cuetoken.ISA, underlying, x.Doc, true)
 			}
 
 			e.indent++
@@ -603,7 +605,7 @@
 
 				e.newLine()
 				e.newLine()
-				fmt.Fprintf(e.w, "enum%s:\n%v", name, enums[0])
+				fmt.Fprintf(e.w, "enum%s::\n%v", name, enums[0])
 				for _, v := range enums[1:] {
 					fmt.Fprint(e.w, " |")
 					e.newLine()
@@ -632,7 +634,7 @@
 				added = true
 
 				e.printDoc(v.Doc, true)
-				fmt.Fprint(e.w, name.Name, ": ")
+				fmt.Fprint(e.w, name.Name, " :: ")
 
 				typ := e.pkg.TypesInfo.TypeOf(name)
 				if s := typ.String(); !strings.Contains(s, "untyped") {
@@ -799,10 +801,13 @@
 	return false
 }
 
-func (e *extractor) printField(name string, opt bool, expr types.Type, doc *ast.CommentGroup, newline bool) (typename string) {
+func (e *extractor) printField(name string, kind cuetoken.Token, expr types.Type, doc *ast.CommentGroup, newline bool) (typename string) {
 	e.printDoc(doc, newline)
 	colon := ": "
-	if opt {
+	switch kind {
+	case cuetoken.ISA:
+		colon = " :: "
+	case cuetoken.OPTION:
 		colon = "?: "
 	}
 	fmt.Fprint(e.w, name, colon)
@@ -857,16 +862,6 @@
 		e.printType(x.Elem())
 
 	case *types.Struct:
-		for i := 0; i < x.NumFields(); i++ {
-			f := x.Field(i)
-			if f.Anonymous() && e.isInline(x.Tag(i)) {
-				typ := f.Type()
-				if _, ok := typ.(*types.Named); ok {
-					e.printType(typ)
-					fmt.Fprintf(e.w, " & ")
-				}
-			}
-		}
 		fmt.Fprint(e.w, "{")
 		e.indent++
 		e.printFields(x)
@@ -943,7 +938,18 @@
 		}
 		if f.Anonymous() && e.isInline(x.Tag(i)) {
 			typ := f.Type()
-			if _, ok := typ.(*types.Named); !ok {
+			if _, ok := typ.(*types.Named); ok {
+				// TODO: strongly consider allowing Expressions for embedded
+				//       values. This ties in with using dots instead of spaces,
+				//       comprehensions, and the ability to generate good
+				//       error messages, so thread carefully.
+				if i > 0 {
+					fmt.Fprintln(e.w)
+				}
+				fmt.Fprint(e.w, "\n(")
+				e.printType(typ)
+				fmt.Fprint(e.w, ")")
+			} else {
 				switch x := typ.(type) {
 				case *types.Struct:
 					e.printFields(x)
@@ -959,7 +965,11 @@
 			continue
 		}
 		e.newLine()
-		cueType := e.printField(name, e.isOptional(tag), f.Type(), docs[i], count > 0)
+		kind := cuetoken.COLON
+		if e.isOptional(tag) {
+			kind = cuetoken.OPTION
+		}
+		cueType := e.printField(name, kind, f.Type(), docs[i], count > 0)
 
 		// Add field tag to convert back to Go.
 		typeName := f.Type().String()
diff --git a/cmd/cue/cmd/testdata/pkg/cuelang.org/go/cmd/cue/cmd/testdata/code/go/pkg1/file1_go_gen.cue b/cmd/cue/cmd/testdata/pkg/cuelang.org/go/cmd/cue/cmd/testdata/code/go/pkg1/file1_go_gen.cue
index 1d2ad81..718e3ae 100644
--- a/cmd/cue/cmd/testdata/pkg/cuelang.org/go/cmd/cue/cmd/testdata/code/go/pkg1/file1_go_gen.cue
+++ b/cmd/cue/cmd/testdata/pkg/cuelang.org/go/cmd/cue/cmd/testdata/code/go/pkg1/file1_go_gen.cue
@@ -10,9 +10,12 @@
 )
 
 // Foozer foozes a jaman.
-Foozer: Inline & {
-	Int:        int
-	String:     string
+Foozer :: {
+	Int:    int
+	String: string
+
+	(Inline)
+
 	NoInline:   NoInline
 	CustomJSON: CustomJSON
 	CustomYAML: null | CustomYAML @go(,*CustomYAML)
@@ -45,32 +48,32 @@
 }
 
 // Level gives an indication of the extent of stuff.
-Level: int // enumLevel
+Level :: int // enumLevel
 
-enumLevel:
+enumLevel ::
 	Unknown |
 	Low |
 	Medium |
 	High
 
-Unknown: Level & 0
-Low:     Level & 1
+Unknown :: Level & 0
+Low ::     Level & 1
 
 // Medium is neither High nor Low
-Medium: Level & 2
-High:   Level & 3
+Medium :: Level & 2
+High ::   Level & 3
 
-CustomJSON: _
+CustomJSON :: _
 
-CustomYAML: {
+CustomYAML :: {
 }
 
-Inline: {
+Inline :: {
 	Kind: string
 }
 
-NoInline: {
+NoInline :: {
 	Kind: string
 }
 
-Interface: _
+Interface :: _
diff --git a/cmd/cue/cmd/testdata/pkg/cuelang.org/go/cmd/cue/cmd/testdata/code/go/pkg2/pkg2_go_gen.cue b/cmd/cue/cmd/testdata/pkg/cuelang.org/go/cmd/cue/cmd/testdata/code/go/pkg2/pkg2_go_gen.cue
index 1cebd7c..8d2a0c2 100644
--- a/cmd/cue/cmd/testdata/pkg/cuelang.org/go/cmd/cue/cmd/testdata/code/go/pkg2/pkg2_go_gen.cue
+++ b/cmd/cue/cmd/testdata/pkg/cuelang.org/go/cmd/cue/cmd/testdata/code/go/pkg2/pkg2_go_gen.cue
@@ -10,7 +10,7 @@
 )
 
 // A Barzer barzes.
-Barzer: {
+Barzer :: {
 	a:   int @go(A) @protobuf(2,varint,)
 	T:   t.Time
 	B:   null | int    @go(,*big.Int)
@@ -21,8 +21,8 @@
 	Err: _ @go(,error)
 }
 
-Perm: 0o755
+Perm :: 0o755
 
-Few: 3
+Few :: 3
 
-Couple: int & 2
+Couple :: int & 2
diff --git a/doc/ref/spec.md b/doc/ref/spec.md
index 453c77e..ca04260 100644
--- a/doc/ref/spec.md
+++ b/doc/ref/spec.md
@@ -1059,6 +1059,11 @@
 ExpressionLabel = BindLabel | [ BindLabel ] "[" [ Expression ] "]" .
 -->
 
+<!-- TODO: strongly consider relaxing an embedding to be an Expression, instead
+of Operand. This will tie in with using dots instead of spaces on the LHS,
+comprehensions and the ability to generate good error messages, so thread
+carefully.
+-->
 ```
 StructLit       = "{" [ DeclarationList [ "," [ "..." ] ] "}" .
 DeclarationList = Declaration { "," Declaration }
diff --git a/doc/tutorial/kubernetes/README.md b/doc/tutorial/kubernetes/README.md
index ed2c865..8ad7ff0 100644
--- a/doc/tutorial/kubernetes/README.md
+++ b/doc/tutorial/kubernetes/README.md
@@ -247,13 +247,13 @@
 $ cat <<EOF > kube.cue
 package kube
 
-service <Name>: {
+service <ID>: {
     apiVersion: "v1"
     kind:       "Service"
     metadata: {
-        name: Name
+        name: ID
         labels: {
-            app:       Name    // by convention
+            app:       ID    // by convention
             domain:    "prod"  // always the same in the given files
             component: string  // varies per directory
         }
@@ -269,32 +269,32 @@
     }
 }
 
-deployment <Name>: {
+deployment <ID>: {
     apiVersion: "extensions/v1beta1"
     kind:       "Deployment"
-    metadata name: Name
+    metadata name: ID
     spec: {
         // 1 is the default, but we allow any number
         replicas: *1 | int
         template: {
             metadata labels: {
-                app:       Name
+                app:       ID
                 domain:    "prod"
                 component: string
             }
             // we always have one namesake container
-            spec containers: [{ name: Name }]
+            spec containers: [{ name: ID }]
         }
     }
 }
 EOF
 ```
 
-By replacing the service and deployment name with `<Name>` we have changed the
+By replacing the service and deployment name with `<ID>` we have changed the
 definition into a template.
-CUE bind the field name to `Name` as a result.
+CUE bind the field name to `ID` as a result.
 During importing we used `metadata.name` as a key for the object names,
-so we can now set this field to `Name`.
+so we can now set this field to `ID`.
 
 Templates are applied to (are unified with) all entries in the struct in which
 they are defined,
@@ -352,25 +352,25 @@
 <!--
 ```
 $ cue add */kube.cue -p kube --list <<EOF
-_component: "{{.DisplayPath}}"
+Component :: "{{.DisplayPath}}"
 EOF
 ```
 -->
 
 ```
 # set the component label to our new top-level field
-$ sed -i.bak 's/component:.*string/component: _component/' kube.cue && rm kube.cue.bak
+$ sed -i.bak 's/component:.*string/component: Component/' kube.cue && rm kube.cue.bak
 
 # add the new top-level field to our previous template definitions
 $ cat <<EOF >> kube.cue
 
-_component: string
+Component :: string
 EOF
 
 # add a file with the component label to each directory
 $ ls -d */ | sed 's/.$//' | xargs -I DIR sh -c 'cd DIR; echo "package kube
 
-_component: \"DIR\"
+Component :: \"DIR\"
 " > kube.cue; cd ..'
 
 # format the files
@@ -422,41 +422,42 @@
 ```
 $ cat <<EOF >> kube.cue
 
-daemonSet <Name>: _spec & {
+daemonSet <ID>: _spec & {
     apiVersion: "extensions/v1beta1"
     kind:       "DaemonSet"
-    _name:      Name
+    Name ::     ID
 }
 
-statefulSet <Name>: _spec & {
+statefulSet <ID>: _spec & {
     apiVersion: "apps/v1beta1"
     kind:       "StatefulSet"
-    _name:      Name
+    Name ::     ID
 }
 
-deployment <Name>: _spec & {
+deployment <ID>: _spec & {
     apiVersion: "extensions/v1beta1"
     kind:       "Deployment"
-    _name:      Name
+    Name ::     ID
     spec replicas: *1 | int
 }
 
-configMap <Name>: {
-    metadata name: Name
-    metadata labels component: _component
+configMap <ID>: {
+    metadata name: ID
+    metadata labels component: Component
 }
 
 _spec: {
-    _name: string
-    metadata name: _name
-    metadata labels component: _component
+    Name :: string
+
+    metadata name: Name
+    metadata labels component: Component
     spec template: {
         metadata labels: {
-            app:       _name
-            component: _component
+            app:       Name
+            component: Component
             domain:    "prod"
         }
-        spec containers: [{name: _name}]
+        spec containers: [{name: Name}]
     }
 }
 EOF
@@ -464,7 +465,7 @@
 ```
 
 The common configuration has been factored out into `_spec`.
-We introduced `_name` to aid both specifying and referring
+We introduced `Name` to aid both specifying and referring
 to the name of an object.
 For completeness, we added `configMap` as a top-level entry.
 
@@ -700,34 +701,37 @@
 ```
 $ cat <<EOF >> kitchen/kube.cue
 
-deployment <Name> spec template spec: {
-    _hasDisks: *true | bool
+deployment <ID> spec template spec: {
+    hasDisks :: *true | bool
 
     volumes: [{
-        name: *"\(Name)-disk" | string
-        gcePersistentDisk pdName: *"\(Name)-disk" | string
+        name: *"\(ID)-disk" | string
+        gcePersistentDisk pdName: *"\(ID)-disk" | string
         gcePersistentDisk fsType: "ext4"
     }, {
-        name: *"secret-\(Name)" | string
-        secret secretName: *"\(Name)-secrets" | string
-    }, ...] if _hasDisks
+        name: *"secret-\(ID)" | string
+        secret secretName: *"\(ID)-secrets" | string
+    }, ...] if hasDisks
 
     containers: [{
         volumeMounts: [{
-            name:      *"\(Name)-disk" | string
+            name:      *"\(ID)-disk" | string
             mountPath: *"/logs" | string
         }, {
             mountPath: *"/etc/certs" | string
-            name:      *"secret-\(Name)" | string
+            name:      *"secret-\(ID)" | string
             readOnly:  true
         }, ...]
-    }] if _hasDisks // field comprehension using just "if"
+    }] if hasDisks // field comprehension using just "if"
 }
 EOF
 
 $ cat <<EOF >> kitchen/souschef/kube.cue
 
-deployment souschef spec template spec _hasDisks: false
+deployment souschef spec template spec: {
+    hasDisks :: false
+}
+
 EOF
 $ cue fmt ./kitchen/...
 ```
@@ -917,7 +921,7 @@
 different subdirectories may have different specializations.
 A merge pre-expands templates of each instance and then merges their root
 values.
-The result may contain conflicts, such as our top-level `_component` field,
+The result may contain conflicts, such as our top-level `Component` field,
 but our per-type maps of Kubernetes objects should be free of conflict
 (if there is, we have a problem with Kubernetes down the line).
 A merge thus gives us a unified view of all objects.
@@ -1055,10 +1059,10 @@
   apps_v1beta1 "k8s.io/api/apps/v1beta1"
 )
 
-service <Name>: v1.Service & {}
-deployment <Name>: extensions_v1beta1.Deployment & {}
-daemonSet <Name>: extensions_v1beta1.DaemonSet & {}
-statefulSet <Name>: apps_v1beta1.StatefulSet & {}
+service <Name>: v1.Service
+deployment <Name>: extensions_v1beta1.Deployment
+daemonSet <Name>: extensions_v1beta1.DaemonSet
+statefulSet <Name>: apps_v1beta1.StatefulSet
 EOF
 ```
 
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/apps/v1beta1/register_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/apps/v1beta1/register_go_gen.cue
index 36f6203..fa8e87d 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/apps/v1beta1/register_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/apps/v1beta1/register_go_gen.cue
@@ -4,4 +4,4 @@
 
 package v1beta1
 
-GroupName: "apps"
+GroupName :: "apps"
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/apps/v1beta1/types_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/apps/v1beta1/types_go_gen.cue
index 17b3cc5..dab4f32 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/apps/v1beta1/types_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/apps/v1beta1/types_go_gen.cue
@@ -11,19 +11,19 @@
 	"k8s.io/apimachinery/pkg/util/intstr"
 )
 
-ControllerRevisionHashLabelKey: "controller-revision-hash"
-StatefulSetRevisionLabel:       "controller-revision-hash"
-StatefulSetPodNameLabel:        "statefulset.kubernetes.io/pod-name"
+ControllerRevisionHashLabelKey :: "controller-revision-hash"
+StatefulSetRevisionLabel ::       "controller-revision-hash"
+StatefulSetPodNameLabel ::        "statefulset.kubernetes.io/pod-name"
 
 // ScaleSpec describes the attributes of a scale subresource
-ScaleSpec: {
+ScaleSpec :: {
 	// desired number of instances for the scaled object.
 	// +optional
 	replicas?: int32 @go(Replicas) @protobuf(1,varint,opt)
 }
 
 // ScaleStatus represents the current status of a scale subresource.
-ScaleStatus: {
+ScaleStatus :: {
 	// actual number of observed instances of the scaled object.
 	replicas: int32 @go(Replicas) @protobuf(1,varint,opt)
 
@@ -42,7 +42,9 @@
 }
 
 // Scale represents a scaling request for a resource.
-Scale: metav1.TypeMeta & {
+Scale :: {
+	(metav1.TypeMeta)
+
 	// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
 	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
@@ -64,7 +66,9 @@
 //  - Storage: As many VolumeClaims as requested.
 // The StatefulSet guarantees that a given network identity will always
 // map to the same storage identity.
-StatefulSet: metav1.TypeMeta & {
+StatefulSet :: {
+	(metav1.TypeMeta)
+
 	// +optional
 	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
@@ -79,9 +83,9 @@
 }
 
 // PodManagementPolicyType defines the policy for creating pods under a stateful set.
-PodManagementPolicyType: string // enumPodManagementPolicyType
+PodManagementPolicyType :: string // enumPodManagementPolicyType
 
-enumPodManagementPolicyType:
+enumPodManagementPolicyType ::
 	OrderedReadyPodManagement |
 	ParallelPodManagement
 
@@ -89,17 +93,17 @@
 // scale up and strictly decreasing order on scale down, progressing only when
 // the previous pod is ready or terminated. At most one pod will be changed
 // at any time.
-OrderedReadyPodManagement: PodManagementPolicyType & "OrderedReady"
+OrderedReadyPodManagement :: PodManagementPolicyType & "OrderedReady"
 
 // ParallelPodManagement will create and delete pods as soon as the stateful set
 // replica count is changed, and will not wait for pods to be ready or complete
 // termination.
-ParallelPodManagement: PodManagementPolicyType & "Parallel"
+ParallelPodManagement :: PodManagementPolicyType & "Parallel"
 
 // StatefulSetUpdateStrategy indicates the strategy that the StatefulSet
 // controller will use to perform updates. It includes any additional parameters
 // necessary to perform the update for the indicated strategy.
-StatefulSetUpdateStrategy: {
+StatefulSetUpdateStrategy :: {
 	// Type indicates the type of the StatefulSetUpdateStrategy.
 	type?: StatefulSetUpdateStrategyType @go(Type) @protobuf(1,bytes,opt,casttype=StatefulSetStrategyType)
 
@@ -109,9 +113,9 @@
 
 // StatefulSetUpdateStrategyType is a string enumeration type that enumerates
 // all possible update strategies for the StatefulSet controller.
-StatefulSetUpdateStrategyType: string // enumStatefulSetUpdateStrategyType
+StatefulSetUpdateStrategyType :: string // enumStatefulSetUpdateStrategyType
 
-enumStatefulSetUpdateStrategyType:
+enumStatefulSetUpdateStrategyType ::
 	RollingUpdateStatefulSetStrategyType |
 	OnDeleteStatefulSetStrategyType
 
@@ -120,24 +124,24 @@
 // ordering constraints. When a scale operation is performed with this
 // strategy, new Pods will be created from the specification version indicated
 // by the StatefulSet's updateRevision.
-RollingUpdateStatefulSetStrategyType: StatefulSetUpdateStrategyType & "RollingUpdate"
+RollingUpdateStatefulSetStrategyType :: StatefulSetUpdateStrategyType & "RollingUpdate"
 
 // OnDeleteStatefulSetStrategyType triggers the legacy behavior. Version
 // tracking and ordered rolling restarts are disabled. Pods are recreated
 // from the StatefulSetSpec when they are manually deleted. When a scale
 // operation is performed with this strategy,specification version indicated
 // by the StatefulSet's currentRevision.
-OnDeleteStatefulSetStrategyType: StatefulSetUpdateStrategyType & "OnDelete"
+OnDeleteStatefulSetStrategyType :: StatefulSetUpdateStrategyType & "OnDelete"
 
 // RollingUpdateStatefulSetStrategy is used to communicate parameter for RollingUpdateStatefulSetStrategyType.
-RollingUpdateStatefulSetStrategy: {
+RollingUpdateStatefulSetStrategy :: {
 	// Partition indicates the ordinal at which the StatefulSet should be
 	// partitioned.
 	partition?: null | int32 @go(Partition,*int32) @protobuf(1,varint,opt)
 }
 
 // A StatefulSetSpec is the specification of a StatefulSet.
-StatefulSetSpec: {
+StatefulSetSpec :: {
 	// replicas is the desired number of replicas of the given Template.
 	// These are replicas in the sense that they are instantiations of the
 	// same Template, but individual replicas also have a consistent identity.
@@ -199,7 +203,7 @@
 }
 
 // StatefulSetStatus represents the current state of a StatefulSet.
-StatefulSetStatus: {
+StatefulSetStatus :: {
 	// observedGeneration is the most recent generation observed for this StatefulSet. It corresponds to the
 	// StatefulSet's generation, which is updated on mutation by the API Server.
 	// +optional
@@ -240,10 +244,10 @@
 	conditions?: [...StatefulSetCondition] @go(Conditions,[]StatefulSetCondition) @protobuf(10,bytes,rep)
 }
 
-StatefulSetConditionType: string
+StatefulSetConditionType :: string
 
 // StatefulSetCondition describes the state of a statefulset at a certain point.
-StatefulSetCondition: {
+StatefulSetCondition :: {
 	// Type of statefulset condition.
 	type: StatefulSetConditionType @go(Type) @protobuf(1,bytes,opt,casttype=StatefulSetConditionType)
 
@@ -264,7 +268,9 @@
 }
 
 // StatefulSetList is a collection of StatefulSets.
-StatefulSetList: metav1.TypeMeta & {
+StatefulSetList :: {
+	(metav1.TypeMeta)
+
 	// +optional
 	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
 	items: [...StatefulSet] @go(Items,[]StatefulSet) @protobuf(2,bytes,rep)
@@ -273,7 +279,9 @@
 // DEPRECATED - This group version of Deployment is deprecated by apps/v1beta2/Deployment. See the release notes for
 // more information.
 // Deployment enables declarative updates for Pods and ReplicaSets.
-Deployment: metav1.TypeMeta & {
+Deployment :: {
+	(metav1.TypeMeta)
+
 	// Standard object metadata.
 	// +optional
 	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
@@ -288,7 +296,7 @@
 }
 
 // DeploymentSpec is the specification of the desired behavior of the Deployment.
-DeploymentSpec: {
+DeploymentSpec :: {
 	// Number of desired pods. This is a pointer to distinguish between explicit
 	// zero and not specified. Defaults to 1.
 	// +optional
@@ -339,7 +347,9 @@
 
 // DEPRECATED.
 // DeploymentRollback stores the information required to rollback a deployment.
-DeploymentRollback: metav1.TypeMeta & {
+DeploymentRollback :: {
+	(metav1.TypeMeta)
+
 	// Required: This must match the Name of a deployment.
 	name: string @go(Name) @protobuf(1,bytes,opt)
 
@@ -352,7 +362,7 @@
 }
 
 // DEPRECATED.
-RollbackConfig: {
+RollbackConfig :: {
 	// The revision to rollback to. If set to 0, rollback to the last revision.
 	// +optional
 	revision?: int64 @go(Revision) @protobuf(1,varint,opt)
@@ -361,10 +371,10 @@
 // DefaultDeploymentUniqueLabelKey is the default key of the selector that is added
 // to existing ReplicaSets (and label key that is added to its pods) to prevent the existing ReplicaSets
 // to select new pods (and old pods being select by new ReplicaSet).
-DefaultDeploymentUniqueLabelKey: "pod-template-hash"
+DefaultDeploymentUniqueLabelKey :: "pod-template-hash"
 
 // DeploymentStrategy describes how to replace existing pods with new ones.
-DeploymentStrategy: {
+DeploymentStrategy :: {
 	// Type of deployment. Can be "Recreate" or "RollingUpdate". Default is RollingUpdate.
 	// +optional
 	type?: DeploymentStrategyType @go(Type) @protobuf(1,bytes,opt,casttype=DeploymentStrategyType)
@@ -378,20 +388,20 @@
 	rollingUpdate?: null | RollingUpdateDeployment @go(RollingUpdate,*RollingUpdateDeployment) @protobuf(2,bytes,opt)
 }
 
-DeploymentStrategyType: string // enumDeploymentStrategyType
+DeploymentStrategyType :: string // enumDeploymentStrategyType
 
-enumDeploymentStrategyType:
+enumDeploymentStrategyType ::
 	RecreateDeploymentStrategyType |
 	RollingUpdateDeploymentStrategyType
 
 // Kill all existing pods before creating new ones.
-RecreateDeploymentStrategyType: DeploymentStrategyType & "Recreate"
+RecreateDeploymentStrategyType :: DeploymentStrategyType & "Recreate"
 
 // Replace the old ReplicaSets by new one using rolling update i.e gradually scale down the old ReplicaSets and scale up the new one.
-RollingUpdateDeploymentStrategyType: DeploymentStrategyType & "RollingUpdate"
+RollingUpdateDeploymentStrategyType :: DeploymentStrategyType & "RollingUpdate"
 
 // Spec to control the desired behavior of rolling update.
-RollingUpdateDeployment: {
+RollingUpdateDeployment :: {
 	// The maximum number of pods that can be unavailable during the update.
 	// Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
 	// Absolute number is calculated from percentage by rounding down.
@@ -421,7 +431,7 @@
 }
 
 // DeploymentStatus is the most recently observed status of the Deployment.
-DeploymentStatus: {
+DeploymentStatus :: {
 	// The generation observed by the deployment controller.
 	// +optional
 	observedGeneration?: int64 @go(ObservedGeneration) @protobuf(1,varint,opt)
@@ -460,29 +470,29 @@
 	collisionCount?: null | int32 @go(CollisionCount,*int32) @protobuf(8,varint,opt)
 }
 
-DeploymentConditionType: string // enumDeploymentConditionType
+DeploymentConditionType :: string // enumDeploymentConditionType
 
-enumDeploymentConditionType:
+enumDeploymentConditionType ::
 	DeploymentAvailable |
 	DeploymentProgressing |
 	DeploymentReplicaFailure
 
 // Available means the deployment is available, ie. at least the minimum available
 // replicas required are up and running for at least minReadySeconds.
-DeploymentAvailable: DeploymentConditionType & "Available"
+DeploymentAvailable :: DeploymentConditionType & "Available"
 
 // Progressing means the deployment is progressing. Progress for a deployment is
 // considered when a new replica set is created or adopted, and when new pods scale
 // up or old pods scale down. Progress is not estimated for paused deployments or
 // when progressDeadlineSeconds is not specified.
-DeploymentProgressing: DeploymentConditionType & "Progressing"
+DeploymentProgressing :: DeploymentConditionType & "Progressing"
 
 // ReplicaFailure is added in a deployment when one of its pods fails to be created
 // or deleted.
-DeploymentReplicaFailure: DeploymentConditionType & "ReplicaFailure"
+DeploymentReplicaFailure :: DeploymentConditionType & "ReplicaFailure"
 
 // DeploymentCondition describes the state of a deployment at a certain point.
-DeploymentCondition: {
+DeploymentCondition :: {
 	// Type of deployment condition.
 	type: DeploymentConditionType @go(Type) @protobuf(1,bytes,opt,casttype=DeploymentConditionType)
 
@@ -503,7 +513,9 @@
 }
 
 // DeploymentList is a list of Deployments.
-DeploymentList: metav1.TypeMeta & {
+DeploymentList :: {
+	(metav1.TypeMeta)
+
 	// Standard list metadata.
 	// +optional
 	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
@@ -523,7 +535,9 @@
 // the DaemonSet and StatefulSet controllers for update and rollback, this object is beta. However,
 // it may be subject to name and representation changes in future releases, and clients should not
 // depend on its stability. It is primarily for internal use by controllers.
-ControllerRevision: metav1.TypeMeta & {
+ControllerRevision :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -537,7 +551,9 @@
 }
 
 // ControllerRevisionList is a resource containing a list of ControllerRevision objects.
-ControllerRevisionList: metav1.TypeMeta & {
+ControllerRevisionList :: {
+	(metav1.TypeMeta)
+
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/core/v1/annotation_key_constants_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/core/v1/annotation_key_constants_go_gen.cue
index 1798bdd..892ae89 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/core/v1/annotation_key_constants_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/core/v1/annotation_key_constants_go_gen.cue
@@ -6,52 +6,52 @@
 
 // ImagePolicyFailedOpenKey is added to pods created by failing open when the image policy
 // webhook backend fails.
-ImagePolicyFailedOpenKey: "alpha.image-policy.k8s.io/failed-open"
+ImagePolicyFailedOpenKey :: "alpha.image-policy.k8s.io/failed-open"
 
 // PodPresetOptOutAnnotationKey represents the annotation key for a pod to exempt itself from pod preset manipulation
-PodPresetOptOutAnnotationKey: "podpreset.admission.kubernetes.io/exclude"
+PodPresetOptOutAnnotationKey :: "podpreset.admission.kubernetes.io/exclude"
 
 // MirrorAnnotationKey represents the annotation key set by kubelets when creating mirror pods
-MirrorPodAnnotationKey: "kubernetes.io/config.mirror"
+MirrorPodAnnotationKey :: "kubernetes.io/config.mirror"
 
 // TolerationsAnnotationKey represents the key of tolerations data (json serialized)
 // in the Annotations of a Pod.
-TolerationsAnnotationKey: "scheduler.alpha.kubernetes.io/tolerations"
+TolerationsAnnotationKey :: "scheduler.alpha.kubernetes.io/tolerations"
 
 // TaintsAnnotationKey represents the key of taints data (json serialized)
 // in the Annotations of a Node.
-TaintsAnnotationKey: "scheduler.alpha.kubernetes.io/taints"
+TaintsAnnotationKey :: "scheduler.alpha.kubernetes.io/taints"
 
 // SeccompPodAnnotationKey represents the key of a seccomp profile applied
 // to all containers of a pod.
-SeccompPodAnnotationKey: "seccomp.security.alpha.kubernetes.io/pod"
+SeccompPodAnnotationKey :: "seccomp.security.alpha.kubernetes.io/pod"
 
 // SeccompContainerAnnotationKeyPrefix represents the key of a seccomp profile applied
 // to one container of a pod.
-SeccompContainerAnnotationKeyPrefix: "container.seccomp.security.alpha.kubernetes.io/"
+SeccompContainerAnnotationKeyPrefix :: "container.seccomp.security.alpha.kubernetes.io/"
 
 // SeccompProfileRuntimeDefault represents the default seccomp profile used by container runtime.
-SeccompProfileRuntimeDefault: "runtime/default"
+SeccompProfileRuntimeDefault :: "runtime/default"
 
 // DeprecatedSeccompProfileDockerDefault represents the default seccomp profile used by docker.
 // This is now deprecated and should be replaced by SeccompProfileRuntimeDefault.
-DeprecatedSeccompProfileDockerDefault: "docker/default"
+DeprecatedSeccompProfileDockerDefault :: "docker/default"
 
 // PreferAvoidPodsAnnotationKey represents the key of preferAvoidPods data (json serialized)
 // in the Annotations of a Node.
-PreferAvoidPodsAnnotationKey: "scheduler.alpha.kubernetes.io/preferAvoidPods"
+PreferAvoidPodsAnnotationKey :: "scheduler.alpha.kubernetes.io/preferAvoidPods"
 
 // ObjectTTLAnnotations represents a suggestion for kubelet for how long it can cache
 // an object (e.g. secret, config map) before fetching it again from apiserver.
 // This annotation can be attached to node.
-ObjectTTLAnnotationKey: "node.alpha.kubernetes.io/ttl"
+ObjectTTLAnnotationKey :: "node.alpha.kubernetes.io/ttl"
 
 // annotation key prefix used to identify non-convertible json paths.
-NonConvertibleAnnotationPrefix: "non-convertible.kubernetes.io"
+NonConvertibleAnnotationPrefix :: "non-convertible.kubernetes.io"
 
 // LastAppliedConfigAnnotation is the annotation used to store the previous
 // configuration of a resource for use in a three way diff by UpdateApplyAnnotation.
-LastAppliedConfigAnnotation: "kubectl.kubernetes.io/last-applied-configuration"
+LastAppliedConfigAnnotation :: "kubectl.kubernetes.io/last-applied-configuration"
 
 // AnnotationLoadBalancerSourceRangesKey is the key of the annotation on a service to set allowed ingress ranges on their LoadBalancers
 //
@@ -60,7 +60,7 @@
 // access only from the CIDRs currently allocated to MIT & the USPS.
 //
 // Not all cloud providers support this annotation, though AWS & GCE do.
-AnnotationLoadBalancerSourceRangesKey: "service.beta.kubernetes.io/load-balancer-source-ranges"
+AnnotationLoadBalancerSourceRangesKey :: "service.beta.kubernetes.io/load-balancer-source-ranges"
 
 // EndpointsLastChangeTriggerTime is the annotation key, set for endpoints objects, that
 // represents the timestamp (stored as RFC 3339 date-time string, e.g. '2018-10-22T19:32:52.1Z')
@@ -79,10 +79,10 @@
 //
 // This annotation will be used to compute the in-cluster network programming latency SLI, see
 // https://github.com/kubernetes/community/blob/master/sig-scalability/slos/network_programming_latency.md
-EndpointsLastChangeTriggerTime: "endpoints.kubernetes.io/last-change-trigger-time"
+EndpointsLastChangeTriggerTime :: "endpoints.kubernetes.io/last-change-trigger-time"
 
 // MigratedPluginsAnnotationKey is the annotation key, set for CSINode objects, that is a comma-separated
 // list of in-tree plugins that will be serviced by the CSI backend on the Node represented by CSINode.
 // This annotation is used by the Attach Detach Controller to determine whether to use the in-tree or
 // CSI Backend for a volume plugin on a specific node.
-MigratedPluginsAnnotationKey: "storage.alpha.kubernetes.io/migrated-plugins"
+MigratedPluginsAnnotationKey :: "storage.alpha.kubernetes.io/migrated-plugins"
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/core/v1/register_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/core/v1/register_go_gen.cue
index 2f90ee9..907efa1 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/core/v1/register_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/core/v1/register_go_gen.cue
@@ -4,4 +4,4 @@
 
 package v1
 
-GroupName: ""
+GroupName :: ""
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/core/v1/types_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/core/v1/types_go_gen.cue
index c5b4899..1c66a03 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/core/v1/types_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/core/v1/types_go_gen.cue
@@ -12,25 +12,28 @@
 )
 
 // NamespaceDefault means the object is in the default namespace which is applied when not specified by clients
-NamespaceDefault: "default"
+NamespaceDefault :: "default"
 
 // NamespaceAll is the default argument to specify on a context when you want to list or filter resources across all namespaces
-NamespaceAll: ""
+NamespaceAll :: ""
 
 // NamespaceNodeLease is the namespace where we place node lease objects (used for node heartbeats)
-NamespaceNodeLease: "kube-node-lease"
+NamespaceNodeLease :: "kube-node-lease"
 
 // Volume represents a named volume in a pod that may be accessed by any container in the pod.
-Volume: VolumeSource & {
+Volume :: {
 	// Volume's name.
 	// Must be a DNS_LABEL and unique within the pod.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
 	name: string @go(Name) @protobuf(1,bytes,opt)
+
+	(VolumeSource)
+
 }
 
 // Represents the source of a volume to mount.
 // Only one of its members may be specified.
-VolumeSource: {
+VolumeSource :: {
 	// HostPath represents a pre-existing file or directory on the host
 	// machine that is directly exposed to the container. This is generally
 	// used for system agents or other privileged things that are allowed
@@ -171,7 +174,7 @@
 // This volume finds the bound PV and mounts that volume for the pod. A
 // PersistentVolumeClaimVolumeSource is, essentially, a wrapper around another
 // type of volume that is owned by someone else (the system).
-PersistentVolumeClaimVolumeSource: {
+PersistentVolumeClaimVolumeSource :: {
 	// ClaimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
 	claimName: string @go(ClaimName) @protobuf(1,bytes,opt)
@@ -184,7 +187,7 @@
 
 // PersistentVolumeSource is similar to VolumeSource but meant for the
 // administrator who creates PVs. Exactly one of its members must be set.
-PersistentVolumeSource: {
+PersistentVolumeSource :: {
 	// GCEPersistentDisk represents a GCE Disk resource that is attached to a
 	// kubelet's host machine and then exposed to the pod. Provisioned by an admin.
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
@@ -291,15 +294,17 @@
 
 // BetaStorageClassAnnotation represents the beta/previous StorageClass annotation.
 // It's currently still used and will be held for backwards compatibility
-BetaStorageClassAnnotation: "volume.beta.kubernetes.io/storage-class"
+BetaStorageClassAnnotation :: "volume.beta.kubernetes.io/storage-class"
 
 // MountOptionAnnotation defines mount option annotation used in PVs
-MountOptionAnnotation: "volume.beta.kubernetes.io/mount-options"
+MountOptionAnnotation :: "volume.beta.kubernetes.io/mount-options"
 
 // PersistentVolume (PV) is a storage resource provisioned by an administrator.
 // It is analogous to a node.
 // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes
-PersistentVolume: metav1.TypeMeta & {
+PersistentVolume :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -320,12 +325,14 @@
 }
 
 // PersistentVolumeSpec is the specification of a persistent volume.
-PersistentVolumeSpec: PersistentVolumeSource & {
+PersistentVolumeSpec :: {
 	// A description of the persistent volume's resources and capacity.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#capacity
 	// +optional
 	capacity?: ResourceList @go(Capacity) @protobuf(1,bytes,rep,casttype=ResourceList,castkey=ResourceName)
 
+	(PersistentVolumeSource)
+
 	// AccessModes contains all ways the volume can be mounted.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes
 	// +optional
@@ -370,46 +377,46 @@
 }
 
 // VolumeNodeAffinity defines constraints that limit what nodes this volume can be accessed from.
-VolumeNodeAffinity: {
+VolumeNodeAffinity :: {
 	// Required specifies hard node constraints that must be met.
 	required?: null | NodeSelector @go(Required,*NodeSelector) @protobuf(1,bytes,opt)
 }
 
 // PersistentVolumeReclaimPolicy describes a policy for end-of-life maintenance of persistent volumes.
-PersistentVolumeReclaimPolicy: string // enumPersistentVolumeReclaimPolicy
+PersistentVolumeReclaimPolicy :: string // enumPersistentVolumeReclaimPolicy
 
-enumPersistentVolumeReclaimPolicy:
+enumPersistentVolumeReclaimPolicy ::
 	PersistentVolumeReclaimRecycle |
 	PersistentVolumeReclaimDelete |
 	PersistentVolumeReclaimRetain
 
 // PersistentVolumeReclaimRecycle means the volume will be recycled back into the pool of unbound persistent volumes on release from its claim.
 // The volume plugin must support Recycling.
-PersistentVolumeReclaimRecycle: PersistentVolumeReclaimPolicy & "Recycle"
+PersistentVolumeReclaimRecycle :: PersistentVolumeReclaimPolicy & "Recycle"
 
 // PersistentVolumeReclaimDelete means the volume will be deleted from Kubernetes on release from its claim.
 // The volume plugin must support Deletion.
-PersistentVolumeReclaimDelete: PersistentVolumeReclaimPolicy & "Delete"
+PersistentVolumeReclaimDelete :: PersistentVolumeReclaimPolicy & "Delete"
 
 // PersistentVolumeReclaimRetain means the volume will be left in its current phase (Released) for manual reclamation by the administrator.
 // The default policy is Retain.
-PersistentVolumeReclaimRetain: PersistentVolumeReclaimPolicy & "Retain"
+PersistentVolumeReclaimRetain :: PersistentVolumeReclaimPolicy & "Retain"
 
 // PersistentVolumeMode describes how a volume is intended to be consumed, either Block or Filesystem.
-PersistentVolumeMode: string // enumPersistentVolumeMode
+PersistentVolumeMode :: string // enumPersistentVolumeMode
 
-enumPersistentVolumeMode:
+enumPersistentVolumeMode ::
 	PersistentVolumeBlock |
 	PersistentVolumeFilesystem
 
 // PersistentVolumeBlock means the volume will not be formatted with a filesystem and will remain a raw block device.
-PersistentVolumeBlock: PersistentVolumeMode & "Block"
+PersistentVolumeBlock :: PersistentVolumeMode & "Block"
 
 // PersistentVolumeFilesystem means the volume will be or is formatted with a filesystem.
-PersistentVolumeFilesystem: PersistentVolumeMode & "Filesystem"
+PersistentVolumeFilesystem :: PersistentVolumeMode & "Filesystem"
 
 // PersistentVolumeStatus is the current status of a persistent volume.
-PersistentVolumeStatus: {
+PersistentVolumeStatus :: {
 	// Phase indicates if a volume is available, bound to a claim, or released by a claim.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#phase
 	// +optional
@@ -426,7 +433,9 @@
 }
 
 // PersistentVolumeList is a list of PersistentVolume items.
-PersistentVolumeList: metav1.TypeMeta & {
+PersistentVolumeList :: {
+	(metav1.TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -438,7 +447,9 @@
 }
 
 // PersistentVolumeClaim is a user's request for and claim to a persistent volume
-PersistentVolumeClaim: metav1.TypeMeta & {
+PersistentVolumeClaim :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -457,7 +468,9 @@
 }
 
 // PersistentVolumeClaimList is a list of PersistentVolumeClaim items.
-PersistentVolumeClaimList: metav1.TypeMeta & {
+PersistentVolumeClaimList :: {
+	(metav1.TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -470,7 +483,7 @@
 
 // PersistentVolumeClaimSpec describes the common attributes of storage devices
 // and allows a Source for provider-specific attributes
-PersistentVolumeClaimSpec: {
+PersistentVolumeClaimSpec :: {
 	// AccessModes contains the desired access modes the volume should have.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
 	// +optional
@@ -513,20 +526,20 @@
 }
 
 // PersistentVolumeClaimConditionType is a valid value of PersistentVolumeClaimCondition.Type
-PersistentVolumeClaimConditionType: string // enumPersistentVolumeClaimConditionType
+PersistentVolumeClaimConditionType :: string // enumPersistentVolumeClaimConditionType
 
-enumPersistentVolumeClaimConditionType:
+enumPersistentVolumeClaimConditionType ::
 	PersistentVolumeClaimResizing |
 	PersistentVolumeClaimFileSystemResizePending
 
 // PersistentVolumeClaimResizing - a user trigger resize of pvc has been started
-PersistentVolumeClaimResizing: PersistentVolumeClaimConditionType & "Resizing"
+PersistentVolumeClaimResizing :: PersistentVolumeClaimConditionType & "Resizing"
 
 // PersistentVolumeClaimFileSystemResizePending - controller resize is finished and a file system resize is pending on node
-PersistentVolumeClaimFileSystemResizePending: PersistentVolumeClaimConditionType & "FileSystemResizePending"
+PersistentVolumeClaimFileSystemResizePending :: PersistentVolumeClaimConditionType & "FileSystemResizePending"
 
 // PersistentVolumeClaimCondition contails details about state of pvc
-PersistentVolumeClaimCondition: {
+PersistentVolumeClaimCondition :: {
 	type:   PersistentVolumeClaimConditionType @go(Type) @protobuf(1,bytes,opt,casttype=PersistentVolumeClaimConditionType)
 	status: ConditionStatus                    @go(Status) @protobuf(2,bytes,opt,casttype=ConditionStatus)
 
@@ -550,7 +563,7 @@
 }
 
 // PersistentVolumeClaimStatus is the current status of a persistent volume claim.
-PersistentVolumeClaimStatus: {
+PersistentVolumeClaimStatus :: {
 	// Phase represents the current phase of PersistentVolumeClaim.
 	// +optional
 	phase?: PersistentVolumeClaimPhase @go(Phase) @protobuf(1,bytes,opt,casttype=PersistentVolumeClaimPhase)
@@ -572,25 +585,25 @@
 	conditions?: [...PersistentVolumeClaimCondition] @go(Conditions,[]PersistentVolumeClaimCondition) @protobuf(4,bytes,rep)
 }
 
-PersistentVolumeAccessMode: string // enumPersistentVolumeAccessMode
+PersistentVolumeAccessMode :: string // enumPersistentVolumeAccessMode
 
-enumPersistentVolumeAccessMode:
+enumPersistentVolumeAccessMode ::
 	ReadWriteOnce |
 	ReadOnlyMany |
 	ReadWriteMany
 
 // can be mounted in read/write mode to exactly 1 host
-ReadWriteOnce: PersistentVolumeAccessMode & "ReadWriteOnce"
+ReadWriteOnce :: PersistentVolumeAccessMode & "ReadWriteOnce"
 
 // can be mounted in read-only mode to many hosts
-ReadOnlyMany: PersistentVolumeAccessMode & "ReadOnlyMany"
+ReadOnlyMany :: PersistentVolumeAccessMode & "ReadOnlyMany"
 
 // can be mounted in read/write mode to many hosts
-ReadWriteMany: PersistentVolumeAccessMode & "ReadWriteMany"
+ReadWriteMany :: PersistentVolumeAccessMode & "ReadWriteMany"
 
-PersistentVolumePhase: string // enumPersistentVolumePhase
+PersistentVolumePhase :: string // enumPersistentVolumePhase
 
-enumPersistentVolumePhase:
+enumPersistentVolumePhase ::
 	VolumePending |
 	VolumeAvailable |
 	VolumeBound |
@@ -598,44 +611,44 @@
 	VolumeFailed
 
 // used for PersistentVolumes that are not available
-VolumePending: PersistentVolumePhase & "Pending"
+VolumePending :: PersistentVolumePhase & "Pending"
 
 // used for PersistentVolumes that are not yet bound
 // Available volumes are held by the binder and matched to PersistentVolumeClaims
-VolumeAvailable: PersistentVolumePhase & "Available"
+VolumeAvailable :: PersistentVolumePhase & "Available"
 
 // used for PersistentVolumes that are bound
-VolumeBound: PersistentVolumePhase & "Bound"
+VolumeBound :: PersistentVolumePhase & "Bound"
 
 // used for PersistentVolumes where the bound PersistentVolumeClaim was deleted
 // released volumes must be recycled before becoming available again
 // this phase is used by the persistent volume claim binder to signal to another process to reclaim the resource
-VolumeReleased: PersistentVolumePhase & "Released"
+VolumeReleased :: PersistentVolumePhase & "Released"
 
 // used for PersistentVolumes that failed to be correctly recycled or deleted after being released from a claim
-VolumeFailed: PersistentVolumePhase & "Failed"
+VolumeFailed :: PersistentVolumePhase & "Failed"
 
-PersistentVolumeClaimPhase: string // enumPersistentVolumeClaimPhase
+PersistentVolumeClaimPhase :: string // enumPersistentVolumeClaimPhase
 
-enumPersistentVolumeClaimPhase:
+enumPersistentVolumeClaimPhase ::
 	ClaimPending |
 	ClaimBound |
 	ClaimLost
 
 // used for PersistentVolumeClaims that are not yet bound
-ClaimPending: PersistentVolumeClaimPhase & "Pending"
+ClaimPending :: PersistentVolumeClaimPhase & "Pending"
 
 // used for PersistentVolumeClaims that are bound
-ClaimBound: PersistentVolumeClaimPhase & "Bound"
+ClaimBound :: PersistentVolumeClaimPhase & "Bound"
 
 // used for PersistentVolumeClaims that lost their underlying
 // PersistentVolume. The claim was bound to a PersistentVolume and this
 // volume does not exist any longer and all data on it was lost.
-ClaimLost: PersistentVolumeClaimPhase & "Lost"
+ClaimLost :: PersistentVolumeClaimPhase & "Lost"
 
-HostPathType: string // enumHostPathType
+HostPathType :: string // enumHostPathType
 
-enumHostPathType:
+enumHostPathType ::
 	HostPathUnset |
 	HostPathDirectoryOrCreate |
 	HostPathDirectory |
@@ -646,34 +659,34 @@
 	HostPathBlockDev
 
 // For backwards compatible, leave it empty if unset
-HostPathUnset: HostPathType & ""
+HostPathUnset :: HostPathType & ""
 
 // If nothing exists at the given path, an empty directory will be created there
 // as needed with file mode 0755, having the same group and ownership with Kubelet.
-HostPathDirectoryOrCreate: HostPathType & "DirectoryOrCreate"
+HostPathDirectoryOrCreate :: HostPathType & "DirectoryOrCreate"
 
 // A directory must exist at the given path
-HostPathDirectory: HostPathType & "Directory"
+HostPathDirectory :: HostPathType & "Directory"
 
 // If nothing exists at the given path, an empty file will be created there
 // as needed with file mode 0644, having the same group and ownership with Kubelet.
-HostPathFileOrCreate: HostPathType & "FileOrCreate"
+HostPathFileOrCreate :: HostPathType & "FileOrCreate"
 
 // A file must exist at the given path
-HostPathFile: HostPathType & "File"
+HostPathFile :: HostPathType & "File"
 
 // A UNIX socket must exist at the given path
-HostPathSocket: HostPathType & "Socket"
+HostPathSocket :: HostPathType & "Socket"
 
 // A character device must exist at the given path
-HostPathCharDev: HostPathType & "CharDevice"
+HostPathCharDev :: HostPathType & "CharDevice"
 
 // A block device must exist at the given path
-HostPathBlockDev: HostPathType & "BlockDevice"
+HostPathBlockDev :: HostPathType & "BlockDevice"
 
 // Represents a host path mapped into a pod.
 // Host path volumes do not support ownership management or SELinux relabeling.
-HostPathVolumeSource: {
+HostPathVolumeSource :: {
 	// Path of the directory on the host.
 	// If the path is a symlink, it will follow the link to the real path.
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
@@ -688,7 +701,7 @@
 
 // Represents an empty directory for a pod.
 // Empty directory volumes support ownership management and SELinux relabeling.
-EmptyDirVolumeSource: {
+EmptyDirVolumeSource :: {
 	// What type of storage medium should back this directory.
 	// The default is "" which means to use the node's default medium.
 	// Must be an empty string (default) or Memory.
@@ -708,7 +721,7 @@
 
 // Represents a Glusterfs mount that lasts the lifetime of a pod.
 // Glusterfs volumes do not support ownership management or SELinux relabeling.
-GlusterfsVolumeSource: {
+GlusterfsVolumeSource :: {
 	// EndpointsName is the endpoint name that details Glusterfs topology.
 	// More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
 	endpoints: string @go(EndpointsName) @protobuf(1,bytes,opt)
@@ -726,7 +739,7 @@
 
 // Represents a Glusterfs mount that lasts the lifetime of a pod.
 // Glusterfs volumes do not support ownership management or SELinux relabeling.
-GlusterfsPersistentVolumeSource: {
+GlusterfsPersistentVolumeSource :: {
 	// EndpointsName is the endpoint name that details Glusterfs topology.
 	// More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
 	endpoints: string @go(EndpointsName) @protobuf(1,bytes,opt)
@@ -750,7 +763,7 @@
 
 // Represents a Rados Block Device mount that lasts the lifetime of a pod.
 // RBD volumes support ownership management and SELinux relabeling.
-RBDVolumeSource: {
+RBDVolumeSource :: {
 	// A collection of Ceph monitors.
 	// More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
 	monitors: [...string] @go(CephMonitors,[]string) @protobuf(1,bytes,rep)
@@ -801,7 +814,7 @@
 
 // Represents a Rados Block Device mount that lasts the lifetime of a pod.
 // RBD volumes support ownership management and SELinux relabeling.
-RBDPersistentVolumeSource: {
+RBDPersistentVolumeSource :: {
 	// A collection of Ceph monitors.
 	// More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
 	monitors: [...string] @go(CephMonitors,[]string) @protobuf(1,bytes,rep)
@@ -854,7 +867,7 @@
 // A Cinder volume must exist before mounting to a container.
 // The volume must also be in the same region as the kubelet.
 // Cinder volumes support ownership management and SELinux relabeling.
-CinderVolumeSource: {
+CinderVolumeSource :: {
 	// volume id used to identify the volume in cinder.
 	// More info: https://examples.k8s.io/mysql-cinder-pd/README.md
 	volumeID: string @go(VolumeID) @protobuf(1,bytes,opt)
@@ -882,7 +895,7 @@
 // A Cinder volume must exist before mounting to a container.
 // The volume must also be in the same region as the kubelet.
 // Cinder volumes support ownership management and SELinux relabeling.
-CinderPersistentVolumeSource: {
+CinderPersistentVolumeSource :: {
 	// volume id used to identify the volume in cinder.
 	// More info: https://examples.k8s.io/mysql-cinder-pd/README.md
 	volumeID: string @go(VolumeID) @protobuf(1,bytes,opt)
@@ -908,7 +921,7 @@
 
 // Represents a Ceph Filesystem mount that lasts the lifetime of a pod
 // Cephfs volumes do not support ownership management or SELinux relabeling.
-CephFSVolumeSource: {
+CephFSVolumeSource :: {
 	// Required: Monitors is a collection of Ceph monitors
 	// More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
 	monitors: [...string] @go(Monitors,[]string) @protobuf(1,bytes,rep)
@@ -941,7 +954,7 @@
 
 // SecretReference represents a Secret Reference. It has enough information to retrieve secret
 // in any namespace
-SecretReference: {
+SecretReference :: {
 	// Name is unique within a namespace to reference a secret resource.
 	// +optional
 	name?: string @go(Name) @protobuf(1,bytes,opt)
@@ -953,7 +966,7 @@
 
 // Represents a Ceph Filesystem mount that lasts the lifetime of a pod
 // Cephfs volumes do not support ownership management or SELinux relabeling.
-CephFSPersistentVolumeSource: {
+CephFSPersistentVolumeSource :: {
 	// Required: Monitors is a collection of Ceph monitors
 	// More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
 	monitors: [...string] @go(Monitors,[]string) @protobuf(1,bytes,rep)
@@ -987,7 +1000,7 @@
 // Represents a Flocker volume mounted by the Flocker agent.
 // One and only one of datasetName and datasetUUID should be set.
 // Flocker volumes do not support ownership management or SELinux relabeling.
-FlockerVolumeSource: {
+FlockerVolumeSource :: {
 	// Name of the dataset stored as metadata -> name on the dataset for Flocker
 	// should be considered as deprecated
 	// +optional
@@ -999,33 +1012,33 @@
 }
 
 // StorageMedium defines ways that storage can be allocated to a volume.
-StorageMedium: string // enumStorageMedium
+StorageMedium :: string // enumStorageMedium
 
-enumStorageMedium:
+enumStorageMedium ::
 	StorageMediumDefault |
 	StorageMediumMemory |
 	StorageMediumHugePages
 
-StorageMediumDefault:   StorageMedium & ""
-StorageMediumMemory:    StorageMedium & "Memory"
-StorageMediumHugePages: StorageMedium & "HugePages"
+StorageMediumDefault ::   StorageMedium & ""
+StorageMediumMemory ::    StorageMedium & "Memory"
+StorageMediumHugePages :: StorageMedium & "HugePages"
 
 // Protocol defines network protocols supported for things like container ports.
-Protocol: string // enumProtocol
+Protocol :: string // enumProtocol
 
-enumProtocol:
+enumProtocol ::
 	ProtocolTCP |
 	ProtocolUDP |
 	ProtocolSCTP
 
 // ProtocolTCP is the TCP protocol.
-ProtocolTCP: Protocol & "TCP"
+ProtocolTCP :: Protocol & "TCP"
 
 // ProtocolUDP is the UDP protocol.
-ProtocolUDP: Protocol & "UDP"
+ProtocolUDP :: Protocol & "UDP"
 
 // ProtocolSCTP is the SCTP protocol.
-ProtocolSCTP: Protocol & "SCTP"
+ProtocolSCTP :: Protocol & "SCTP"
 
 // Represents a Persistent Disk resource in Google Compute Engine.
 //
@@ -1033,7 +1046,7 @@
 // also be in the same GCE project and zone as the kubelet. A GCE PD
 // can only be mounted as read/write once or read-only many times. GCE
 // PDs support ownership management and SELinux relabeling.
-GCEPersistentDiskVolumeSource: {
+GCEPersistentDiskVolumeSource :: {
 	// Unique name of the PD resource in GCE. Used to identify the disk in GCE.
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
 	pdName: string @go(PDName) @protobuf(1,bytes,opt)
@@ -1063,7 +1076,7 @@
 
 // Represents a Quobyte mount that lasts the lifetime of a pod.
 // Quobyte volumes do not support ownership management or SELinux relabeling.
-QuobyteVolumeSource: {
+QuobyteVolumeSource :: {
 	// Registry represents a single or multiple Quobyte Registry services
 	// specified as a string as host:port pair (multiple entries are separated with commas)
 	// which acts as the central registry for volumes
@@ -1095,7 +1108,7 @@
 
 // FlexPersistentVolumeSource represents a generic persistent volume resource that is
 // provisioned/attached using an exec based plugin.
-FlexPersistentVolumeSource: {
+FlexPersistentVolumeSource :: {
 	// Driver is the name of the driver to use for this volume.
 	driver: string @go(Driver) @protobuf(1,bytes,opt)
 
@@ -1125,7 +1138,7 @@
 
 // FlexVolume represents a generic volume resource that is
 // provisioned/attached using an exec based plugin.
-FlexVolumeSource: {
+FlexVolumeSource :: {
 	// Driver is the name of the driver to use for this volume.
 	driver: string @go(Driver) @protobuf(1,bytes,opt)
 
@@ -1159,7 +1172,7 @@
 // must also be in the same AWS zone as the kubelet. An AWS EBS disk
 // can only be mounted as read/write once. AWS EBS volumes support
 // ownership management and SELinux relabeling.
-AWSElasticBlockStoreVolumeSource: {
+AWSElasticBlockStoreVolumeSource :: {
 	// Unique ID of the persistent disk resource in AWS (Amazon EBS volume).
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
 	volumeID: string @go(VolumeID) @protobuf(1,bytes,opt)
@@ -1193,7 +1206,7 @@
 // DEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an
 // EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir
 // into the Pod's container.
-GitRepoVolumeSource: {
+GitRepoVolumeSource :: {
 	// Repository URL
 	repository: string @go(Repository) @protobuf(1,bytes,opt)
 
@@ -1214,7 +1227,7 @@
 // The contents of the target Secret's Data field will be presented in a volume
 // as files using the keys in the Data field as the file names.
 // Secret volumes support ownership management and SELinux relabeling.
-SecretVolumeSource: {
+SecretVolumeSource :: {
 	// Name of the secret in the pod's namespace to use.
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
 	// +optional
@@ -1243,7 +1256,7 @@
 	optional?: null | bool @go(Optional,*bool) @protobuf(4,varint,opt)
 }
 
-SecretVolumeSourceDefaultMode: int32 & 0o644
+SecretVolumeSourceDefaultMode :: int32 & 0o644
 
 // Adapts a secret into a projected volume.
 //
@@ -1251,7 +1264,9 @@
 // projected volume as files using the keys in the Data field as the file names.
 // Note that this is identical to a secret volume source without the default
 // mode.
-SecretProjection: LocalObjectReference & {
+SecretProjection :: {
+	(LocalObjectReference)
+
 	// If unspecified, each key-value pair in the Data field of the referenced
 	// Secret will be projected into the volume as a file whose name is the
 	// key and content is the value. If specified, the listed keys will be
@@ -1269,7 +1284,7 @@
 
 // Represents an NFS mount that lasts the lifetime of a pod.
 // NFS volumes do not support ownership management or SELinux relabeling.
-NFSVolumeSource: {
+NFSVolumeSource :: {
 	// Server is the hostname or IP address of the NFS server.
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
 	server: string @go(Server) @protobuf(1,bytes,opt)
@@ -1289,7 +1304,7 @@
 // Represents an ISCSI disk.
 // ISCSI volumes can only be mounted as read/write once.
 // ISCSI volumes support ownership management and SELinux relabeling.
-ISCSIVolumeSource: {
+ISCSIVolumeSource :: {
 	// iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port
 	// is other than default (typically TCP ports 860 and 3260).
 	targetPortal: string @go(TargetPortal) @protobuf(1,bytes,opt)
@@ -1345,7 +1360,7 @@
 // ISCSIPersistentVolumeSource represents an ISCSI disk.
 // ISCSI volumes can only be mounted as read/write once.
 // ISCSI volumes support ownership management and SELinux relabeling.
-ISCSIPersistentVolumeSource: {
+ISCSIPersistentVolumeSource :: {
 	// iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port
 	// is other than default (typically TCP ports 860 and 3260).
 	targetPortal: string @go(TargetPortal) @protobuf(1,bytes,opt)
@@ -1401,7 +1416,7 @@
 // Represents a Fibre Channel volume.
 // Fibre Channel volumes can only be mounted as read/write once.
 // Fibre Channel volumes support ownership management and SELinux relabeling.
-FCVolumeSource: {
+FCVolumeSource :: {
 	// Optional: FC target worldwide names (WWNs)
 	// +optional
 	targetWWNs?: [...string] @go(TargetWWNs,[]string) @protobuf(1,bytes,rep)
@@ -1429,7 +1444,7 @@
 }
 
 // AzureFile represents an Azure File Service mount on the host and bind mount to the pod.
-AzureFileVolumeSource: {
+AzureFileVolumeSource :: {
 	// the name of secret that contains Azure Storage Account Name and Key
 	secretName: string @go(SecretName) @protobuf(1,bytes,opt)
 
@@ -1443,7 +1458,7 @@
 }
 
 // AzureFile represents an Azure File Service mount on the host and bind mount to the pod.
-AzureFilePersistentVolumeSource: {
+AzureFilePersistentVolumeSource :: {
 	// the name of secret that contains Azure Storage Account Name and Key
 	secretName: string @go(SecretName) @protobuf(1,bytes,opt)
 
@@ -1462,7 +1477,7 @@
 }
 
 // Represents a vSphere volume resource.
-VsphereVirtualDiskVolumeSource: {
+VsphereVirtualDiskVolumeSource :: {
 	// Path that identifies vSphere volume vmdk
 	volumePath: string @go(VolumePath) @protobuf(1,bytes,opt)
 
@@ -1482,7 +1497,7 @@
 }
 
 // Represents a Photon Controller persistent disk resource.
-PhotonPersistentDiskVolumeSource: {
+PhotonPersistentDiskVolumeSource :: {
 	// ID that identifies Photon Controller persistent disk
 	pdID: string @go(PdID) @protobuf(1,bytes,opt)
 
@@ -1492,29 +1507,29 @@
 	fsType?: string @go(FSType) @protobuf(2,bytes,opt)
 }
 
-AzureDataDiskCachingMode: string // enumAzureDataDiskCachingMode
+AzureDataDiskCachingMode :: string // enumAzureDataDiskCachingMode
 
-enumAzureDataDiskCachingMode:
+enumAzureDataDiskCachingMode ::
 	AzureDataDiskCachingNone |
 	AzureDataDiskCachingReadOnly |
 	AzureDataDiskCachingReadWrite
 
-AzureDataDiskKind: string // enumAzureDataDiskKind
+AzureDataDiskKind :: string // enumAzureDataDiskKind
 
-enumAzureDataDiskKind:
+enumAzureDataDiskKind ::
 	AzureSharedBlobDisk |
 	AzureDedicatedBlobDisk |
 	AzureManagedDisk
 
-AzureDataDiskCachingNone:      AzureDataDiskCachingMode & "None"
-AzureDataDiskCachingReadOnly:  AzureDataDiskCachingMode & "ReadOnly"
-AzureDataDiskCachingReadWrite: AzureDataDiskCachingMode & "ReadWrite"
-AzureSharedBlobDisk:           AzureDataDiskKind & "Shared"
-AzureDedicatedBlobDisk:        AzureDataDiskKind & "Dedicated"
-AzureManagedDisk:              AzureDataDiskKind & "Managed"
+AzureDataDiskCachingNone ::      AzureDataDiskCachingMode & "None"
+AzureDataDiskCachingReadOnly ::  AzureDataDiskCachingMode & "ReadOnly"
+AzureDataDiskCachingReadWrite :: AzureDataDiskCachingMode & "ReadWrite"
+AzureSharedBlobDisk ::           AzureDataDiskKind & "Shared"
+AzureDedicatedBlobDisk ::        AzureDataDiskKind & "Dedicated"
+AzureManagedDisk ::              AzureDataDiskKind & "Managed"
 
 // AzureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.
-AzureDiskVolumeSource: {
+AzureDiskVolumeSource :: {
 	// The Name of the data disk in the blob storage
 	diskName: string @go(DiskName) @protobuf(1,bytes,opt)
 
@@ -1541,7 +1556,7 @@
 }
 
 // PortworxVolumeSource represents a Portworx volume resource.
-PortworxVolumeSource: {
+PortworxVolumeSource :: {
 	// VolumeID uniquely identifies a Portworx volume
 	volumeID: string @go(VolumeID) @protobuf(1,bytes,opt)
 
@@ -1557,7 +1572,7 @@
 }
 
 // ScaleIOVolumeSource represents a persistent ScaleIO volume
-ScaleIOVolumeSource: {
+ScaleIOVolumeSource :: {
 	// The host address of the ScaleIO API Gateway.
 	gateway: string @go(Gateway) @protobuf(1,bytes,opt)
 
@@ -1603,7 +1618,7 @@
 }
 
 // ScaleIOPersistentVolumeSource represents a persistent ScaleIO volume
-ScaleIOPersistentVolumeSource: {
+ScaleIOPersistentVolumeSource :: {
 	// The host address of the ScaleIO API Gateway.
 	gateway: string @go(Gateway) @protobuf(1,bytes,opt)
 
@@ -1649,7 +1664,7 @@
 }
 
 // Represents a StorageOS persistent volume resource.
-StorageOSVolumeSource: {
+StorageOSVolumeSource :: {
 	// VolumeName is the human-readable name of the StorageOS volume.  Volume
 	// names are only unique within a namespace.
 	volumeName?: string @go(VolumeName) @protobuf(1,bytes,opt)
@@ -1681,7 +1696,7 @@
 }
 
 // Represents a StorageOS persistent volume resource.
-StorageOSPersistentVolumeSource: {
+StorageOSPersistentVolumeSource :: {
 	// VolumeName is the human-readable name of the StorageOS volume.  Volume
 	// names are only unique within a namespace.
 	volumeName?: string @go(VolumeName) @protobuf(1,bytes,opt)
@@ -1718,7 +1733,9 @@
 // volume as files using the keys in the Data field as the file names, unless
 // the items element is populated with specific mappings of keys to paths.
 // ConfigMap volumes support ownership management and SELinux relabeling.
-ConfigMapVolumeSource: LocalObjectReference & {
+ConfigMapVolumeSource :: {
+	(LocalObjectReference)
+
 	// If unspecified, each key-value pair in the Data field of the referenced
 	// ConfigMap will be projected into the volume as a file whose name is the
 	// key and content is the value. If specified, the listed keys will be
@@ -1742,7 +1759,7 @@
 	optional?: null | bool @go(Optional,*bool) @protobuf(4,varint,opt)
 }
 
-ConfigMapVolumeSourceDefaultMode: int32 & 0o644
+ConfigMapVolumeSourceDefaultMode :: int32 & 0o644
 
 // Adapts a ConfigMap into a projected volume.
 //
@@ -1751,7 +1768,9 @@
 // unless the items element is populated with specific mappings of keys to paths.
 // Note that this is identical to a configmap volume source without the default
 // mode.
-ConfigMapProjection: LocalObjectReference & {
+ConfigMapProjection :: {
+	(LocalObjectReference)
+
 	// If unspecified, each key-value pair in the Data field of the referenced
 	// ConfigMap will be projected into the volume as a file whose name is the
 	// key and content is the value. If specified, the listed keys will be
@@ -1771,7 +1790,7 @@
 // volume. This projection can be used to insert a service account token into
 // the pods runtime filesystem for use against APIs (Kubernetes API Server or
 // otherwise).
-ServiceAccountTokenProjection: {
+ServiceAccountTokenProjection :: {
 	// Audience is the intended audience of the token. A recipient of a token
 	// must identify itself with an identifier specified in the audience of the
 	// token, and otherwise should reject the token. The audience defaults to the
@@ -1794,7 +1813,7 @@
 }
 
 // Represents a projected volume source
-ProjectedVolumeSource: {
+ProjectedVolumeSource :: {
 	// list of volume projections
 	sources: [...VolumeProjection] @go(Sources,[]VolumeProjection) @protobuf(1,bytes,rep)
 
@@ -1808,7 +1827,7 @@
 }
 
 // Projection that may be projected along with other supported volume types
-VolumeProjection: {
+VolumeProjection :: {
 	// information about the secret data to project
 	// +optional
 	secret?: null | SecretProjection @go(Secret,*SecretProjection) @protobuf(1,bytes,opt)
@@ -1826,10 +1845,10 @@
 	serviceAccountToken?: null | ServiceAccountTokenProjection @go(ServiceAccountToken,*ServiceAccountTokenProjection) @protobuf(4,bytes,opt)
 }
 
-ProjectedVolumeSourceDefaultMode: int32 & 0o644
+ProjectedVolumeSourceDefaultMode :: int32 & 0o644
 
 // Maps a string key to a path within a volume.
-KeyToPath: {
+KeyToPath :: {
 	// The key to project.
 	key: string @go(Key) @protobuf(1,bytes,opt)
 
@@ -1848,7 +1867,7 @@
 }
 
 // Local represents directly-attached storage with node affinity (Beta feature)
-LocalVolumeSource: {
+LocalVolumeSource :: {
 	// The full path to the volume on the node.
 	// It can be either a directory or block device (disk, partition, ...).
 	path: string @go(Path) @protobuf(1,bytes,opt)
@@ -1862,7 +1881,7 @@
 }
 
 // Represents storage that is managed by an external CSI volume driver (Beta feature)
-CSIPersistentVolumeSource: {
+CSIPersistentVolumeSource :: {
 	// Driver is the name of the driver to use for this volume.
 	// Required.
 	driver: string @go(Driver) @protobuf(1,bytes,opt)
@@ -1922,7 +1941,7 @@
 }
 
 // Represents a source location of a volume to mount, managed by an external CSI driver
-CSIVolumeSource: {
+CSIVolumeSource :: {
 	// Driver is the name of the CSI driver that handles this volume.
 	// Consult with your admin for the correct name as registered in the cluster.
 	driver: string @go(Driver) @protobuf(1,bytes,opt)
@@ -1953,7 +1972,7 @@
 }
 
 // ContainerPort represents a network port in a single container.
-ContainerPort: {
+ContainerPort :: {
 	// If specified, this must be an IANA_SVC_NAME and unique within the pod. Each
 	// named port in a pod must have a unique name. Name for the port that can be
 	// referred to by services.
@@ -1982,7 +2001,7 @@
 }
 
 // VolumeMount describes a mounting of a Volume within a container.
-VolumeMount: {
+VolumeMount :: {
 	// This must match the Name of a Volume.
 	name: string @go(Name) @protobuf(1,bytes,opt)
 
@@ -2017,9 +2036,9 @@
 }
 
 // MountPropagationMode describes mount propagation.
-MountPropagationMode: string // enumMountPropagationMode
+MountPropagationMode :: string // enumMountPropagationMode
 
-enumMountPropagationMode:
+enumMountPropagationMode ::
 	MountPropagationNone |
 	MountPropagationHostToContainer |
 	MountPropagationBidirectional
@@ -2029,7 +2048,7 @@
 // mounted inside the container won't be propagated to the host or other
 // containers.
 // Note that this mode corresponds to "private" in Linux terminology.
-MountPropagationNone: MountPropagationMode & "None"
+MountPropagationNone :: MountPropagationMode & "None"
 
 // MountPropagationHostToContainer means that the volume in a container will
 // receive new mounts from the host or other containers, but filesystems
@@ -2037,17 +2056,17 @@
 // containers.
 // Note that this mode is recursively applied to all mounts in the volume
 // ("rslave" in Linux terminology).
-MountPropagationHostToContainer: MountPropagationMode & "HostToContainer"
+MountPropagationHostToContainer :: MountPropagationMode & "HostToContainer"
 
 // MountPropagationBidirectional means that the volume in a container will
 // receive new mounts from the host or other containers, and its own mounts
 // will be propagated from the container to the host or other containers.
 // Note that this mode is recursively applied to all mounts in the volume
 // ("rshared" in Linux terminology).
-MountPropagationBidirectional: MountPropagationMode & "Bidirectional"
+MountPropagationBidirectional :: MountPropagationMode & "Bidirectional"
 
 // volumeDevice describes a mapping of a raw block device within a container.
-VolumeDevice: {
+VolumeDevice :: {
 	// name must match the name of a persistentVolumeClaim in the pod
 	name: string @go(Name) @protobuf(1,bytes,opt)
 
@@ -2056,7 +2075,7 @@
 }
 
 // EnvVar represents an environment variable present in a Container.
-EnvVar: {
+EnvVar :: {
 	// Name of the environment variable. Must be a C_IDENTIFIER.
 	name: string @go(Name) @protobuf(1,bytes,opt)
 
@@ -2077,7 +2096,7 @@
 }
 
 // EnvVarSource represents a source for the value of an EnvVar.
-EnvVarSource: {
+EnvVarSource :: {
 	// Selects a field of the pod: supports metadata.name, metadata.namespace, metadata.labels, metadata.annotations,
 	// spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP.
 	// +optional
@@ -2098,7 +2117,7 @@
 }
 
 // ObjectFieldSelector selects an APIVersioned field of an object.
-ObjectFieldSelector: {
+ObjectFieldSelector :: {
 	// Version of the schema the FieldPath is written in terms of, defaults to "v1".
 	// +optional
 	apiVersion?: string @go(APIVersion) @protobuf(1,bytes,opt)
@@ -2108,7 +2127,7 @@
 }
 
 // ResourceFieldSelector represents container resources (cpu, memory) and their output format
-ResourceFieldSelector: {
+ResourceFieldSelector :: {
 	// Container name: required for volumes, optional for env vars
 	// +optional
 	containerName?: string @go(ContainerName) @protobuf(1,bytes,opt)
@@ -2122,7 +2141,9 @@
 }
 
 // Selects a key from a ConfigMap.
-ConfigMapKeySelector: LocalObjectReference & {
+ConfigMapKeySelector :: {
+	(LocalObjectReference)
+
 	// The key to select.
 	key: string @go(Key) @protobuf(2,bytes,opt)
 
@@ -2132,7 +2153,9 @@
 }
 
 // SecretKeySelector selects a key of a Secret.
-SecretKeySelector: LocalObjectReference & {
+SecretKeySelector :: {
+	(LocalObjectReference)
+
 	// The key of the secret to select from.  Must be a valid secret key.
 	key: string @go(Key) @protobuf(2,bytes,opt)
 
@@ -2142,7 +2165,7 @@
 }
 
 // EnvFromSource represents the source of a set of ConfigMaps
-EnvFromSource: {
+EnvFromSource :: {
 	// An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
 	// +optional
 	prefix?: string @go(Prefix) @protobuf(1,bytes,opt)
@@ -2161,7 +2184,9 @@
 //
 // The contents of the target ConfigMap's Data field will represent the
 // key-value pairs as environment variables.
-ConfigMapEnvSource: LocalObjectReference & {
+ConfigMapEnvSource :: {
+	(LocalObjectReference)
+
 	// Specify whether the ConfigMap must be defined
 	// +optional
 	optional?: null | bool @go(Optional,*bool) @protobuf(2,varint,opt)
@@ -2172,14 +2197,16 @@
 //
 // The contents of the target Secret's Data field will represent the
 // key-value pairs as environment variables.
-SecretEnvSource: LocalObjectReference & {
+SecretEnvSource :: {
+	(LocalObjectReference)
+
 	// Specify whether the Secret must be defined
 	// +optional
 	optional?: null | bool @go(Optional,*bool) @protobuf(2,varint,opt)
 }
 
 // HTTPHeader describes a custom header to be used in HTTP probes
-HTTPHeader: {
+HTTPHeader :: {
 	// The header field name
 	name: string @go(Name) @protobuf(1,bytes,opt)
 
@@ -2188,7 +2215,7 @@
 }
 
 // HTTPGetAction describes an action based on HTTP Get requests.
-HTTPGetAction: {
+HTTPGetAction :: {
 	// Path to access on the HTTP server.
 	// +optional
 	path?: string @go(Path) @protobuf(1,bytes,opt)
@@ -2214,20 +2241,20 @@
 }
 
 // URIScheme identifies the scheme used for connection to a host for Get actions
-URIScheme: string // enumURIScheme
+URIScheme :: string // enumURIScheme
 
-enumURIScheme:
+enumURIScheme ::
 	URISchemeHTTP |
 	URISchemeHTTPS
 
 // URISchemeHTTP means that the scheme used will be http://
-URISchemeHTTP: URIScheme & "HTTP"
+URISchemeHTTP :: URIScheme & "HTTP"
 
 // URISchemeHTTPS means that the scheme used will be https://
-URISchemeHTTPS: URIScheme & "HTTPS"
+URISchemeHTTPS :: URIScheme & "HTTPS"
 
 // TCPSocketAction describes an action based on opening a socket
-TCPSocketAction: {
+TCPSocketAction :: {
 	// Number or name of the port to access on the container.
 	// Number must be in the range 1 to 65535.
 	// Name must be an IANA_SVC_NAME.
@@ -2239,7 +2266,7 @@
 }
 
 // ExecAction describes a "run in container" action.
-ExecAction: {
+ExecAction :: {
 	// Command is the command line to execute inside the container, the working directory for the
 	// command  is root ('/') in the container's filesystem. The command is simply exec'd, it is
 	// not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use
@@ -2251,7 +2278,9 @@
 
 // Probe describes a health check to be performed against a container to determine whether it is
 // alive or ready to receive traffic.
-Probe: Handler & {
+Probe :: {
+	(Handler)
+
 	// Number of seconds after the container has started before liveness probes are initiated.
 	// More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
 	// +optional
@@ -2280,56 +2309,56 @@
 }
 
 // PullPolicy describes a policy for if/when to pull a container image
-PullPolicy: string // enumPullPolicy
+PullPolicy :: string // enumPullPolicy
 
-enumPullPolicy:
+enumPullPolicy ::
 	PullAlways |
 	PullNever |
 	PullIfNotPresent
 
 // PullAlways means that kubelet always attempts to pull the latest image. Container will fail If the pull fails.
-PullAlways: PullPolicy & "Always"
+PullAlways :: PullPolicy & "Always"
 
 // PullNever means that kubelet never pulls an image, but only uses a local image. Container will fail if the image isn't present
-PullNever: PullPolicy & "Never"
+PullNever :: PullPolicy & "Never"
 
 // PullIfNotPresent means that kubelet pulls if the image isn't present on disk. Container will fail if the image isn't present and the pull fails.
-PullIfNotPresent: PullPolicy & "IfNotPresent"
+PullIfNotPresent :: PullPolicy & "IfNotPresent"
 
 // PreemptionPolicy describes a policy for if/when to preempt a pod.
-PreemptionPolicy: string // enumPreemptionPolicy
+PreemptionPolicy :: string // enumPreemptionPolicy
 
-enumPreemptionPolicy:
+enumPreemptionPolicy ::
 	PreemptLowerPriority |
 	PreemptNever
 
 // PreemptLowerPriority means that pod can preempt other pods with lower priority.
-PreemptLowerPriority: PreemptionPolicy & "PreemptLowerPriority"
+PreemptLowerPriority :: PreemptionPolicy & "PreemptLowerPriority"
 
 // PreemptNever means that pod never preempts other pods with lower priority.
-PreemptNever: PreemptionPolicy & "Never"
+PreemptNever :: PreemptionPolicy & "Never"
 
 // TerminationMessagePolicy describes how termination messages are retrieved from a container.
-TerminationMessagePolicy: string // enumTerminationMessagePolicy
+TerminationMessagePolicy :: string // enumTerminationMessagePolicy
 
-enumTerminationMessagePolicy:
+enumTerminationMessagePolicy ::
 	TerminationMessageReadFile |
 	TerminationMessageFallbackToLogsOnError
 
 // TerminationMessageReadFile is the default behavior and will set the container status message to
 // the contents of the container's terminationMessagePath when the container exits.
-TerminationMessageReadFile: TerminationMessagePolicy & "File"
+TerminationMessageReadFile :: TerminationMessagePolicy & "File"
 
 // TerminationMessageFallbackToLogsOnError will read the most recent contents of the container logs
 // for the container status message when the container exits with an error and the
 // terminationMessagePath has no contents.
-TerminationMessageFallbackToLogsOnError: TerminationMessagePolicy & "FallbackToLogsOnError"
+TerminationMessageFallbackToLogsOnError :: TerminationMessagePolicy & "FallbackToLogsOnError"
 
 // Capability represent POSIX capabilities type
-Capability: string
+Capability :: string
 
 // Adds and removes POSIX capabilities from running containers.
-Capabilities: {
+Capabilities :: {
 	// Added capabilities
 	// +optional
 	add?: [...Capability] @go(Add,[]Capability) @protobuf(1,bytes,rep,casttype=Capability)
@@ -2340,7 +2369,7 @@
 }
 
 // ResourceRequirements describes the compute resource requirements.
-ResourceRequirements: {
+ResourceRequirements :: {
 	// Limits describes the maximum amount of compute resources allowed.
 	// More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
 	// +optional
@@ -2355,10 +2384,10 @@
 }
 
 // TerminationMessagePathDefault means the default path to capture the application termination message running in a container
-TerminationMessagePathDefault: "/dev/termination-log"
+TerminationMessagePathDefault :: "/dev/termination-log"
 
 // A single application container that you want to run within a pod.
-Container: {
+Container :: {
 	// Name of the container specified as a DNS_LABEL.
 	// Each container in a pod must have a unique name (DNS_LABEL).
 	// Cannot be updated.
@@ -2539,7 +2568,7 @@
 
 // Handler defines a specific action that should be taken
 // TODO: pass structured data to these actions, and document that data here.
-Handler: {
+Handler :: {
 	// One and only one of the following should be specified.
 	// Exec specifies the action to take.
 	// +optional
@@ -2559,7 +2588,7 @@
 // Lifecycle describes actions that the management system should take in response to container lifecycle
 // events. For the PostStart and PreStop lifecycle handlers, management of the container blocks
 // until the action is complete, unless the container process fails, in which case the handler is aborted.
-Lifecycle: {
+Lifecycle :: {
 	// PostStart is called immediately after a container is created. If the handler fails,
 	// the container is terminated and restarted according to its restart policy.
 	// Other management of the container blocks until the hook completes.
@@ -2581,19 +2610,19 @@
 	preStop?: null | Handler @go(PreStop,*Handler) @protobuf(2,bytes,opt)
 }
 
-ConditionStatus: string // enumConditionStatus
+ConditionStatus :: string // enumConditionStatus
 
-enumConditionStatus:
+enumConditionStatus ::
 	ConditionTrue |
 	ConditionFalse |
 	ConditionUnknown
 
-ConditionTrue:    ConditionStatus & "True"
-ConditionFalse:   ConditionStatus & "False"
-ConditionUnknown: ConditionStatus & "Unknown"
+ConditionTrue ::    ConditionStatus & "True"
+ConditionFalse ::   ConditionStatus & "False"
+ConditionUnknown :: ConditionStatus & "Unknown"
 
 // ContainerStateWaiting is a waiting state of a container.
-ContainerStateWaiting: {
+ContainerStateWaiting :: {
 	// (brief) reason the container is not yet running.
 	// +optional
 	reason?: string @go(Reason) @protobuf(1,bytes,opt)
@@ -2604,14 +2633,14 @@
 }
 
 // ContainerStateRunning is a running state of a container.
-ContainerStateRunning: {
+ContainerStateRunning :: {
 	// Time at which the container was last (re-)started
 	// +optional
 	startedAt?: metav1.Time @go(StartedAt) @protobuf(1,bytes,opt)
 }
 
 // ContainerStateTerminated is a terminated state of a container.
-ContainerStateTerminated: {
+ContainerStateTerminated :: {
 	// Exit status from the last termination of the container
 	exitCode: int32 @go(ExitCode) @protobuf(1,varint,opt)
 
@@ -2643,7 +2672,7 @@
 // ContainerState holds a possible state of container.
 // Only one of its members may be specified.
 // If none of them is specified, the default one is ContainerStateWaiting.
-ContainerState: {
+ContainerState :: {
 	// Details about a waiting container
 	// +optional
 	waiting?: null | ContainerStateWaiting @go(Waiting,*ContainerStateWaiting) @protobuf(1,bytes,opt)
@@ -2658,7 +2687,7 @@
 }
 
 // ContainerStatus contains details for the current status of this container.
-ContainerStatus: {
+ContainerStatus :: {
 	// This must be a DNS_LABEL. Each container in a pod must have a unique name.
 	// Cannot be updated.
 	name: string @go(Name) @protobuf(1,bytes,opt)
@@ -2701,9 +2730,9 @@
 }
 
 // PodPhase is a label for the condition of a pod at the current time.
-PodPhase: string // enumPodPhase
+PodPhase :: string // enumPodPhase
 
-enumPodPhase:
+enumPodPhase ::
 	PodPending |
 	PodRunning |
 	PodSucceeded |
@@ -2713,52 +2742,52 @@
 // PodPending means the pod has been accepted by the system, but one or more of the containers
 // has not been started. This includes time before being bound to a node, as well as time spent
 // pulling images onto the host.
-PodPending: PodPhase & "Pending"
+PodPending :: PodPhase & "Pending"
 
 // PodRunning means the pod has been bound to a node and all of the containers have been started.
 // At least one container is still running or is in the process of being restarted.
-PodRunning: PodPhase & "Running"
+PodRunning :: PodPhase & "Running"
 
 // PodSucceeded means that all containers in the pod have voluntarily terminated
 // with a container exit code of 0, and the system is not going to restart any of these containers.
-PodSucceeded: PodPhase & "Succeeded"
+PodSucceeded :: PodPhase & "Succeeded"
 
 // PodFailed means that all containers in the pod have terminated, and at least one container has
 // terminated in a failure (exited with a non-zero exit code or was stopped by the system).
-PodFailed: PodPhase & "Failed"
+PodFailed :: PodPhase & "Failed"
 
 // PodUnknown means that for some reason the state of the pod could not be obtained, typically due
 // to an error in communicating with the host of the pod.
-PodUnknown: PodPhase & "Unknown"
+PodUnknown :: PodPhase & "Unknown"
 
 // PodConditionType is a valid value for PodCondition.Type
-PodConditionType: string // enumPodConditionType
+PodConditionType :: string // enumPodConditionType
 
-enumPodConditionType:
+enumPodConditionType ::
 	ContainersReady |
 	PodInitialized |
 	PodReady |
 	PodScheduled
 
 // ContainersReady indicates whether all containers in the pod are ready.
-ContainersReady: PodConditionType & "ContainersReady"
+ContainersReady :: PodConditionType & "ContainersReady"
 
 // PodInitialized means that all init containers in the pod have started successfully.
-PodInitialized: PodConditionType & "Initialized"
+PodInitialized :: PodConditionType & "Initialized"
 
 // PodReady means the pod is able to service requests and should be added to the
 // load balancing pools of all matching services.
-PodReady: PodConditionType & "Ready"
+PodReady :: PodConditionType & "Ready"
 
 // PodScheduled represents status of the scheduling process for this pod.
-PodScheduled: PodConditionType & "PodScheduled"
+PodScheduled :: PodConditionType & "PodScheduled"
 
 // PodReasonUnschedulable reason in PodScheduled PodCondition means that the scheduler
 // can't schedule the pod right now, for example due to insufficient resources in the cluster.
-PodReasonUnschedulable: "Unschedulable"
+PodReasonUnschedulable :: "Unschedulable"
 
 // PodCondition contains details for the current condition of this pod.
-PodCondition: {
+PodCondition :: {
 	// Type is the type of the condition.
 	// More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-conditions
 	type: PodConditionType @go(Type) @protobuf(1,bytes,opt,casttype=PodConditionType)
@@ -2789,21 +2818,21 @@
 // Only one of the following restart policies may be specified.
 // If none of the following policies is specified, the default one
 // is RestartPolicyAlways.
-RestartPolicy: string // enumRestartPolicy
+RestartPolicy :: string // enumRestartPolicy
 
-enumRestartPolicy:
+enumRestartPolicy ::
 	RestartPolicyAlways |
 	RestartPolicyOnFailure |
 	RestartPolicyNever
 
-RestartPolicyAlways:    RestartPolicy & "Always"
-RestartPolicyOnFailure: RestartPolicy & "OnFailure"
-RestartPolicyNever:     RestartPolicy & "Never"
+RestartPolicyAlways ::    RestartPolicy & "Always"
+RestartPolicyOnFailure :: RestartPolicy & "OnFailure"
+RestartPolicyNever ::     RestartPolicy & "Never"
 
 // DNSPolicy defines how a pod's DNS will be configured.
-DNSPolicy: string // enumDNSPolicy
+DNSPolicy :: string // enumDNSPolicy
 
-enumDNSPolicy:
+enumDNSPolicy ::
 	DNSClusterFirstWithHostNet |
 	DNSClusterFirst |
 	DNSDefault |
@@ -2812,30 +2841,30 @@
 // DNSClusterFirstWithHostNet indicates that the pod should use cluster DNS
 // first, if it is available, then fall back on the default
 // (as determined by kubelet) DNS settings.
-DNSClusterFirstWithHostNet: DNSPolicy & "ClusterFirstWithHostNet"
+DNSClusterFirstWithHostNet :: DNSPolicy & "ClusterFirstWithHostNet"
 
 // DNSClusterFirst indicates that the pod should use cluster DNS
 // first unless hostNetwork is true, if it is available, then
 // fall back on the default (as determined by kubelet) DNS settings.
-DNSClusterFirst: DNSPolicy & "ClusterFirst"
+DNSClusterFirst :: DNSPolicy & "ClusterFirst"
 
 // DNSDefault indicates that the pod should use the default (as
 // determined by kubelet) DNS settings.
-DNSDefault: DNSPolicy & "Default"
+DNSDefault :: DNSPolicy & "Default"
 
 // DNSNone indicates that the pod should use empty DNS settings. DNS
 // parameters such as nameservers and search paths should be defined via
 // DNSConfig.
-DNSNone: DNSPolicy & "None"
+DNSNone :: DNSPolicy & "None"
 
 // DefaultTerminationGracePeriodSeconds indicates the default duration in
 // seconds a pod needs to terminate gracefully.
-DefaultTerminationGracePeriodSeconds: 30
+DefaultTerminationGracePeriodSeconds :: 30
 
 // A node selector represents the union of the results of one or more label queries
 // over a set of nodes; that is, it represents the OR of the selectors represented
 // by the node selector terms.
-NodeSelector: {
+NodeSelector :: {
 	//Required. A list of node selector terms. The terms are ORed.
 	nodeSelectorTerms: [...NodeSelectorTerm] @go(NodeSelectorTerms,[]NodeSelectorTerm) @protobuf(1,bytes,rep)
 }
@@ -2843,7 +2872,7 @@
 // A null or empty node selector term matches no objects. The requirements of
 // them are ANDed.
 // The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.
-NodeSelectorTerm: {
+NodeSelectorTerm :: {
 	// A list of node selector requirements by node's labels.
 	// +optional
 	matchExpressions?: [...NodeSelectorRequirement] @go(MatchExpressions,[]NodeSelectorRequirement) @protobuf(1,bytes,rep)
@@ -2855,7 +2884,7 @@
 
 // A node selector requirement is a selector that contains values, a key, and an operator
 // that relates the key and values.
-NodeSelectorRequirement: {
+NodeSelectorRequirement :: {
 	// The label key that the selector applies to.
 	key: string @go(Key) @protobuf(1,bytes,opt)
 
@@ -2874,9 +2903,9 @@
 
 // A node selector operator is the set of operators that can be used in
 // a node selector requirement.
-NodeSelectorOperator: string // enumNodeSelectorOperator
+NodeSelectorOperator :: string // enumNodeSelectorOperator
 
-enumNodeSelectorOperator:
+enumNodeSelectorOperator ::
 	NodeSelectorOpIn |
 	NodeSelectorOpNotIn |
 	NodeSelectorOpExists |
@@ -2884,19 +2913,19 @@
 	NodeSelectorOpGt |
 	NodeSelectorOpLt
 
-NodeSelectorOpIn:           NodeSelectorOperator & "In"
-NodeSelectorOpNotIn:        NodeSelectorOperator & "NotIn"
-NodeSelectorOpExists:       NodeSelectorOperator & "Exists"
-NodeSelectorOpDoesNotExist: NodeSelectorOperator & "DoesNotExist"
-NodeSelectorOpGt:           NodeSelectorOperator & "Gt"
-NodeSelectorOpLt:           NodeSelectorOperator & "Lt"
+NodeSelectorOpIn ::           NodeSelectorOperator & "In"
+NodeSelectorOpNotIn ::        NodeSelectorOperator & "NotIn"
+NodeSelectorOpExists ::       NodeSelectorOperator & "Exists"
+NodeSelectorOpDoesNotExist :: NodeSelectorOperator & "DoesNotExist"
+NodeSelectorOpGt ::           NodeSelectorOperator & "Gt"
+NodeSelectorOpLt ::           NodeSelectorOperator & "Lt"
 
 // A topology selector term represents the result of label queries.
 // A null or empty topology selector term matches no objects.
 // The requirements of them are ANDed.
 // It provides a subset of functionality as NodeSelectorTerm.
 // This is an alpha feature and may change in the future.
-TopologySelectorTerm: {
+TopologySelectorTerm :: {
 	// A list of topology selector requirements by labels.
 	// +optional
 	matchLabelExpressions?: [...TopologySelectorLabelRequirement] @go(MatchLabelExpressions,[]TopologySelectorLabelRequirement) @protobuf(1,bytes,rep)
@@ -2904,7 +2933,7 @@
 
 // A topology selector requirement is a selector that matches given label.
 // This is an alpha feature and may change in the future.
-TopologySelectorLabelRequirement: {
+TopologySelectorLabelRequirement :: {
 	// The label key that the selector applies to.
 	key: string @go(Key) @protobuf(1,bytes,opt)
 
@@ -2914,7 +2943,7 @@
 }
 
 // Affinity is a group of affinity scheduling rules.
-Affinity: {
+Affinity :: {
 	// Describes node affinity scheduling rules for the pod.
 	// +optional
 	nodeAffinity?: null | NodeAffinity @go(NodeAffinity,*NodeAffinity) @protobuf(1,bytes,opt)
@@ -2929,7 +2958,7 @@
 }
 
 // Pod affinity is a group of inter pod affinity scheduling rules.
-PodAffinity: {
+PodAffinity :: {
 	// If the affinity requirements specified by this field are not met at
 	// scheduling time, the pod will not be scheduled onto the node.
 	// If the affinity requirements specified by this field cease to be met
@@ -2954,7 +2983,7 @@
 }
 
 // Pod anti affinity is a group of inter pod anti affinity scheduling rules.
-PodAntiAffinity: {
+PodAntiAffinity :: {
 	// If the anti-affinity requirements specified by this field are not met at
 	// scheduling time, the pod will not be scheduled onto the node.
 	// If the anti-affinity requirements specified by this field cease to be met
@@ -2979,7 +3008,7 @@
 }
 
 // The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)
-WeightedPodAffinityTerm: {
+WeightedPodAffinityTerm :: {
 	// weight associated with matching the corresponding podAffinityTerm,
 	// in the range 1-100.
 	weight: int32 @go(Weight) @protobuf(1,varint,opt)
@@ -2994,7 +3023,7 @@
 // where co-located is defined as running on a node whose value of
 // the label with key <topologyKey> matches that of any node on which
 // a pod of the set of pods is running
-PodAffinityTerm: {
+PodAffinityTerm :: {
 	// A label query over a set of resources, in this case pods.
 	// +optional
 	labelSelector?: null | metav1.LabelSelector @go(LabelSelector,*metav1.LabelSelector) @protobuf(1,bytes,opt)
@@ -3013,7 +3042,7 @@
 }
 
 // Node affinity is a group of node affinity scheduling rules.
-NodeAffinity: {
+NodeAffinity :: {
 	// If the affinity requirements specified by this field are not met at
 	// scheduling time, the pod will not be scheduled onto the node.
 	// If the affinity requirements specified by this field cease to be met
@@ -3037,7 +3066,7 @@
 
 // An empty preferred scheduling term matches all objects with implicit weight 0
 // (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
-PreferredSchedulingTerm: {
+PreferredSchedulingTerm :: {
 	// Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
 	weight: int32 @go(Weight) @protobuf(1,varint,opt)
 
@@ -3047,7 +3076,7 @@
 
 // The node this Taint is attached to has the "effect" on
 // any pod that does not tolerate the Taint.
-Taint: {
+Taint :: {
 	// Required. The taint key to be applied to a node.
 	key: string @go(Key) @protobuf(1,bytes,opt)
 
@@ -3066,9 +3095,9 @@
 	timeAdded?: null | metav1.Time @go(TimeAdded,*metav1.Time) @protobuf(4,bytes,opt)
 }
 
-TaintEffect: string // enumTaintEffect
+TaintEffect :: string // enumTaintEffect
 
-enumTaintEffect:
+enumTaintEffect ::
 	TaintEffectNoSchedule |
 	TaintEffectPreferNoSchedule |
 	TaintEffectNoExecute
@@ -3077,20 +3106,20 @@
 // but allow all pods submitted to Kubelet without going through the scheduler
 // to start, and allow all already-running pods to continue running.
 // Enforced by the scheduler.
-TaintEffectNoSchedule: TaintEffect & "NoSchedule"
+TaintEffectNoSchedule :: TaintEffect & "NoSchedule"
 
 // Like TaintEffectNoSchedule, but the scheduler tries not to schedule
 // new pods onto the node, rather than prohibiting new pods from scheduling
 // onto the node entirely. Enforced by the scheduler.
-TaintEffectPreferNoSchedule: TaintEffect & "PreferNoSchedule"
+TaintEffectPreferNoSchedule :: TaintEffect & "PreferNoSchedule"
 
 // Evict any already-running pods that do not tolerate the taint.
 // Currently enforced by NodeController.
-TaintEffectNoExecute: TaintEffect & "NoExecute"
+TaintEffectNoExecute :: TaintEffect & "NoExecute"
 
 // The pod this Toleration is attached to tolerates any taint that matches
 // the triple <key,value,effect> using the matching operator <operator>.
-Toleration: {
+Toleration :: {
 	// Key is the taint key that the toleration applies to. Empty means match all taint keys.
 	// If the key is empty, operator must be Exists; this combination means to match all values and all keys.
 	// +optional
@@ -3122,23 +3151,23 @@
 }
 
 // A toleration operator is the set of operators that can be used in a toleration.
-TolerationOperator: string // enumTolerationOperator
+TolerationOperator :: string // enumTolerationOperator
 
-enumTolerationOperator:
+enumTolerationOperator ::
 	TolerationOpExists |
 	TolerationOpEqual
 
-TolerationOpExists: TolerationOperator & "Exists"
-TolerationOpEqual:  TolerationOperator & "Equal"
+TolerationOpExists :: TolerationOperator & "Exists"
+TolerationOpEqual ::  TolerationOperator & "Equal"
 
 // PodReadinessGate contains the reference to a pod condition
-PodReadinessGate: {
+PodReadinessGate :: {
 	// ConditionType refers to a condition in the pod's condition list with matching type.
 	conditionType: PodConditionType @go(ConditionType) @protobuf(1,bytes,opt,casttype=PodConditionType)
 }
 
 // PodSpec is a description of a pod.
-PodSpec: {
+PodSpec :: {
 	// List of volumes that can be mounted by containers belonging to the pod.
 	// More info: https://kubernetes.io/docs/concepts/storage/volumes
 	// +optional
@@ -3390,22 +3419,22 @@
 	topologySpreadConstraints?: [...TopologySpreadConstraint] @go(TopologySpreadConstraints,[]TopologySpreadConstraint) @protobuf(33,bytes,opt)
 }
 
-UnsatisfiableConstraintAction: string // enumUnsatisfiableConstraintAction
+UnsatisfiableConstraintAction :: string // enumUnsatisfiableConstraintAction
 
-enumUnsatisfiableConstraintAction:
+enumUnsatisfiableConstraintAction ::
 	DoNotSchedule |
 	ScheduleAnyway
 
 // DoNotSchedule instructs the scheduler not to schedule the pod
 // when constraints are not satisfied.
-DoNotSchedule: UnsatisfiableConstraintAction & "DoNotSchedule"
+DoNotSchedule :: UnsatisfiableConstraintAction & "DoNotSchedule"
 
 // ScheduleAnyway instructs the scheduler to schedule the pod
 // even if constraints are not satisfied.
-ScheduleAnyway: UnsatisfiableConstraintAction & "ScheduleAnyway"
+ScheduleAnyway :: UnsatisfiableConstraintAction & "ScheduleAnyway"
 
 // TopologySpreadConstraint specifies how to spread matching pods among the given topology.
-TopologySpreadConstraint: {
+TopologySpreadConstraint :: {
 	// MaxSkew describes the degree to which pods may be unevenly distributed.
 	// It's the maximum permitted difference between the number of matching pods in
 	// any two topology domains of a given topology type.
@@ -3458,11 +3487,11 @@
 }
 
 // The default value for enableServiceLinks attribute.
-DefaultEnableServiceLinks: true
+DefaultEnableServiceLinks :: true
 
 // HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the
 // pod's hosts file.
-HostAlias: {
+HostAlias :: {
 	// IP address of the host file entry.
 	ip?: string @go(IP) @protobuf(1,bytes,opt)
 
@@ -3473,7 +3502,7 @@
 // PodSecurityContext holds pod-level security attributes and common container settings.
 // Some fields are also present in container.securityContext.  Field values of
 // container.securityContext take precedence over field values of PodSecurityContext.
-PodSecurityContext: {
+PodSecurityContext :: {
 	// The SELinux context to be applied to all containers.
 	// If unspecified, the container runtime will allocate a random SELinux context for each
 	// container.  May also be set in SecurityContext.  If set in
@@ -3538,25 +3567,25 @@
 }
 
 // PodQOSClass defines the supported qos classes of Pods.
-PodQOSClass: string // enumPodQOSClass
+PodQOSClass :: string // enumPodQOSClass
 
-enumPodQOSClass:
+enumPodQOSClass ::
 	PodQOSGuaranteed |
 	PodQOSBurstable |
 	PodQOSBestEffort
 
 // PodQOSGuaranteed is the Guaranteed qos class.
-PodQOSGuaranteed: PodQOSClass & "Guaranteed"
+PodQOSGuaranteed :: PodQOSClass & "Guaranteed"
 
 // PodQOSBurstable is the Burstable qos class.
-PodQOSBurstable: PodQOSClass & "Burstable"
+PodQOSBurstable :: PodQOSClass & "Burstable"
 
 // PodQOSBestEffort is the BestEffort qos class.
-PodQOSBestEffort: PodQOSClass & "BestEffort"
+PodQOSBestEffort :: PodQOSClass & "BestEffort"
 
 // PodDNSConfig defines the DNS parameters of a pod in addition to
 // those generated from DNSPolicy.
-PodDNSConfig: {
+PodDNSConfig :: {
 	// A list of DNS name server IP addresses.
 	// This will be appended to the base nameservers generated from DNSPolicy.
 	// Duplicated nameservers will be removed.
@@ -3578,7 +3607,7 @@
 }
 
 // PodDNSConfigOption defines DNS resolver options of a pod.
-PodDNSConfigOption: {
+PodDNSConfigOption :: {
 	// Required.
 	name?: string @go(Name) @protobuf(1,bytes,opt)
 
@@ -3589,7 +3618,7 @@
 // IP address information for entries in the (plural) PodIPs field.
 // Each entry includes:
 //    IP: An IP address allocated to the pod. Routable at least within the cluster.
-PodIP: {
+PodIP :: {
 	// ip is an IP address (IPv4 or IPv6) assigned to the pod
 	ip?: string @go(IP) @protobuf(1,bytes,opt)
 }
@@ -3598,7 +3627,7 @@
 // EphemeralContainer. This separate type allows easy conversion from EphemeralContainer
 // to Container and allows separate documentation for the fields of EphemeralContainer.
 // When a new field is added to Container it must be added here as well.
-EphemeralContainerCommon: {
+EphemeralContainerCommon :: {
 	// Name of the ephemeral container specified as a DNS_LABEL.
 	// This name must be unique among all containers, init containers and ephemeral containers.
 	name: string @go(Name) @protobuf(1,bytes,opt)
@@ -3753,7 +3782,9 @@
 // via the pod's ephemeralcontainers subresource, and they will appear in the pod spec
 // once added.
 // This is an alpha feature enabled by the EphemeralContainers feature flag.
-EphemeralContainer: EphemeralContainerCommon & {
+EphemeralContainer :: {
+	(EphemeralContainerCommon)
+
 	// If set, the name of the container from PodSpec that this ephemeral container targets.
 	// The ephemeral container will be run in the namespaces (IPC, PID, etc) of this container.
 	// If not set then the ephemeral container is run in whatever namespaces are shared
@@ -3765,7 +3796,7 @@
 // PodStatus represents information about the status of a pod. Status may trail the actual
 // state of a system, especially if the node that hosts the pod cannot contact the control
 // plane.
-PodStatus: {
+PodStatus :: {
 	// The phase of a Pod is a simple, high-level summary of where the Pod is in its lifecycle.
 	// The conditions array, the reason and message fields, and the individual container status
 	// arrays contain more detail about the pod's status.
@@ -3860,7 +3891,9 @@
 }
 
 // PodStatusResult is a wrapper for PodStatus returned by kubelet that can be encode/decoded
-PodStatusResult: metav1.TypeMeta & {
+PodStatusResult :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -3877,7 +3910,9 @@
 
 // Pod is a collection of containers that can run on a host. This resource is created
 // by clients and scheduled onto hosts.
-Pod: metav1.TypeMeta & {
+Pod :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -3898,7 +3933,9 @@
 }
 
 // PodList is a list of Pods.
-PodList: metav1.TypeMeta & {
+PodList :: {
+	(metav1.TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -3910,7 +3947,7 @@
 }
 
 // PodTemplateSpec describes the data a pod should have when created from a template
-PodTemplateSpec: {
+PodTemplateSpec :: {
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -3923,7 +3960,9 @@
 }
 
 // PodTemplate describes a template for creating copies of a predefined pod.
-PodTemplate: metav1.TypeMeta & {
+PodTemplate :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -3936,7 +3975,9 @@
 }
 
 // PodTemplateList is a list of PodTemplates.
-PodTemplateList: metav1.TypeMeta & {
+PodTemplateList :: {
+	(metav1.TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -3947,7 +3988,7 @@
 }
 
 // ReplicationControllerSpec is the specification of a replication controller.
-ReplicationControllerSpec: {
+ReplicationControllerSpec :: {
 	// Replicas is the number of desired replicas.
 	// This is a pointer to distinguish between explicit zero and unspecified.
 	// Defaults to 1.
@@ -3978,7 +4019,7 @@
 
 // ReplicationControllerStatus represents the current status of a replication
 // controller.
-ReplicationControllerStatus: {
+ReplicationControllerStatus :: {
 	// Replicas is the most recently oberved number of replicas.
 	// More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#what-is-a-replicationcontroller
 	replicas: int32 @go(Replicas) @protobuf(1,varint,opt)
@@ -4006,18 +4047,18 @@
 	conditions?: [...ReplicationControllerCondition] @go(Conditions,[]ReplicationControllerCondition) @protobuf(6,bytes,rep)
 }
 
-ReplicationControllerConditionType: string // enumReplicationControllerConditionType
+ReplicationControllerConditionType :: string // enumReplicationControllerConditionType
 
-enumReplicationControllerConditionType:
+enumReplicationControllerConditionType ::
 	ReplicationControllerReplicaFailure
 
 // ReplicationControllerReplicaFailure is added in a replication controller when one of its pods
 // fails to be created due to insufficient quota, limit ranges, pod security policy, node selectors,
 // etc. or deleted due to kubelet being down or finalizers are failing.
-ReplicationControllerReplicaFailure: ReplicationControllerConditionType & "ReplicaFailure"
+ReplicationControllerReplicaFailure :: ReplicationControllerConditionType & "ReplicaFailure"
 
 // ReplicationControllerCondition describes the state of a replication controller at a certain point.
-ReplicationControllerCondition: {
+ReplicationControllerCondition :: {
 	// Type of replication controller condition.
 	type: ReplicationControllerConditionType @go(Type) @protobuf(1,bytes,opt,casttype=ReplicationControllerConditionType)
 
@@ -4038,7 +4079,9 @@
 }
 
 // ReplicationController represents the configuration of a replication controller.
-ReplicationController: metav1.TypeMeta & {
+ReplicationController :: {
+	(metav1.TypeMeta)
+
 	// If the Labels of a ReplicationController are empty, they are defaulted to
 	// be the same as the Pod(s) that the replication controller manages.
 	// Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -4060,7 +4103,9 @@
 }
 
 // ReplicationControllerList is a collection of replication controllers.
-ReplicationControllerList: metav1.TypeMeta & {
+ReplicationControllerList :: {
+	(metav1.TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -4072,29 +4117,29 @@
 }
 
 // Session Affinity Type string
-ServiceAffinity: string // enumServiceAffinity
+ServiceAffinity :: string // enumServiceAffinity
 
-enumServiceAffinity:
+enumServiceAffinity ::
 	ServiceAffinityClientIP |
 	ServiceAffinityNone
 
 // ServiceAffinityClientIP is the Client IP based.
-ServiceAffinityClientIP: ServiceAffinity & "ClientIP"
+ServiceAffinityClientIP :: ServiceAffinity & "ClientIP"
 
 // ServiceAffinityNone - no session affinity.
-ServiceAffinityNone: ServiceAffinity & "None"
+ServiceAffinityNone :: ServiceAffinity & "None"
 
-DefaultClientIPServiceAffinitySeconds: int32 & 10800
+DefaultClientIPServiceAffinitySeconds :: int32 & 10800
 
 // SessionAffinityConfig represents the configurations of session affinity.
-SessionAffinityConfig: {
+SessionAffinityConfig :: {
 	// clientIP contains the configurations of Client IP based session affinity.
 	// +optional
 	clientIP?: null | ClientIPConfig @go(ClientIP,*ClientIPConfig) @protobuf(1,bytes,opt)
 }
 
 // ClientIPConfig represents the configurations of Client IP based session affinity.
-ClientIPConfig: {
+ClientIPConfig :: {
 	// timeoutSeconds specifies the seconds of ClientIP type session sticky time.
 	// The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP".
 	// Default value is 10800(for 3 hours).
@@ -4103,9 +4148,9 @@
 }
 
 // Service Type string describes ingress methods for a service
-ServiceType: string // enumServiceType
+ServiceType :: string // enumServiceType
 
-enumServiceType:
+enumServiceType ::
 	ServiceTypeClusterIP |
 	ServiceTypeNodePort |
 	ServiceTypeLoadBalancer |
@@ -4113,37 +4158,37 @@
 
 // ServiceTypeClusterIP means a service will only be accessible inside the
 // cluster, via the cluster IP.
-ServiceTypeClusterIP: ServiceType & "ClusterIP"
+ServiceTypeClusterIP :: ServiceType & "ClusterIP"
 
 // ServiceTypeNodePort means a service will be exposed on one port of
 // every node, in addition to 'ClusterIP' type.
-ServiceTypeNodePort: ServiceType & "NodePort"
+ServiceTypeNodePort :: ServiceType & "NodePort"
 
 // ServiceTypeLoadBalancer means a service will be exposed via an
 // external load balancer (if the cloud provider supports it), in addition
 // to 'NodePort' type.
-ServiceTypeLoadBalancer: ServiceType & "LoadBalancer"
+ServiceTypeLoadBalancer :: ServiceType & "LoadBalancer"
 
 // ServiceTypeExternalName means a service consists of only a reference to
 // an external name that kubedns or equivalent will return as a CNAME
 // record, with no exposing or proxying of any pods involved.
-ServiceTypeExternalName: ServiceType & "ExternalName"
+ServiceTypeExternalName :: ServiceType & "ExternalName"
 
 // Service External Traffic Policy Type string
-ServiceExternalTrafficPolicyType: string // enumServiceExternalTrafficPolicyType
+ServiceExternalTrafficPolicyType :: string // enumServiceExternalTrafficPolicyType
 
-enumServiceExternalTrafficPolicyType:
+enumServiceExternalTrafficPolicyType ::
 	ServiceExternalTrafficPolicyTypeLocal |
 	ServiceExternalTrafficPolicyTypeCluster
 
 // ServiceExternalTrafficPolicyTypeLocal specifies node-local endpoints behavior.
-ServiceExternalTrafficPolicyTypeLocal: ServiceExternalTrafficPolicyType & "Local"
+ServiceExternalTrafficPolicyTypeLocal :: ServiceExternalTrafficPolicyType & "Local"
 
 // ServiceExternalTrafficPolicyTypeCluster specifies node-global (legacy) behavior.
-ServiceExternalTrafficPolicyTypeCluster: ServiceExternalTrafficPolicyType & "Cluster"
+ServiceExternalTrafficPolicyTypeCluster :: ServiceExternalTrafficPolicyType & "Cluster"
 
 // ServiceStatus represents the current status of a service.
-ServiceStatus: {
+ServiceStatus :: {
 	// LoadBalancer contains the current status of the load-balancer,
 	// if one is present.
 	// +optional
@@ -4151,7 +4196,7 @@
 }
 
 // LoadBalancerStatus represents the status of a load-balancer.
-LoadBalancerStatus: {
+LoadBalancerStatus :: {
 	// Ingress is a list containing ingress points for the load-balancer.
 	// Traffic intended for the service should be sent to these ingress points.
 	// +optional
@@ -4160,7 +4205,7 @@
 
 // LoadBalancerIngress represents the status of a load-balancer ingress point:
 // traffic intended for the service should be sent to an ingress point.
-LoadBalancerIngress: {
+LoadBalancerIngress :: {
 	// IP is set for load-balancer ingress points that are IP based
 	// (typically GCE or OpenStack load-balancers)
 	// +optional
@@ -4174,20 +4219,20 @@
 
 // IPFamily represents the IP Family (IPv4 or IPv6). This type is used
 // to express the family of an IP expressed by a type (i.e. service.Spec.IPFamily)
-IPFamily: string // enumIPFamily
+IPFamily :: string // enumIPFamily
 
-enumIPFamily:
+enumIPFamily ::
 	IPv4Protocol |
 	IPv6Protocol
 
 // IPv4Protocol indicates that this IP is IPv4 protocol
-IPv4Protocol: IPFamily & "IPv4"
+IPv4Protocol :: IPFamily & "IPv4"
 
 // IPv6Protocol indicates that this IP is IPv6 protocol
-IPv6Protocol: IPFamily & "IPv6"
+IPv6Protocol :: IPFamily & "IPv6"
 
 // ServiceSpec describes the attributes that a user creates on a service.
-ServiceSpec: {
+ServiceSpec :: {
 	// The list of ports that are exposed by this service.
 	// More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies
 	// +patchMergeKey=port
@@ -4315,7 +4360,7 @@
 }
 
 // ServicePort contains information on service's port.
-ServicePort: {
+ServicePort :: {
 	// The name of this port within the service. This must be a DNS_LABEL.
 	// All ports within a ServiceSpec must have unique names. When considering
 	// the endpoints for a Service, this must match the 'name' field in the
@@ -4355,7 +4400,9 @@
 // Service is a named abstraction of software service (for example, mysql) consisting of local port
 // (for example 3306) that the proxy listens on, and the selector that determines which pods
 // will answer requests sent through the proxy.
-Service: metav1.TypeMeta & {
+Service :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -4376,10 +4423,12 @@
 
 // ClusterIPNone - do not assign a cluster IP
 // no proxying required and no environment variables should be created for pods
-ClusterIPNone: "None"
+ClusterIPNone :: "None"
 
 // ServiceList holds a list of services.
-ServiceList: metav1.TypeMeta & {
+ServiceList :: {
+	(metav1.TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -4393,7 +4442,9 @@
 // * a name, understood by users, and perhaps by peripheral systems, for an identity
 // * a principal that can be authenticated and authorized
 // * a set of secrets
-ServiceAccount: metav1.TypeMeta & {
+ServiceAccount :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -4420,7 +4471,9 @@
 }
 
 // ServiceAccountList is a list of ServiceAccount objects
-ServiceAccountList: metav1.TypeMeta & {
+ServiceAccountList :: {
+	(metav1.TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -4443,7 +4496,9 @@
 //       Ports: [{"name": "a", "port": 93}, {"name": "b", "port": 76}]
 //     },
 //  ]
-Endpoints: metav1.TypeMeta & {
+Endpoints :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -4470,7 +4525,7 @@
 // The resulting set of endpoints can be viewed as:
 //     a: [ 10.10.1.1:8675, 10.10.2.2:8675 ],
 //     b: [ 10.10.1.1:309, 10.10.2.2:309 ]
-EndpointSubset: {
+EndpointSubset :: {
 	// IP addresses which offer the related ports that are marked as ready. These endpoints
 	// should be considered safe for load balancers and clients to utilize.
 	// +optional
@@ -4488,7 +4543,7 @@
 }
 
 // EndpointAddress is a tuple that describes single IP address.
-EndpointAddress: {
+EndpointAddress :: {
 	// The IP of this endpoint.
 	// May not be loopback (127.0.0.0/8), link-local (169.254.0.0/16),
 	// or link-local multicast ((224.0.0.0/24).
@@ -4511,7 +4566,7 @@
 }
 
 // EndpointPort is a tuple that describes a single port.
-EndpointPort: {
+EndpointPort :: {
 	// The name of this port.  This must match the 'name' field in the
 	// corresponding ServicePort.
 	// Must be a DNS_LABEL.
@@ -4530,7 +4585,9 @@
 }
 
 // EndpointsList is a list of endpoints.
-EndpointsList: metav1.TypeMeta & {
+EndpointsList :: {
+	(metav1.TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -4541,7 +4598,7 @@
 }
 
 // NodeSpec describes the attributes that a node is created with.
-NodeSpec: {
+NodeSpec :: {
 	// PodCIDR represents the pod IP range assigned to the node.
 	// +optional
 	podCIDR?: string @go(PodCIDR) @protobuf(1,bytes,opt)
@@ -4578,13 +4635,13 @@
 }
 
 // NodeConfigSource specifies a source of node configuration. Exactly one subfield (excluding metadata) must be non-nil.
-NodeConfigSource: {
+NodeConfigSource :: {
 	// ConfigMap is a reference to a Node's ConfigMap
 	configMap?: null | ConfigMapNodeConfigSource @go(ConfigMap,*ConfigMapNodeConfigSource) @protobuf(2,bytes,opt)
 }
 
 // ConfigMapNodeConfigSource contains the information to reference a ConfigMap as a config source for the Node.
-ConfigMapNodeConfigSource: {
+ConfigMapNodeConfigSource :: {
 	// Namespace is the metadata.namespace of the referenced ConfigMap.
 	// This field is required in all cases.
 	namespace: string @go(Namespace) @protobuf(1,bytes,opt)
@@ -4609,20 +4666,20 @@
 }
 
 // DaemonEndpoint contains information about a single Daemon endpoint.
-DaemonEndpoint: {
+DaemonEndpoint :: {
 	// Port number of the given endpoint.
 	Port: int32 @protobuf(1,varint,opt)
 }
 
 // NodeDaemonEndpoints lists ports opened by daemons running on the Node.
-NodeDaemonEndpoints: {
+NodeDaemonEndpoints :: {
 	// Endpoint on which Kubelet is listening.
 	// +optional
 	kubeletEndpoint?: DaemonEndpoint @go(KubeletEndpoint) @protobuf(1,bytes,opt)
 }
 
 // NodeSystemInfo is a set of ids/uuids to uniquely identify the node.
-NodeSystemInfo: {
+NodeSystemInfo :: {
 	// MachineID reported by the node. For unique machine identification
 	// in the cluster this field is preferred. Learn more from man(5)
 	// machine-id: http://man7.org/linux/man-pages/man5/machine-id.5.html
@@ -4659,7 +4716,7 @@
 }
 
 // NodeConfigStatus describes the status of the config assigned by Node.Spec.ConfigSource.
-NodeConfigStatus: {
+NodeConfigStatus :: {
 	// Assigned reports the checkpointed config the node will try to use.
 	// When Node.Spec.ConfigSource is updated, the node checkpoints the associated
 	// config payload to local disk, along with a record indicating intended
@@ -4709,7 +4766,7 @@
 }
 
 // NodeStatus is information about the current status of a node.
-NodeStatus: {
+NodeStatus :: {
 	// Capacity represents the total resources of a node.
 	// More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#capacity
 	// +optional
@@ -4770,10 +4827,10 @@
 	config?: null | NodeConfigStatus @go(Config,*NodeConfigStatus) @protobuf(11,bytes,opt)
 }
 
-UniqueVolumeName: string
+UniqueVolumeName :: string
 
 // AttachedVolume describes a volume attached to a node
-AttachedVolume: {
+AttachedVolume :: {
 	// Name of the attached volume
 	name: UniqueVolumeName @go(Name) @protobuf(1,bytes,rep)
 
@@ -4784,7 +4841,7 @@
 // AvoidPods describes pods that should avoid this node. This is the value for a
 // Node annotation with key scheduler.alpha.kubernetes.io/preferAvoidPods and
 // will eventually become a field of NodeStatus.
-AvoidPods: {
+AvoidPods :: {
 	// Bounded-sized list of signatures of pods that should avoid this node, sorted
 	// in timestamp order from oldest to newest. Size of the slice is unspecified.
 	// +optional
@@ -4792,7 +4849,7 @@
 }
 
 // Describes a class of pods that should avoid this node.
-PreferAvoidPodsEntry: {
+PreferAvoidPodsEntry :: {
 	// The class of pods.
 	podSignature: PodSignature @go(PodSignature) @protobuf(1,bytes,opt)
 
@@ -4811,14 +4868,14 @@
 
 // Describes the class of pods that should avoid this node.
 // Exactly one field should be set.
-PodSignature: {
+PodSignature :: {
 	// Reference to controller whose pods should avoid this node.
 	// +optional
 	podController?: null | metav1.OwnerReference @go(PodController,*metav1.OwnerReference) @protobuf(1,bytes,opt)
 }
 
 // Describe a container image
-ContainerImage: {
+ContainerImage :: {
 	// Names by which this image is known.
 	// e.g. ["k8s.gcr.io/hyperkube:v1.0.7", "dockerhub.io/google_containers/hyperkube:v1.0.7"]
 	names: [...string] @go(Names,[]string) @protobuf(1,bytes,rep)
@@ -4828,25 +4885,25 @@
 	sizeBytes?: int64 @go(SizeBytes) @protobuf(2,varint,opt)
 }
 
-NodePhase: string // enumNodePhase
+NodePhase :: string // enumNodePhase
 
-enumNodePhase:
+enumNodePhase ::
 	NodePending |
 	NodeRunning |
 	NodeTerminated
 
 // NodePending means the node has been created/added by the system, but not configured.
-NodePending: NodePhase & "Pending"
+NodePending :: NodePhase & "Pending"
 
 // NodeRunning means the node has been configured and has Kubernetes components running.
-NodeRunning: NodePhase & "Running"
+NodeRunning :: NodePhase & "Running"
 
 // NodeTerminated means the node has been removed from the cluster.
-NodeTerminated: NodePhase & "Terminated"
+NodeTerminated :: NodePhase & "Terminated"
 
-NodeConditionType: string // enumNodeConditionType
+NodeConditionType :: string // enumNodeConditionType
 
-enumNodeConditionType:
+enumNodeConditionType ::
 	NodeReady |
 	NodeMemoryPressure |
 	NodeDiskPressure |
@@ -4854,22 +4911,22 @@
 	NodeNetworkUnavailable
 
 // NodeReady means kubelet is healthy and ready to accept pods.
-NodeReady: NodeConditionType & "Ready"
+NodeReady :: NodeConditionType & "Ready"
 
 // NodeMemoryPressure means the kubelet is under pressure due to insufficient available memory.
-NodeMemoryPressure: NodeConditionType & "MemoryPressure"
+NodeMemoryPressure :: NodeConditionType & "MemoryPressure"
 
 // NodeDiskPressure means the kubelet is under pressure due to insufficient available disk.
-NodeDiskPressure: NodeConditionType & "DiskPressure"
+NodeDiskPressure :: NodeConditionType & "DiskPressure"
 
 // NodePIDPressure means the kubelet is under pressure due to insufficient available PID.
-NodePIDPressure: NodeConditionType & "PIDPressure"
+NodePIDPressure :: NodeConditionType & "PIDPressure"
 
 // NodeNetworkUnavailable means that network for the node is not correctly configured.
-NodeNetworkUnavailable: NodeConditionType & "NetworkUnavailable"
+NodeNetworkUnavailable :: NodeConditionType & "NetworkUnavailable"
 
 // NodeCondition contains condition information for a node.
-NodeCondition: {
+NodeCondition :: {
 	// Type of node condition.
 	type: NodeConditionType @go(Type) @protobuf(1,bytes,opt,casttype=NodeConditionType)
 
@@ -4893,23 +4950,23 @@
 	message?: string @go(Message) @protobuf(6,bytes,opt)
 }
 
-NodeAddressType: string // enumNodeAddressType
+NodeAddressType :: string // enumNodeAddressType
 
-enumNodeAddressType:
+enumNodeAddressType ::
 	NodeHostName |
 	NodeExternalIP |
 	NodeInternalIP |
 	NodeExternalDNS |
 	NodeInternalDNS
 
-NodeHostName:    NodeAddressType & "Hostname"
-NodeExternalIP:  NodeAddressType & "ExternalIP"
-NodeInternalIP:  NodeAddressType & "InternalIP"
-NodeExternalDNS: NodeAddressType & "ExternalDNS"
-NodeInternalDNS: NodeAddressType & "InternalDNS"
+NodeHostName ::    NodeAddressType & "Hostname"
+NodeExternalIP ::  NodeAddressType & "ExternalIP"
+NodeInternalIP ::  NodeAddressType & "InternalIP"
+NodeExternalDNS :: NodeAddressType & "ExternalDNS"
+NodeInternalDNS :: NodeAddressType & "InternalDNS"
 
 // NodeAddress contains information for the node's address.
-NodeAddress: {
+NodeAddress :: {
 	// Node address type, one of Hostname, ExternalIP or InternalIP.
 	type: NodeAddressType @go(Type) @protobuf(1,bytes,opt,casttype=NodeAddressType)
 
@@ -4918,9 +4975,9 @@
 }
 
 // ResourceName is the name identifying various resources in a ResourceList.
-ResourceName: string // enumResourceName
+ResourceName :: string // enumResourceName
 
-enumResourceName:
+enumResourceName ::
 	ResourceCPU |
 	ResourceMemory |
 	ResourceStorage |
@@ -4943,33 +5000,35 @@
 	ResourceLimitsEphemeralStorage
 
 // CPU, in cores. (500m = .5 cores)
-ResourceCPU: ResourceName & "cpu"
+ResourceCPU :: ResourceName & "cpu"
 
 // Memory, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
-ResourceMemory: ResourceName & "memory"
+ResourceMemory :: ResourceName & "memory"
 
 // Volume size, in bytes (e,g. 5Gi = 5GiB = 5 * 1024 * 1024 * 1024)
-ResourceStorage: ResourceName & "storage"
+ResourceStorage :: ResourceName & "storage"
 
 // Local ephemeral storage, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
 // The resource name for ResourceEphemeralStorage is alpha and it can change across releases.
-ResourceEphemeralStorage: ResourceName & "ephemeral-storage"
+ResourceEphemeralStorage :: ResourceName & "ephemeral-storage"
 
 // Default namespace prefix.
-ResourceDefaultNamespacePrefix: "kubernetes.io/"
+ResourceDefaultNamespacePrefix :: "kubernetes.io/"
 
 // Name prefix for huge page resources (alpha).
-ResourceHugePagesPrefix: "hugepages-"
+ResourceHugePagesPrefix :: "hugepages-"
 
 // Name prefix for storage resource limits
-ResourceAttachableVolumesPrefix: "attachable-volumes-"
+ResourceAttachableVolumesPrefix :: "attachable-volumes-"
 
 // ResourceList is a set of (resource name, quantity) pairs.
-ResourceList: {<_>: resource.Quantity}
+ResourceList :: {<_>: resource.Quantity}
 
 // Node is a worker node in Kubernetes.
 // Each node will have a unique identifier in the cache (i.e. in etcd).
-Node: metav1.TypeMeta & {
+Node :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -4989,7 +5048,9 @@
 }
 
 // NodeList is the whole list of all Nodes which have been registered with master.
-NodeList: metav1.TypeMeta & {
+NodeList :: {
+	(metav1.TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -5000,15 +5061,15 @@
 }
 
 // FinalizerName is the name identifying a finalizer during namespace lifecycle.
-FinalizerName: string // enumFinalizerName
+FinalizerName :: string // enumFinalizerName
 
-enumFinalizerName:
+enumFinalizerName ::
 	FinalizerKubernetes
 
-FinalizerKubernetes: FinalizerName & "kubernetes"
+FinalizerKubernetes :: FinalizerName & "kubernetes"
 
 // NamespaceSpec describes the attributes on a Namespace.
-NamespaceSpec: {
+NamespaceSpec :: {
 	// Finalizers is an opaque list of values that must be empty to permanently remove object from storage.
 	// More info: https://kubernetes.io/docs/tasks/administer-cluster/namespaces/
 	// +optional
@@ -5016,7 +5077,7 @@
 }
 
 // NamespaceStatus is information about the current status of a Namespace.
-NamespaceStatus: {
+NamespaceStatus :: {
 	// Phase is the current lifecycle phase of the namespace.
 	// More info: https://kubernetes.io/docs/tasks/administer-cluster/namespaces/
 	// +optional
@@ -5029,36 +5090,36 @@
 	conditions?: [...NamespaceCondition] @go(Conditions,[]NamespaceCondition) @protobuf(2,bytes,rep)
 }
 
-NamespacePhase: string // enumNamespacePhase
+NamespacePhase :: string // enumNamespacePhase
 
-enumNamespacePhase:
+enumNamespacePhase ::
 	NamespaceActive |
 	NamespaceTerminating
 
 // NamespaceActive means the namespace is available for use in the system
-NamespaceActive: NamespacePhase & "Active"
+NamespaceActive :: NamespacePhase & "Active"
 
 // NamespaceTerminating means the namespace is undergoing graceful termination
-NamespaceTerminating: NamespacePhase & "Terminating"
+NamespaceTerminating :: NamespacePhase & "Terminating"
 
-NamespaceConditionType: string // enumNamespaceConditionType
+NamespaceConditionType :: string // enumNamespaceConditionType
 
-enumNamespaceConditionType:
+enumNamespaceConditionType ::
 	NamespaceDeletionDiscoveryFailure |
 	NamespaceDeletionContentFailure |
 	NamespaceDeletionGVParsingFailure
 
 // NamespaceDeletionDiscoveryFailure contains information about namespace deleter errors during resource discovery.
-NamespaceDeletionDiscoveryFailure: NamespaceConditionType & "NamespaceDeletionDiscoveryFailure"
+NamespaceDeletionDiscoveryFailure :: NamespaceConditionType & "NamespaceDeletionDiscoveryFailure"
 
 // NamespaceDeletionContentFailure contains information about namespace deleter errors during deletion of resources.
-NamespaceDeletionContentFailure: NamespaceConditionType & "NamespaceDeletionContentFailure"
+NamespaceDeletionContentFailure :: NamespaceConditionType & "NamespaceDeletionContentFailure"
 
 // NamespaceDeletionGVParsingFailure contains information about namespace deleter errors parsing GV for legacy types.
-NamespaceDeletionGVParsingFailure: NamespaceConditionType & "NamespaceDeletionGroupVersionParsingFailure"
+NamespaceDeletionGVParsingFailure :: NamespaceConditionType & "NamespaceDeletionGroupVersionParsingFailure"
 
 // NamespaceCondition contains details about state of namespace.
-NamespaceCondition: {
+NamespaceCondition :: {
 	// Type of namespace controller condition.
 	type: NamespaceConditionType @go(Type) @protobuf(1,bytes,opt,casttype=NamespaceConditionType)
 
@@ -5077,7 +5138,9 @@
 
 // Namespace provides a scope for Names.
 // Use of multiple namespaces is optional.
-Namespace: metav1.TypeMeta & {
+Namespace :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -5095,7 +5158,9 @@
 }
 
 // NamespaceList is a list of Namespaces.
-NamespaceList: metav1.TypeMeta & {
+NamespaceList :: {
+	(metav1.TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -5108,7 +5173,9 @@
 
 // Binding ties one object to another; for example, a pod is bound to a node by a scheduler.
 // Deprecated in 1.7, please use the bindings subresource of pods instead.
-Binding: metav1.TypeMeta & {
+Binding :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -5119,7 +5186,9 @@
 }
 
 // A list of ephemeral containers used with the Pod ephemeralcontainers subresource.
-EphemeralContainers: metav1.TypeMeta & {
+EphemeralContainers :: {
+	(metav1.TypeMeta)
+
 	// +optional
 	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
 
@@ -5133,14 +5202,16 @@
 
 // Preconditions must be fulfilled before an operation (update, delete, etc.) is carried out.
 // +k8s:openapi-gen=false
-Preconditions: {
+Preconditions :: {
 	// Specifies the target UID.
 	// +optional
 	uid?: null | types.UID @go(UID,*types.UID) @protobuf(1,bytes,opt,casttype=k8s.io/apimachinery/pkg/types.UID)
 }
 
 // PodLogOptions is the query options for a Pod's logs REST call.
-PodLogOptions: metav1.TypeMeta & {
+PodLogOptions :: {
+	(metav1.TypeMeta)
+
 	// The container for which to stream logs. Defaults to only container if there is one container in the pod.
 	// +optional
 	container?: string @go(Container) @protobuf(1,bytes,opt)
@@ -5188,7 +5259,9 @@
 // ---
 // TODO: merge w/ PodExecOptions below for stdin, stdout, etc
 // and also when we cut V2, we should export a "StreamOptions" or somesuch that contains Stdin, Stdout, Stder and TTY
-PodAttachOptions: metav1.TypeMeta & {
+PodAttachOptions :: {
+	(metav1.TypeMeta)
+
 	// Stdin if true, redirects the standard input stream of the pod for this call.
 	// Defaults to false.
 	// +optional
@@ -5221,7 +5294,9 @@
 // ---
 // TODO: This is largely identical to PodAttachOptions above, make sure they stay in sync and see about merging
 // and also when we cut V2, we should export a "StreamOptions" or somesuch that contains Stdin, Stdout, Stder and TTY
-PodExecOptions: metav1.TypeMeta & {
+PodExecOptions :: {
+	(metav1.TypeMeta)
+
 	// Redirect the standard input stream of the pod for this call.
 	// Defaults to false.
 	// +optional
@@ -5257,7 +5332,9 @@
 // ports (comma separated) to forward over.
 // Port forwarding over SPDY does not use these options. It requires the port
 // to be passed in the `port` header as part of request.
-PodPortForwardOptions: metav1.TypeMeta & {
+PodPortForwardOptions :: {
+	(metav1.TypeMeta)
+
 	// List of ports to forward
 	// Required when using WebSockets
 	// +optional
@@ -5265,21 +5342,27 @@
 }
 
 // PodProxyOptions is the query options to a Pod's proxy call.
-PodProxyOptions: metav1.TypeMeta & {
+PodProxyOptions :: {
+	(metav1.TypeMeta)
+
 	// Path is the URL path to use for the current proxy request to pod.
 	// +optional
 	path?: string @go(Path) @protobuf(1,bytes,opt)
 }
 
 // NodeProxyOptions is the query options to a Node's proxy call.
-NodeProxyOptions: metav1.TypeMeta & {
+NodeProxyOptions :: {
+	(metav1.TypeMeta)
+
 	// Path is the URL path to use for the current proxy request to node.
 	// +optional
 	path?: string @go(Path) @protobuf(1,bytes,opt)
 }
 
 // ServiceProxyOptions is the query options to a Service's proxy call.
-ServiceProxyOptions: metav1.TypeMeta & {
+ServiceProxyOptions :: {
+	(metav1.TypeMeta)
+
 	// Path is the part of URLs that include service endpoints, suffixes,
 	// and parameters to use for the current proxy request to service.
 	// For example, the whole request URL is
@@ -5291,7 +5374,7 @@
 
 // ObjectReference contains enough information to let you inspect or modify the referred object.
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-ObjectReference: {
+ObjectReference :: {
 	// Kind of the referent.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -5335,7 +5418,7 @@
 
 // LocalObjectReference contains enough information to let you locate the
 // referenced object inside the same namespace.
-LocalObjectReference: {
+LocalObjectReference :: {
 	// Name of the referent.
 	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
 	// TODO: Add other useful fields. apiVersion, kind, uid?
@@ -5345,7 +5428,7 @@
 
 // TypedLocalObjectReference contains enough information to let you locate the
 // typed referenced object inside the same namespace.
-TypedLocalObjectReference: {
+TypedLocalObjectReference :: {
 	// APIGroup is the group for the resource being referenced.
 	// If APIGroup is not specified, the specified Kind must be in the core API group.
 	// For any other third-party types, APIGroup is required.
@@ -5360,14 +5443,16 @@
 }
 
 // SerializedReference is a reference to serialized object.
-SerializedReference: metav1.TypeMeta & {
+SerializedReference :: {
+	(metav1.TypeMeta)
+
 	// The reference to an object in the system.
 	// +optional
 	reference?: ObjectReference @go(Reference) @protobuf(1,bytes,opt)
 }
 
 // EventSource contains information for an event.
-EventSource: {
+EventSource :: {
 	// Component from which the event is generated.
 	// +optional
 	component?: string @go(Component) @protobuf(1,bytes,opt)
@@ -5378,13 +5463,15 @@
 }
 
 // Information only and will not cause any problems
-EventTypeNormal: "Normal"
+EventTypeNormal :: "Normal"
 
 // These events are to warn that something might go wrong
-EventTypeWarning: "Warning"
+EventTypeWarning :: "Warning"
 
 // Event is a report of an event somewhere in the cluster.
-Event: metav1.TypeMeta & {
+Event :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	metadata: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
@@ -5450,7 +5537,7 @@
 
 // EventSeries contain information on series of events, i.e. thing that was/is happening
 // continuously for some time.
-EventSeries: {
+EventSeries :: {
 	// Number of occurrences in this series up to the last heartbeat time
 	count?: int32 @go(Count) @protobuf(1,varint)
 
@@ -5462,19 +5549,21 @@
 	state?: EventSeriesState @go(State) @protobuf(3,bytes)
 }
 
-EventSeriesState: string // enumEventSeriesState
+EventSeriesState :: string // enumEventSeriesState
 
-enumEventSeriesState:
+enumEventSeriesState ::
 	EventSeriesStateOngoing |
 	EventSeriesStateFinished |
 	EventSeriesStateUnknown
 
-EventSeriesStateOngoing:  EventSeriesState & "Ongoing"
-EventSeriesStateFinished: EventSeriesState & "Finished"
-EventSeriesStateUnknown:  EventSeriesState & "Unknown"
+EventSeriesStateOngoing ::  EventSeriesState & "Ongoing"
+EventSeriesStateFinished :: EventSeriesState & "Finished"
+EventSeriesStateUnknown ::  EventSeriesState & "Unknown"
 
 // EventList is a list of events.
-EventList: metav1.TypeMeta & {
+EventList :: {
+	(metav1.TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -5485,27 +5574,27 @@
 }
 
 // List holds a list of objects, which may not be known by the server.
-List: metav1.List
+List :: metav1.List
 
 // LimitType is a type of object that is limited
-LimitType: string // enumLimitType
+LimitType :: string // enumLimitType
 
-enumLimitType:
+enumLimitType ::
 	LimitTypePod |
 	LimitTypeContainer |
 	LimitTypePersistentVolumeClaim
 
 // Limit that applies to all pods in a namespace
-LimitTypePod: LimitType & "Pod"
+LimitTypePod :: LimitType & "Pod"
 
 // Limit that applies to all containers in a namespace
-LimitTypeContainer: LimitType & "Container"
+LimitTypeContainer :: LimitType & "Container"
 
 // Limit that applies to all persistent volume claims in a namespace
-LimitTypePersistentVolumeClaim: LimitType & "PersistentVolumeClaim"
+LimitTypePersistentVolumeClaim :: LimitType & "PersistentVolumeClaim"
 
 // LimitRangeItem defines a min/max usage limit for any resource that matches on kind.
-LimitRangeItem: {
+LimitRangeItem :: {
 	// Type of resource that this limit applies to.
 	// +optional
 	type?: LimitType @go(Type) @protobuf(1,bytes,opt,casttype=LimitType)
@@ -5532,13 +5621,15 @@
 }
 
 // LimitRangeSpec defines a min/max usage limit for resources that match on kind.
-LimitRangeSpec: {
+LimitRangeSpec :: {
 	// Limits is the list of LimitRangeItem objects that are enforced.
 	limits: [...LimitRangeItem] @go(Limits,[]LimitRangeItem) @protobuf(1,bytes,rep)
 }
 
 // LimitRange sets resource usage limits for each kind of resource in a Namespace.
-LimitRange: metav1.TypeMeta & {
+LimitRange :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -5551,7 +5642,9 @@
 }
 
 // LimitRangeList is a list of LimitRange items.
-LimitRangeList: metav1.TypeMeta & {
+LimitRangeList :: {
+	(metav1.TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -5563,64 +5656,64 @@
 }
 
 // Pods, number
-ResourcePods: ResourceName & "pods"
+ResourcePods :: ResourceName & "pods"
 
 // Services, number
-ResourceServices: ResourceName & "services"
+ResourceServices :: ResourceName & "services"
 
 // ReplicationControllers, number
-ResourceReplicationControllers: ResourceName & "replicationcontrollers"
+ResourceReplicationControllers :: ResourceName & "replicationcontrollers"
 
 // ResourceQuotas, number
-ResourceQuotas: ResourceName & "resourcequotas"
+ResourceQuotas :: ResourceName & "resourcequotas"
 
 // ResourceSecrets, number
-ResourceSecrets: ResourceName & "secrets"
+ResourceSecrets :: ResourceName & "secrets"
 
 // ResourceConfigMaps, number
-ResourceConfigMaps: ResourceName & "configmaps"
+ResourceConfigMaps :: ResourceName & "configmaps"
 
 // ResourcePersistentVolumeClaims, number
-ResourcePersistentVolumeClaims: ResourceName & "persistentvolumeclaims"
+ResourcePersistentVolumeClaims :: ResourceName & "persistentvolumeclaims"
 
 // ResourceServicesNodePorts, number
-ResourceServicesNodePorts: ResourceName & "services.nodeports"
+ResourceServicesNodePorts :: ResourceName & "services.nodeports"
 
 // ResourceServicesLoadBalancers, number
-ResourceServicesLoadBalancers: ResourceName & "services.loadbalancers"
+ResourceServicesLoadBalancers :: ResourceName & "services.loadbalancers"
 
 // CPU request, in cores. (500m = .5 cores)
-ResourceRequestsCPU: ResourceName & "requests.cpu"
+ResourceRequestsCPU :: ResourceName & "requests.cpu"
 
 // Memory request, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
-ResourceRequestsMemory: ResourceName & "requests.memory"
+ResourceRequestsMemory :: ResourceName & "requests.memory"
 
 // Storage request, in bytes
-ResourceRequestsStorage: ResourceName & "requests.storage"
+ResourceRequestsStorage :: ResourceName & "requests.storage"
 
 // Local ephemeral storage request, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
-ResourceRequestsEphemeralStorage: ResourceName & "requests.ephemeral-storage"
+ResourceRequestsEphemeralStorage :: ResourceName & "requests.ephemeral-storage"
 
 // CPU limit, in cores. (500m = .5 cores)
-ResourceLimitsCPU: ResourceName & "limits.cpu"
+ResourceLimitsCPU :: ResourceName & "limits.cpu"
 
 // Memory limit, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
-ResourceLimitsMemory: ResourceName & "limits.memory"
+ResourceLimitsMemory :: ResourceName & "limits.memory"
 
 // Local ephemeral storage limit, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
-ResourceLimitsEphemeralStorage: ResourceName & "limits.ephemeral-storage"
+ResourceLimitsEphemeralStorage :: ResourceName & "limits.ephemeral-storage"
 
 // HugePages request, in bytes. (500Gi = 500GiB = 500 * 1024 * 1024 * 1024)
 // As burst is not supported for HugePages, we would only quota its request, and ignore the limit.
-ResourceRequestsHugePagesPrefix: "requests.hugepages-"
+ResourceRequestsHugePagesPrefix :: "requests.hugepages-"
 
 // Default resource requests prefix
-DefaultResourceRequestsPrefix: "requests."
+DefaultResourceRequestsPrefix :: "requests."
 
 // A ResourceQuotaScope defines a filter that must match each object tracked by a quota
-ResourceQuotaScope: string // enumResourceQuotaScope
+ResourceQuotaScope :: string // enumResourceQuotaScope
 
-enumResourceQuotaScope:
+enumResourceQuotaScope ::
 	ResourceQuotaScopeTerminating |
 	ResourceQuotaScopeNotTerminating |
 	ResourceQuotaScopeBestEffort |
@@ -5628,22 +5721,22 @@
 	ResourceQuotaScopePriorityClass
 
 // Match all pod objects where spec.activeDeadlineSeconds
-ResourceQuotaScopeTerminating: ResourceQuotaScope & "Terminating"
+ResourceQuotaScopeTerminating :: ResourceQuotaScope & "Terminating"
 
 // Match all pod objects where !spec.activeDeadlineSeconds
-ResourceQuotaScopeNotTerminating: ResourceQuotaScope & "NotTerminating"
+ResourceQuotaScopeNotTerminating :: ResourceQuotaScope & "NotTerminating"
 
 // Match all pod objects that have best effort quality of service
-ResourceQuotaScopeBestEffort: ResourceQuotaScope & "BestEffort"
+ResourceQuotaScopeBestEffort :: ResourceQuotaScope & "BestEffort"
 
 // Match all pod objects that do not have best effort quality of service
-ResourceQuotaScopeNotBestEffort: ResourceQuotaScope & "NotBestEffort"
+ResourceQuotaScopeNotBestEffort :: ResourceQuotaScope & "NotBestEffort"
 
 // Match all pod objects that have priority class mentioned
-ResourceQuotaScopePriorityClass: ResourceQuotaScope & "PriorityClass"
+ResourceQuotaScopePriorityClass :: ResourceQuotaScope & "PriorityClass"
 
 // ResourceQuotaSpec defines the desired hard limits to enforce for Quota.
-ResourceQuotaSpec: {
+ResourceQuotaSpec :: {
 	// hard is the set of desired hard limits for each named resource.
 	// More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
 	// +optional
@@ -5663,7 +5756,7 @@
 
 // A scope selector represents the AND of the selectors represented
 // by the scoped-resource selector requirements.
-ScopeSelector: {
+ScopeSelector :: {
 	// A list of scope selector requirements by scope of the resources.
 	// +optional
 	matchExpressions?: [...ScopedResourceSelectorRequirement] @go(MatchExpressions,[]ScopedResourceSelectorRequirement) @protobuf(1,bytes,rep)
@@ -5671,7 +5764,7 @@
 
 // A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator
 // that relates the scope name and values.
-ScopedResourceSelectorRequirement: {
+ScopedResourceSelectorRequirement :: {
 	// The name of the scope that the selector applies to.
 	scopeName: ResourceQuotaScope @go(ScopeName) @protobuf(1,bytes,opt)
 
@@ -5689,21 +5782,21 @@
 
 // A scope selector operator is the set of operators that can be used in
 // a scope selector requirement.
-ScopeSelectorOperator: string // enumScopeSelectorOperator
+ScopeSelectorOperator :: string // enumScopeSelectorOperator
 
-enumScopeSelectorOperator:
+enumScopeSelectorOperator ::
 	ScopeSelectorOpIn |
 	ScopeSelectorOpNotIn |
 	ScopeSelectorOpExists |
 	ScopeSelectorOpDoesNotExist
 
-ScopeSelectorOpIn:           ScopeSelectorOperator & "In"
-ScopeSelectorOpNotIn:        ScopeSelectorOperator & "NotIn"
-ScopeSelectorOpExists:       ScopeSelectorOperator & "Exists"
-ScopeSelectorOpDoesNotExist: ScopeSelectorOperator & "DoesNotExist"
+ScopeSelectorOpIn ::           ScopeSelectorOperator & "In"
+ScopeSelectorOpNotIn ::        ScopeSelectorOperator & "NotIn"
+ScopeSelectorOpExists ::       ScopeSelectorOperator & "Exists"
+ScopeSelectorOpDoesNotExist :: ScopeSelectorOperator & "DoesNotExist"
 
 // ResourceQuotaStatus defines the enforced hard limits and observed use.
-ResourceQuotaStatus: {
+ResourceQuotaStatus :: {
 	// Hard is the set of enforced hard limits for each named resource.
 	// More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
 	// +optional
@@ -5715,7 +5808,9 @@
 }
 
 // ResourceQuota sets aggregate quota restrictions enforced per namespace
-ResourceQuota: metav1.TypeMeta & {
+ResourceQuota :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -5733,7 +5828,9 @@
 }
 
 // ResourceQuotaList is a list of ResourceQuota items.
-ResourceQuotaList: metav1.TypeMeta & {
+ResourceQuotaList :: {
+	(metav1.TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -5746,7 +5843,9 @@
 
 // Secret holds secret data of a certain type. The total bytes of the values in
 // the Data field must be less than MaxSecretSize bytes.
-Secret: metav1.TypeMeta & {
+Secret :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -5772,11 +5871,11 @@
 	type?: SecretType @go(Type) @protobuf(3,bytes,opt,casttype=SecretType)
 }
 
-MaxSecretSize: 1048576
+MaxSecretSize :: 1048576
 
-SecretType: string // enumSecretType
+SecretType :: string // enumSecretType
 
-enumSecretType:
+enumSecretType ::
 	SecretTypeOpaque |
 	SecretTypeServiceAccountToken |
 	SecretTypeDockercfg |
@@ -5787,7 +5886,7 @@
 	SecretTypeBootstrapToken
 
 // SecretTypeOpaque is the default. Arbitrary user-defined data
-SecretTypeOpaque: SecretType & "Opaque"
+SecretTypeOpaque :: SecretType & "Opaque"
 
 // SecretTypeServiceAccountToken contains a token that identifies a service account to the API
 //
@@ -5795,65 +5894,65 @@
 // - Secret.Annotations["kubernetes.io/service-account.name"] - the name of the ServiceAccount the token identifies
 // - Secret.Annotations["kubernetes.io/service-account.uid"] - the UID of the ServiceAccount the token identifies
 // - Secret.Data["token"] - a token that identifies the service account to the API
-SecretTypeServiceAccountToken: SecretType & "kubernetes.io/service-account-token"
+SecretTypeServiceAccountToken :: SecretType & "kubernetes.io/service-account-token"
 
 // ServiceAccountNameKey is the key of the required annotation for SecretTypeServiceAccountToken secrets
-ServiceAccountNameKey: "kubernetes.io/service-account.name"
+ServiceAccountNameKey :: "kubernetes.io/service-account.name"
 
 // ServiceAccountUIDKey is the key of the required annotation for SecretTypeServiceAccountToken secrets
-ServiceAccountUIDKey: "kubernetes.io/service-account.uid"
+ServiceAccountUIDKey :: "kubernetes.io/service-account.uid"
 
 // ServiceAccountTokenKey is the key of the required data for SecretTypeServiceAccountToken secrets
-ServiceAccountTokenKey: "token"
+ServiceAccountTokenKey :: "token"
 
 // ServiceAccountKubeconfigKey is the key of the optional kubeconfig data for SecretTypeServiceAccountToken secrets
-ServiceAccountKubeconfigKey: "kubernetes.kubeconfig"
+ServiceAccountKubeconfigKey :: "kubernetes.kubeconfig"
 
 // ServiceAccountRootCAKey is the key of the optional root certificate authority for SecretTypeServiceAccountToken secrets
-ServiceAccountRootCAKey: "ca.crt"
+ServiceAccountRootCAKey :: "ca.crt"
 
 // ServiceAccountNamespaceKey is the key of the optional namespace to use as the default for namespaced API calls
-ServiceAccountNamespaceKey: "namespace"
+ServiceAccountNamespaceKey :: "namespace"
 
 // SecretTypeDockercfg contains a dockercfg file that follows the same format rules as ~/.dockercfg
 //
 // Required fields:
 // - Secret.Data[".dockercfg"] - a serialized ~/.dockercfg file
-SecretTypeDockercfg: SecretType & "kubernetes.io/dockercfg"
+SecretTypeDockercfg :: SecretType & "kubernetes.io/dockercfg"
 
 // DockerConfigKey is the key of the required data for SecretTypeDockercfg secrets
-DockerConfigKey: ".dockercfg"
+DockerConfigKey :: ".dockercfg"
 
 // SecretTypeDockerConfigJson contains a dockercfg file that follows the same format rules as ~/.docker/config.json
 //
 // Required fields:
 // - Secret.Data[".dockerconfigjson"] - a serialized ~/.docker/config.json file
-SecretTypeDockerConfigJson: SecretType & "kubernetes.io/dockerconfigjson"
+SecretTypeDockerConfigJson :: SecretType & "kubernetes.io/dockerconfigjson"
 
 // DockerConfigJsonKey is the key of the required data for SecretTypeDockerConfigJson secrets
-DockerConfigJsonKey: ".dockerconfigjson"
+DockerConfigJsonKey :: ".dockerconfigjson"
 
 // SecretTypeBasicAuth contains data needed for basic authentication.
 //
 // Required at least one of fields:
 // - Secret.Data["username"] - username used for authentication
 // - Secret.Data["password"] - password or token needed for authentication
-SecretTypeBasicAuth: SecretType & "kubernetes.io/basic-auth"
+SecretTypeBasicAuth :: SecretType & "kubernetes.io/basic-auth"
 
 // BasicAuthUsernameKey is the key of the username for SecretTypeBasicAuth secrets
-BasicAuthUsernameKey: "username"
+BasicAuthUsernameKey :: "username"
 
 // BasicAuthPasswordKey is the key of the password or token for SecretTypeBasicAuth secrets
-BasicAuthPasswordKey: "password"
+BasicAuthPasswordKey :: "password"
 
 // SecretTypeSSHAuth contains data needed for SSH authetication.
 //
 // Required field:
 // - Secret.Data["ssh-privatekey"] - private SSH key needed for authentication
-SecretTypeSSHAuth: SecretType & "kubernetes.io/ssh-auth"
+SecretTypeSSHAuth :: SecretType & "kubernetes.io/ssh-auth"
 
 // SSHAuthPrivateKey is the key of the required SSH private key for SecretTypeSSHAuth secrets
-SSHAuthPrivateKey: "ssh-privatekey"
+SSHAuthPrivateKey :: "ssh-privatekey"
 
 // SecretTypeTLS contains information about a TLS client or server secret. It
 // is primarily used with TLS termination of the Ingress resource, but may be
@@ -5863,21 +5962,23 @@
 // - Secret.Data["tls.key"] - TLS private key.
 //   Secret.Data["tls.crt"] - TLS certificate.
 // TODO: Consider supporting different formats, specifying CA/destinationCA.
-SecretTypeTLS: SecretType & "kubernetes.io/tls"
+SecretTypeTLS :: SecretType & "kubernetes.io/tls"
 
 // TLSCertKey is the key for tls certificates in a TLS secert.
-TLSCertKey: "tls.crt"
+TLSCertKey :: "tls.crt"
 
 // TLSPrivateKeyKey is the key for the private key field in a TLS secret.
-TLSPrivateKeyKey: "tls.key"
+TLSPrivateKeyKey :: "tls.key"
 
 // SecretTypeBootstrapToken is used during the automated bootstrap process (first
 // implemented by kubeadm). It stores tokens that are used to sign well known
 // ConfigMaps. They are used for authn.
-SecretTypeBootstrapToken: SecretType & "bootstrap.kubernetes.io/token"
+SecretTypeBootstrapToken :: SecretType & "bootstrap.kubernetes.io/token"
 
 // SecretList is a list of Secret.
-SecretList: metav1.TypeMeta & {
+SecretList :: {
+	(metav1.TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -5889,7 +5990,9 @@
 }
 
 // ConfigMap holds configuration data for pods to consume.
-ConfigMap: metav1.TypeMeta & {
+ConfigMap :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -5915,7 +6018,9 @@
 }
 
 // ConfigMapList is a resource containing a list of ConfigMap objects.
-ConfigMapList: metav1.TypeMeta & {
+ConfigMapList :: {
+	(metav1.TypeMeta)
+
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
 	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
@@ -5925,15 +6030,15 @@
 }
 
 // Type and constants for component health validation.
-ComponentConditionType: string // enumComponentConditionType
+ComponentConditionType :: string // enumComponentConditionType
 
-enumComponentConditionType:
+enumComponentConditionType ::
 	ComponentHealthy
 
-ComponentHealthy: ComponentConditionType & "Healthy"
+ComponentHealthy :: ComponentConditionType & "Healthy"
 
 // Information about the condition of a component.
-ComponentCondition: {
+ComponentCondition :: {
 	// Type of condition for a component.
 	// Valid value: "Healthy"
 	type: ComponentConditionType @go(Type) @protobuf(1,bytes,opt,casttype=ComponentConditionType)
@@ -5954,7 +6059,9 @@
 }
 
 // ComponentStatus (and ComponentStatusList) holds the cluster validation info.
-ComponentStatus: metav1.TypeMeta & {
+ComponentStatus :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -5968,7 +6075,9 @@
 }
 
 // Status of all the conditions for the component as a list of ComponentStatus objects.
-ComponentStatusList: metav1.TypeMeta & {
+ComponentStatusList :: {
+	(metav1.TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -5980,7 +6089,7 @@
 
 // DownwardAPIVolumeSource represents a volume containing downward API info.
 // Downward API volumes support ownership management and SELinux relabeling.
-DownwardAPIVolumeSource: {
+DownwardAPIVolumeSource :: {
 	// Items is a list of downward API volume file
 	// +optional
 	items?: [...DownwardAPIVolumeFile] @go(Items,[]DownwardAPIVolumeFile) @protobuf(1,bytes,rep)
@@ -5994,10 +6103,10 @@
 	defaultMode?: null | int32 @go(DefaultMode,*int32) @protobuf(2,varint,opt)
 }
 
-DownwardAPIVolumeSourceDefaultMode: int32 & 0o644
+DownwardAPIVolumeSourceDefaultMode :: int32 & 0o644
 
 // DownwardAPIVolumeFile represents information to create the file containing the pod field
-DownwardAPIVolumeFile: {
+DownwardAPIVolumeFile :: {
 	// Required: Path is  the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'
 	path: string @go(Path) @protobuf(1,bytes,opt)
 
@@ -6021,7 +6130,7 @@
 // Represents downward API info for projecting into a projected volume.
 // Note that this is identical to a downwardAPI volume source without the default
 // mode.
-DownwardAPIProjection: {
+DownwardAPIProjection :: {
 	// Items is a list of DownwardAPIVolume file
 	// +optional
 	items?: [...DownwardAPIVolumeFile] @go(Items,[]DownwardAPIVolumeFile) @protobuf(1,bytes,rep)
@@ -6030,7 +6139,7 @@
 // SecurityContext holds security configuration that will be applied to a container.
 // Some fields are present in both SecurityContext and PodSecurityContext.  When both
 // are set, the values in SecurityContext take precedence.
-SecurityContext: {
+SecurityContext :: {
 	// The capabilities to add/drop when running containers.
 	// Defaults to the default set of capabilities granted by the container runtime.
 	// +optional
@@ -6100,24 +6209,24 @@
 	procMount?: null | ProcMountType @go(ProcMount,*ProcMountType) @protobuf(9,bytes,opt)
 }
 
-ProcMountType: string // enumProcMountType
+ProcMountType :: string // enumProcMountType
 
-enumProcMountType:
+enumProcMountType ::
 	DefaultProcMount |
 	UnmaskedProcMount
 
 // DefaultProcMount uses the container runtime defaults for readonly and masked
 // paths for /proc.  Most container runtimes mask certain paths in /proc to avoid
 // accidental security exposure of special devices or information.
-DefaultProcMount: ProcMountType & "Default"
+DefaultProcMount :: ProcMountType & "Default"
 
 // UnmaskedProcMount bypasses the default masking behavior of the container
 // runtime and ensures the newly created /proc the container stays in tact with
 // no modifications.
-UnmaskedProcMount: ProcMountType & "Unmasked"
+UnmaskedProcMount :: ProcMountType & "Unmasked"
 
 // SELinuxOptions are the labels to be applied to the container
-SELinuxOptions: {
+SELinuxOptions :: {
 	// User is a SELinux user label that applies to the container.
 	// +optional
 	user?: string @go(User) @protobuf(1,bytes,opt)
@@ -6136,7 +6245,7 @@
 }
 
 // WindowsSecurityContextOptions contain Windows-specific options and credentials.
-WindowsSecurityContextOptions: {
+WindowsSecurityContextOptions :: {
 	// GMSACredentialSpecName is the name of the GMSA credential spec to use.
 	// This field is alpha-level and is only honored by servers that enable the WindowsGMSA feature flag.
 	// +optional
@@ -6159,7 +6268,9 @@
 }
 
 // RangeAllocation is not a public type.
-RangeAllocation: metav1.TypeMeta & {
+RangeAllocation :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -6173,16 +6284,16 @@
 }
 
 // "default-scheduler" is the name of default scheduler.
-DefaultSchedulerName: "default-scheduler"
+DefaultSchedulerName :: "default-scheduler"
 
 // RequiredDuringScheduling affinity is not symmetric, but there is an implicit PreferredDuringScheduling affinity rule
 // corresponding to every RequiredDuringScheduling affinity rule.
 // When the --hard-pod-affinity-weight scheduler flag is not specified,
 // DefaultHardPodAffinityWeight defines the weight of the implicit PreferredDuringScheduling affinity rule.
-DefaultHardPodAffinitySymmetricWeight: int32 & 1
+DefaultHardPodAffinitySymmetricWeight :: int32 & 1
 
 // Sysctl defines a kernel parameter to be set
-Sysctl: {
+Sysctl :: {
 	// Name of a property to set
 	name: string @go(Name) @protobuf(1,bytes,opt)
 
@@ -6192,50 +6303,50 @@
 
 // NodeResources is an object for conveying resource information about a node.
 // see http://releases.k8s.io/HEAD/docs/design/resources.md for more details.
-NodeResources: {
+NodeResources :: {
 	// Capacity represents the available resources of a node
 	Capacity: ResourceList @protobuf(1,bytes,rep,name=capacity,casttype=ResourceList,castkey=ResourceName)
 }
 
 // Enable stdin for remote command execution
-ExecStdinParam: "input"
+ExecStdinParam :: "input"
 
 // Enable stdout for remote command execution
-ExecStdoutParam: "output"
+ExecStdoutParam :: "output"
 
 // Enable stderr for remote command execution
-ExecStderrParam: "error"
+ExecStderrParam :: "error"
 
 // Enable TTY for remote command execution
-ExecTTYParam: "tty"
+ExecTTYParam :: "tty"
 
 // Command to run for remote command execution
-ExecCommandParam: "command"
+ExecCommandParam :: "command"
 
 // Name of header that specifies stream type
-StreamType: "streamType"
+StreamType :: "streamType"
 
 // Value for streamType header for stdin stream
-StreamTypeStdin: "stdin"
+StreamTypeStdin :: "stdin"
 
 // Value for streamType header for stdout stream
-StreamTypeStdout: "stdout"
+StreamTypeStdout :: "stdout"
 
 // Value for streamType header for stderr stream
-StreamTypeStderr: "stderr"
+StreamTypeStderr :: "stderr"
 
 // Value for streamType header for data stream
-StreamTypeData: "data"
+StreamTypeData :: "data"
 
 // Value for streamType header for error stream
-StreamTypeError: "error"
+StreamTypeError :: "error"
 
 // Value for streamType header for terminal resize stream
-StreamTypeResize: "resize"
+StreamTypeResize :: "resize"
 
 // Name of header that specifies the port being forwarded
-PortHeader: "port"
+PortHeader :: "port"
 
 // Name of header that specifies a request ID used to associate the error
 // and data streams for a single forwarded connection
-PortForwardRequestIDHeader: "requestID"
+PortForwardRequestIDHeader :: "requestID"
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/core/v1/well_known_labels_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/core/v1/well_known_labels_go_gen.cue
index fcc2cf9..69f2086 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/core/v1/well_known_labels_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/core/v1/well_known_labels_go_gen.cue
@@ -4,24 +4,24 @@
 
 package v1
 
-LabelHostname:          "kubernetes.io/hostname"
-LabelZoneFailureDomain: "failure-domain.beta.kubernetes.io/zone"
-LabelZoneRegion:        "failure-domain.beta.kubernetes.io/region"
-LabelInstanceType:      "beta.kubernetes.io/instance-type"
-LabelOSStable:          "kubernetes.io/os"
-LabelArchStable:        "kubernetes.io/arch"
+LabelHostname ::          "kubernetes.io/hostname"
+LabelZoneFailureDomain :: "failure-domain.beta.kubernetes.io/zone"
+LabelZoneRegion ::        "failure-domain.beta.kubernetes.io/region"
+LabelInstanceType ::      "beta.kubernetes.io/instance-type"
+LabelOSStable ::          "kubernetes.io/os"
+LabelArchStable ::        "kubernetes.io/arch"
 
 // LabelNamespaceSuffixKubelet is an allowed label namespace suffix kubelets can self-set ([*.]kubelet.kubernetes.io/*)
-LabelNamespaceSuffixKubelet: "kubelet.kubernetes.io"
+LabelNamespaceSuffixKubelet :: "kubelet.kubernetes.io"
 
 // LabelNamespaceSuffixNode is an allowed label namespace suffix kubelets can self-set ([*.]node.kubernetes.io/*)
-LabelNamespaceSuffixNode: "node.kubernetes.io"
+LabelNamespaceSuffixNode :: "node.kubernetes.io"
 
 // LabelNamespaceNodeRestriction is a forbidden label namespace that kubelets may not self-set when the NodeRestriction admission plugin is enabled
-LabelNamespaceNodeRestriction: "node-restriction.kubernetes.io"
+LabelNamespaceNodeRestriction :: "node-restriction.kubernetes.io"
 
 // IsHeadlessService is added by Controller to an Endpoint denoting if its parent
 // Service is Headless. The existence of this label can be used further by other
 // controllers and kube-proxy to check if the Endpoint objects should be replicated when
 // using Headless Services
-IsHeadlessService: "service.kubernetes.io/headless"
+IsHeadlessService :: "service.kubernetes.io/headless"
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/extensions/v1beta1/register_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/extensions/v1beta1/register_go_gen.cue
index 8ee73e9..2ba9aa1 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/extensions/v1beta1/register_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/extensions/v1beta1/register_go_gen.cue
@@ -4,4 +4,4 @@
 
 package v1beta1
 
-GroupName: "extensions"
+GroupName :: "extensions"
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/extensions/v1beta1/types_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/extensions/v1beta1/types_go_gen.cue
index 2bf7d72..ee8b19d 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/extensions/v1beta1/types_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/api/extensions/v1beta1/types_go_gen.cue
@@ -11,14 +11,14 @@
 )
 
 // describes the attributes of a scale subresource
-ScaleSpec: {
+ScaleSpec :: {
 	// desired number of instances for the scaled object.
 	// +optional
 	replicas?: int32 @go(Replicas) @protobuf(1,varint,opt)
 }
 
 // represents the current status of a scale subresource.
-ScaleStatus: {
+ScaleStatus :: {
 	// actual number of observed instances of the scaled object.
 	replicas: int32 @go(Replicas) @protobuf(1,varint,opt)
 
@@ -37,7 +37,9 @@
 }
 
 // represents a scaling request for a resource.
-Scale: metav1.TypeMeta & {
+Scale :: {
+	(metav1.TypeMeta)
+
 	// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
 	// +optional
 	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
@@ -52,13 +54,17 @@
 }
 
 // Dummy definition
-ReplicationControllerDummy: metav1.TypeMeta & {
+ReplicationControllerDummy :: {
+	(metav1.TypeMeta)
+
 }
 
 // DEPRECATED - This group version of Deployment is deprecated by apps/v1beta2/Deployment. See the release notes for
 // more information.
 // Deployment enables declarative updates for Pods and ReplicaSets.
-Deployment: metav1.TypeMeta & {
+Deployment :: {
+	(metav1.TypeMeta)
+
 	// Standard object metadata.
 	// +optional
 	metadata?: metav1.ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)
@@ -73,7 +79,7 @@
 }
 
 // DeploymentSpec is the specification of the desired behavior of the Deployment.
-DeploymentSpec: {
+DeploymentSpec :: {
 	// Number of desired pods. This is a pointer to distinguish between explicit
 	// zero and not specified. Defaults to 1.
 	// +optional
@@ -127,7 +133,9 @@
 
 // DEPRECATED.
 // DeploymentRollback stores the information required to rollback a deployment.
-DeploymentRollback: metav1.TypeMeta & {
+DeploymentRollback :: {
+	(metav1.TypeMeta)
+
 	// Required: This must match the Name of a deployment.
 	name: string @go(Name) @protobuf(1,bytes,opt)
 
@@ -140,7 +148,7 @@
 }
 
 // DEPRECATED.
-RollbackConfig: {
+RollbackConfig :: {
 	// The revision to rollback to. If set to 0, rollback to the last revision.
 	// +optional
 	revision?: int64 @go(Revision) @protobuf(1,varint,opt)
@@ -149,10 +157,10 @@
 // DefaultDeploymentUniqueLabelKey is the default key of the selector that is added
 // to existing RCs (and label key that is added to its pods) to prevent the existing RCs
 // to select new pods (and old pods being select by new RC).
-DefaultDeploymentUniqueLabelKey: "pod-template-hash"
+DefaultDeploymentUniqueLabelKey :: "pod-template-hash"
 
 // DeploymentStrategy describes how to replace existing pods with new ones.
-DeploymentStrategy: {
+DeploymentStrategy :: {
 	// Type of deployment. Can be "Recreate" or "RollingUpdate". Default is RollingUpdate.
 	// +optional
 	type?: DeploymentStrategyType @go(Type) @protobuf(1,bytes,opt,casttype=DeploymentStrategyType)
@@ -166,20 +174,20 @@
 	rollingUpdate?: null | RollingUpdateDeployment @go(RollingUpdate,*RollingUpdateDeployment) @protobuf(2,bytes,opt)
 }
 
-DeploymentStrategyType: string // enumDeploymentStrategyType
+DeploymentStrategyType :: string // enumDeploymentStrategyType
 
-enumDeploymentStrategyType:
+enumDeploymentStrategyType ::
 	RecreateDeploymentStrategyType |
 	RollingUpdateDeploymentStrategyType
 
 // Kill all existing pods before creating new ones.
-RecreateDeploymentStrategyType: DeploymentStrategyType & "Recreate"
+RecreateDeploymentStrategyType :: DeploymentStrategyType & "Recreate"
 
 // Replace the old RCs by new one using rolling update i.e gradually scale down the old RCs and scale up the new one.
-RollingUpdateDeploymentStrategyType: DeploymentStrategyType & "RollingUpdate"
+RollingUpdateDeploymentStrategyType :: DeploymentStrategyType & "RollingUpdate"
 
 // Spec to control the desired behavior of rolling update.
-RollingUpdateDeployment: {
+RollingUpdateDeployment :: {
 	// The maximum number of pods that can be unavailable during the update.
 	// Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
 	// Absolute number is calculated from percentage by rounding down.
@@ -209,7 +217,7 @@
 }
 
 // DeploymentStatus is the most recently observed status of the Deployment.
-DeploymentStatus: {
+DeploymentStatus :: {
 	// The generation observed by the deployment controller.
 	// +optional
 	observedGeneration?: int64 @go(ObservedGeneration) @protobuf(1,varint,opt)
@@ -248,29 +256,29 @@
 	collisionCount?: null | int32 @go(CollisionCount,*int32) @protobuf(8,varint,opt)
 }
 
-DeploymentConditionType: string // enumDeploymentConditionType
+DeploymentConditionType :: string // enumDeploymentConditionType
 
-enumDeploymentConditionType:
+enumDeploymentConditionType ::
 	DeploymentAvailable |
 	DeploymentProgressing |
 	DeploymentReplicaFailure
 
 // Available means the deployment is available, ie. at least the minimum available
 // replicas required are up and running for at least minReadySeconds.
-DeploymentAvailable: DeploymentConditionType & "Available"
+DeploymentAvailable :: DeploymentConditionType & "Available"
 
 // Progressing means the deployment is progressing. Progress for a deployment is
 // considered when a new replica set is created or adopted, and when new pods scale
 // up or old pods scale down. Progress is not estimated for paused deployments or
 // when progressDeadlineSeconds is not specified.
-DeploymentProgressing: DeploymentConditionType & "Progressing"
+DeploymentProgressing :: DeploymentConditionType & "Progressing"
 
 // ReplicaFailure is added in a deployment when one of its pods fails to be created
 // or deleted.
-DeploymentReplicaFailure: DeploymentConditionType & "ReplicaFailure"
+DeploymentReplicaFailure :: DeploymentConditionType & "ReplicaFailure"
 
 // DeploymentCondition describes the state of a deployment at a certain point.
-DeploymentCondition: {
+DeploymentCondition :: {
 	// Type of deployment condition.
 	type: DeploymentConditionType @go(Type) @protobuf(1,bytes,opt,casttype=DeploymentConditionType)
 
@@ -291,7 +299,9 @@
 }
 
 // DeploymentList is a list of Deployments.
-DeploymentList: metav1.TypeMeta & {
+DeploymentList :: {
+	(metav1.TypeMeta)
+
 	// Standard list metadata.
 	// +optional
 	metadata?: metav1.ListMeta @go(ListMeta) @protobuf(1,bytes,opt)
@@ -300,7 +310,7 @@
 	items: [...Deployment] @go(Items,[]Deployment) @protobuf(2,bytes,rep)
 }
 
-DaemonSetUpdateStrategy: {
+DaemonSetUpdateStrategy :: {
 	// Type of daemon set update. Can be "RollingUpdate" or "OnDelete".
 	// Default is OnDelete.
 	// +optional
@@ -315,20 +325,20 @@
 	rollingUpdate?: null | RollingUpdateDaemonSet @go(RollingUpdate,*RollingUpdateDaemonSet) @protobuf(2,bytes,opt)
 }
 
-DaemonSetUpdateStrategyType: string // enumDaemonSetUpdateStrategyType
+DaemonSetUpdateStrategyType :: string // enumDaemonSetUpdateStrategyType
 
-enumDaemonSetUpdateStrategyType:
+enumDaemonSetUpdateStrategyType ::
 	RollingUpdateDaemonSetStrategyType |
 	OnDeleteDaemonSetStrategyType
 
 // Replace the old daemons by new ones using rolling update i.e replace them on each node one after the other.
-RollingUpdateDaemonSetStrategyType: DaemonSetUpdateStrategyType & "RollingUpdate"
+RollingUpdateDaemonSetStrategyType :: DaemonSetUpdateStrategyType & "RollingUpdate"
 
 // Replace the old daemons only when it's killed
-OnDeleteDaemonSetStrategyType: DaemonSetUpdateStrategyType & "OnDelete"
+OnDeleteDaemonSetStrategyType :: DaemonSetUpdateStrategyType & "OnDelete"
 
 // Spec to control the desired behavior of daemon set rolling update.
-RollingUpdateDaemonSet: {
+RollingUpdateDaemonSet :: {
 	// The maximum number of DaemonSet pods that can be unavailable during the
 	// update. Value can be an absolute number (ex: 5) or a percentage of total
 	// number of DaemonSet pods at the start of the update (ex: 10%). Absolute
@@ -348,7 +358,7 @@
 }
 
 // DaemonSetSpec is the specification of a daemon set.
-DaemonSetSpec: {
+DaemonSetSpec :: {
 	// A label query over pods that are managed by the daemon set.
 	// Must match in order to be controlled.
 	// If empty, defaulted to labels on Pod template.
@@ -388,7 +398,7 @@
 }
 
 // DaemonSetStatus represents the current status of a daemon set.
-DaemonSetStatus: {
+DaemonSetStatus :: {
 	// The number of nodes that are running at least 1
 	// daemon pod and are supposed to run the daemon pod.
 	// More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/
@@ -441,10 +451,10 @@
 	conditions?: [...DaemonSetCondition] @go(Conditions,[]DaemonSetCondition) @protobuf(10,bytes,rep)
 }
 
-DaemonSetConditionType: string
+DaemonSetConditionType :: string
 
 // DaemonSetCondition describes the state of a DaemonSet at a certain point.
-DaemonSetCondition: {
+DaemonSetCondition :: {
 	// Type of DaemonSet condition.
 	type: DaemonSetConditionType @go(Type) @protobuf(1,bytes,opt,casttype=DaemonSetConditionType)
 
@@ -467,7 +477,9 @@
 // DEPRECATED - This group version of DaemonSet is deprecated by apps/v1beta2/DaemonSet. See the release notes for
 // more information.
 // DaemonSet represents the configuration of a daemon set.
-DaemonSet: metav1.TypeMeta & {
+DaemonSet :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -491,15 +503,17 @@
 // DaemonSetTemplateGenerationKey is the key of the labels that is added
 // to daemon set pods to distinguish between old and new pod templates
 // during DaemonSet template update.
-DaemonSetTemplateGenerationKey: "pod-template-generation"
+DaemonSetTemplateGenerationKey :: "pod-template-generation"
 
 // DefaultDaemonSetUniqueLabelKey is the default label key that is added
 // to existing DaemonSet pods to distinguish between old and new
 // DaemonSet pods during DaemonSet template updates.
-DefaultDaemonSetUniqueLabelKey: "controller-revision-hash"
+DefaultDaemonSetUniqueLabelKey :: "controller-revision-hash"
 
 // DaemonSetList is a collection of daemon sets.
-DaemonSetList: metav1.TypeMeta & {
+DaemonSetList :: {
+	(metav1.TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -514,7 +528,9 @@
 // externally-reachable urls, load balance traffic, terminate SSL, offer name
 // based virtual hosting etc.
 // DEPRECATED - This group version of Ingress is deprecated by networking.k8s.io/v1beta1 Ingress. See the release notes for more information.
-Ingress: metav1.TypeMeta & {
+Ingress :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -532,7 +548,9 @@
 }
 
 // IngressList is a collection of Ingress.
-IngressList: metav1.TypeMeta & {
+IngressList :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -543,7 +561,7 @@
 }
 
 // IngressSpec describes the Ingress the user wishes to exist.
-IngressSpec: {
+IngressSpec :: {
 	// A default backend capable of servicing requests that don't match any
 	// rule. At least one of 'backend' or 'rules' must be specified. This field
 	// is optional to allow the loadbalancer controller or defaulting logic to
@@ -566,7 +584,7 @@
 }
 
 // IngressTLS describes the transport layer security associated with an Ingress.
-IngressTLS: {
+IngressTLS :: {
 	// Hosts are a list of hosts included in the TLS certificate. The values in
 	// this list must match the name/s used in the tlsSecret. Defaults to the
 	// wildcard host setting for the loadbalancer controller fulfilling this
@@ -584,7 +602,7 @@
 }
 
 // IngressStatus describe the current state of the Ingress.
-IngressStatus: {
+IngressStatus :: {
 	// LoadBalancer contains the current status of the load-balancer.
 	// +optional
 	loadBalancer?: v1.LoadBalancerStatus @go(LoadBalancer) @protobuf(1,bytes,opt)
@@ -593,7 +611,7 @@
 // IngressRule represents the rules mapping the paths under a specified host to
 // the related backend services. Incoming requests are first evaluated for a host
 // match, then routed to the backend associated with the matching IngressRuleValue.
-IngressRule: IngressRuleValue & {
+IngressRule :: {
 	// Host is the fully qualified domain name of a network host, as defined
 	// by RFC 3986. Note the following deviations from the "host" part of the
 	// URI as defined in the RFC:
@@ -608,13 +626,16 @@
 	// specified IngressRuleValue.
 	// +optional
 	host?: string @go(Host) @protobuf(1,bytes,opt)
+
+	(IngressRuleValue)
+
 }
 
 // IngressRuleValue represents a rule to apply against incoming requests. If the
 // rule is satisfied, the request is routed to the specified backend. Currently
 // mixing different types of rules in a single Ingress is disallowed, so exactly
 // one of the following must be set.
-IngressRuleValue: {
+IngressRuleValue :: {
 	// +optional
 	http?: null | HTTPIngressRuleValue @go(HTTP,*HTTPIngressRuleValue) @protobuf(1,bytes,opt)
 }
@@ -624,14 +645,14 @@
 // where parts of the url correspond to RFC 3986, this resource will be used
 // to match against everything after the last '/' and before the first '?'
 // or '#'.
-HTTPIngressRuleValue: {
+HTTPIngressRuleValue :: {
 	// A collection of paths that map requests to backends.
 	paths: [...HTTPIngressPath] @go(Paths,[]HTTPIngressPath) @protobuf(1,bytes,rep)
 }
 
 // HTTPIngressPath associates a path regex with a backend. Incoming urls matching
 // the path are forwarded to the backend.
-HTTPIngressPath: {
+HTTPIngressPath :: {
 	// Path is an extended POSIX regex as defined by IEEE Std 1003.1,
 	// (i.e this follows the egrep/unix syntax, not the perl syntax)
 	// matched against the path of an incoming request. Currently it can
@@ -648,7 +669,7 @@
 }
 
 // IngressBackend describes all endpoints for a given service and port.
-IngressBackend: {
+IngressBackend :: {
 	// Specifies the name of the referenced service.
 	serviceName: string @go(ServiceName) @protobuf(1,bytes,opt)
 
@@ -659,7 +680,9 @@
 // DEPRECATED - This group version of ReplicaSet is deprecated by apps/v1beta2/ReplicaSet. See the release notes for
 // more information.
 // ReplicaSet ensures that a specified number of pod replicas are running at any given time.
-ReplicaSet: metav1.TypeMeta & {
+ReplicaSet :: {
+	(metav1.TypeMeta)
+
 	// If the Labels of a ReplicaSet are empty, they are defaulted to
 	// be the same as the Pod(s) that the ReplicaSet manages.
 	// Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
@@ -681,7 +704,9 @@
 }
 
 // ReplicaSetList is a collection of ReplicaSets.
-ReplicaSetList: metav1.TypeMeta & {
+ReplicaSetList :: {
+	(metav1.TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -693,7 +718,7 @@
 }
 
 // ReplicaSetSpec is the specification of a ReplicaSet.
-ReplicaSetSpec: {
+ReplicaSetSpec :: {
 	// Replicas is the number of desired replicas.
 	// This is a pointer to distinguish between explicit zero and unspecified.
 	// Defaults to 1.
@@ -722,7 +747,7 @@
 }
 
 // ReplicaSetStatus represents the current status of a ReplicaSet.
-ReplicaSetStatus: {
+ReplicaSetStatus :: {
 	// Replicas is the most recently oberved number of replicas.
 	// More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller/#what-is-a-replicationcontroller
 	replicas: int32 @go(Replicas) @protobuf(1,varint,opt)
@@ -750,18 +775,18 @@
 	conditions?: [...ReplicaSetCondition] @go(Conditions,[]ReplicaSetCondition) @protobuf(6,bytes,rep)
 }
 
-ReplicaSetConditionType: string // enumReplicaSetConditionType
+ReplicaSetConditionType :: string // enumReplicaSetConditionType
 
-enumReplicaSetConditionType:
+enumReplicaSetConditionType ::
 	ReplicaSetReplicaFailure
 
 // ReplicaSetReplicaFailure is added in a replica set when one of its pods fails to be created
 // due to insufficient quota, limit ranges, pod security policy, node selectors, etc. or deleted
 // due to kubelet being down or finalizers are failing.
-ReplicaSetReplicaFailure: ReplicaSetConditionType & "ReplicaFailure"
+ReplicaSetReplicaFailure :: ReplicaSetConditionType & "ReplicaFailure"
 
 // ReplicaSetCondition describes the state of a replica set at a certain point.
-ReplicaSetCondition: {
+ReplicaSetCondition :: {
 	// Type of replica set condition.
 	type: ReplicaSetConditionType @go(Type) @protobuf(1,bytes,opt,casttype=ReplicaSetConditionType)
 
@@ -784,7 +809,9 @@
 // PodSecurityPolicy governs the ability to make requests that affect the Security Context
 // that will be applied to a pod and container.
 // Deprecated: use PodSecurityPolicy from policy API Group instead.
-PodSecurityPolicy: metav1.TypeMeta & {
+PodSecurityPolicy :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -797,7 +824,7 @@
 
 // PodSecurityPolicySpec defines the policy enforced.
 // Deprecated: use PodSecurityPolicySpec from policy API Group instead.
-PodSecurityPolicySpec: {
+PodSecurityPolicySpec :: {
 	// privileged determines if a pod can request to be run as privileged.
 	// +optional
 	privileged?: bool @go(Privileged) @protobuf(1,varint,opt)
@@ -930,7 +957,7 @@
 // AllowedHostPath defines the host volume conditions that will be enabled by a policy
 // for pods to use. It requires the path prefix to be defined.
 // Deprecated: use AllowedHostPath from policy API Group instead.
-AllowedHostPath: {
+AllowedHostPath :: {
 	// pathPrefix is the path prefix that the host volume must match.
 	// It does not support `*`.
 	// Trailing slashes are trimmed when validating the path prefix with a host path.
@@ -947,17 +974,17 @@
 
 // FSType gives strong typing to different file systems that are used by volumes.
 // Deprecated: use FSType from policy API Group instead.
-FSType: string
+FSType :: string
 
 // AllowedFlexVolume represents a single Flexvolume that is allowed to be used.
 // Deprecated: use AllowedFlexVolume from policy API Group instead.
-AllowedFlexVolume: {
+AllowedFlexVolume :: {
 	// driver is the name of the Flexvolume driver.
 	driver: string @go(Driver) @protobuf(1,bytes,opt)
 }
 
 // AllowedCSIDriver represents a single inline CSI Driver that is allowed to be used.
-AllowedCSIDriver: {
+AllowedCSIDriver :: {
 	// Name is the registered name of the CSI driver
 	name: string @go(Name) @protobuf(1,bytes,opt)
 }
@@ -965,7 +992,7 @@
 // HostPortRange defines a range of host ports that will be enabled by a policy
 // for pods to use.  It requires both the start and end to be defined.
 // Deprecated: use HostPortRange from policy API Group instead.
-HostPortRange: {
+HostPortRange :: {
 	// min is the start of the range, inclusive.
 	min: int32 @go(Min) @protobuf(1,varint,opt)
 
@@ -975,7 +1002,7 @@
 
 // SELinuxStrategyOptions defines the strategy type and any options used to create the strategy.
 // Deprecated: use SELinuxStrategyOptions from policy API Group instead.
-SELinuxStrategyOptions: {
+SELinuxStrategyOptions :: {
 	// rule is the strategy that will dictate the allowable labels that may be set.
 	rule: SELinuxStrategy @go(Rule) @protobuf(1,bytes,opt,casttype=SELinuxStrategy)
 
@@ -988,23 +1015,23 @@
 // SELinuxStrategy denotes strategy types for generating SELinux options for a
 // Security Context.
 // Deprecated: use SELinuxStrategy from policy API Group instead.
-SELinuxStrategy: string // enumSELinuxStrategy
+SELinuxStrategy :: string // enumSELinuxStrategy
 
-enumSELinuxStrategy:
+enumSELinuxStrategy ::
 	SELinuxStrategyMustRunAs |
 	SELinuxStrategyRunAsAny
 
 // SELinuxStrategyMustRunAs means that container must have SELinux labels of X applied.
 // Deprecated: use SELinuxStrategyMustRunAs from policy API Group instead.
-SELinuxStrategyMustRunAs: SELinuxStrategy & "MustRunAs"
+SELinuxStrategyMustRunAs :: SELinuxStrategy & "MustRunAs"
 
 // SELinuxStrategyRunAsAny means that container may make requests for any SELinux context labels.
 // Deprecated: use SELinuxStrategyRunAsAny from policy API Group instead.
-SELinuxStrategyRunAsAny: SELinuxStrategy & "RunAsAny"
+SELinuxStrategyRunAsAny :: SELinuxStrategy & "RunAsAny"
 
 // RunAsUserStrategyOptions defines the strategy type and any options used to create the strategy.
 // Deprecated: use RunAsUserStrategyOptions from policy API Group instead.
-RunAsUserStrategyOptions: {
+RunAsUserStrategyOptions :: {
 	// rule is the strategy that will dictate the allowable RunAsUser values that may be set.
 	rule: RunAsUserStrategy @go(Rule) @protobuf(1,bytes,opt,casttype=RunAsUserStrategy)
 
@@ -1016,7 +1043,7 @@
 
 // RunAsGroupStrategyOptions defines the strategy type and any options used to create the strategy.
 // Deprecated: use RunAsGroupStrategyOptions from policy API Group instead.
-RunAsGroupStrategyOptions: {
+RunAsGroupStrategyOptions :: {
 	// rule is the strategy that will dictate the allowable RunAsGroup values that may be set.
 	rule: RunAsGroupStrategy @go(Rule) @protobuf(1,bytes,opt,casttype=RunAsGroupStrategy)
 
@@ -1028,7 +1055,7 @@
 
 // IDRange provides a min/max of an allowed range of IDs.
 // Deprecated: use IDRange from policy API Group instead.
-IDRange: {
+IDRange :: {
 	// min is the start of the range, inclusive.
 	min: int64 @go(Min) @protobuf(1,varint,opt)
 
@@ -1039,50 +1066,50 @@
 // RunAsUserStrategy denotes strategy types for generating RunAsUser values for a
 // Security Context.
 // Deprecated: use RunAsUserStrategy from policy API Group instead.
-RunAsUserStrategy: string // enumRunAsUserStrategy
+RunAsUserStrategy :: string // enumRunAsUserStrategy
 
-enumRunAsUserStrategy:
+enumRunAsUserStrategy ::
 	RunAsUserStrategyMustRunAs |
 	RunAsUserStrategyMustRunAsNonRoot |
 	RunAsUserStrategyRunAsAny
 
 // RunAsUserStrategyMustRunAs means that container must run as a particular uid.
 // Deprecated: use RunAsUserStrategyMustRunAs from policy API Group instead.
-RunAsUserStrategyMustRunAs: RunAsUserStrategy & "MustRunAs"
+RunAsUserStrategyMustRunAs :: RunAsUserStrategy & "MustRunAs"
 
 // RunAsUserStrategyMustRunAsNonRoot means that container must run as a non-root uid.
 // Deprecated: use RunAsUserStrategyMustRunAsNonRoot from policy API Group instead.
-RunAsUserStrategyMustRunAsNonRoot: RunAsUserStrategy & "MustRunAsNonRoot"
+RunAsUserStrategyMustRunAsNonRoot :: RunAsUserStrategy & "MustRunAsNonRoot"
 
 // RunAsUserStrategyRunAsAny means that container may make requests for any uid.
 // Deprecated: use RunAsUserStrategyRunAsAny from policy API Group instead.
-RunAsUserStrategyRunAsAny: RunAsUserStrategy & "RunAsAny"
+RunAsUserStrategyRunAsAny :: RunAsUserStrategy & "RunAsAny"
 
 // RunAsGroupStrategy denotes strategy types for generating RunAsGroup values for a
 // Security Context.
 // Deprecated: use RunAsGroupStrategy from policy API Group instead.
-RunAsGroupStrategy: string // enumRunAsGroupStrategy
+RunAsGroupStrategy :: string // enumRunAsGroupStrategy
 
-enumRunAsGroupStrategy:
+enumRunAsGroupStrategy ::
 	RunAsGroupStrategyMayRunAs |
 	RunAsGroupStrategyMustRunAs |
 	RunAsGroupStrategyRunAsAny
 
 // RunAsGroupStrategyMayRunAs means that container does not need to run with a particular gid.
 // However, when RunAsGroup are specified, they have to fall in the defined range.
-RunAsGroupStrategyMayRunAs: RunAsGroupStrategy & "MayRunAs"
+RunAsGroupStrategyMayRunAs :: RunAsGroupStrategy & "MayRunAs"
 
 // RunAsGroupStrategyMustRunAs means that container must run as a particular gid.
 // Deprecated: use RunAsGroupStrategyMustRunAs from policy API Group instead.
-RunAsGroupStrategyMustRunAs: RunAsGroupStrategy & "MustRunAs"
+RunAsGroupStrategyMustRunAs :: RunAsGroupStrategy & "MustRunAs"
 
 // RunAsGroupStrategyRunAsAny means that container may make requests for any gid.
 // Deprecated: use RunAsGroupStrategyRunAsAny from policy API Group instead.
-RunAsGroupStrategyRunAsAny: RunAsGroupStrategy & "RunAsAny"
+RunAsGroupStrategyRunAsAny :: RunAsGroupStrategy & "RunAsAny"
 
 // FSGroupStrategyOptions defines the strategy type and options used to create the strategy.
 // Deprecated: use FSGroupStrategyOptions from policy API Group instead.
-FSGroupStrategyOptions: {
+FSGroupStrategyOptions :: {
 	// rule is the strategy that will dictate what FSGroup is used in the SecurityContext.
 	// +optional
 	rule?: FSGroupStrategyType @go(Rule) @protobuf(1,bytes,opt,casttype=FSGroupStrategyType)
@@ -1096,23 +1123,23 @@
 // FSGroupStrategyType denotes strategy types for generating FSGroup values for a
 // SecurityContext
 // Deprecated: use FSGroupStrategyType from policy API Group instead.
-FSGroupStrategyType: string // enumFSGroupStrategyType
+FSGroupStrategyType :: string // enumFSGroupStrategyType
 
-enumFSGroupStrategyType:
+enumFSGroupStrategyType ::
 	FSGroupStrategyMustRunAs |
 	FSGroupStrategyRunAsAny
 
 // FSGroupStrategyMustRunAs meant that container must have FSGroup of X applied.
 // Deprecated: use FSGroupStrategyMustRunAs from policy API Group instead.
-FSGroupStrategyMustRunAs: FSGroupStrategyType & "MustRunAs"
+FSGroupStrategyMustRunAs :: FSGroupStrategyType & "MustRunAs"
 
 // FSGroupStrategyRunAsAny means that container may make requests for any FSGroup labels.
 // Deprecated: use FSGroupStrategyRunAsAny from policy API Group instead.
-FSGroupStrategyRunAsAny: FSGroupStrategyType & "RunAsAny"
+FSGroupStrategyRunAsAny :: FSGroupStrategyType & "RunAsAny"
 
 // SupplementalGroupsStrategyOptions defines the strategy type and options used to create the strategy.
 // Deprecated: use SupplementalGroupsStrategyOptions from policy API Group instead.
-SupplementalGroupsStrategyOptions: {
+SupplementalGroupsStrategyOptions :: {
 	// rule is the strategy that will dictate what supplemental groups is used in the SecurityContext.
 	// +optional
 	rule?: SupplementalGroupsStrategyType @go(Rule) @protobuf(1,bytes,opt,casttype=SupplementalGroupsStrategyType)
@@ -1126,23 +1153,23 @@
 // SupplementalGroupsStrategyType denotes strategy types for determining valid supplemental
 // groups for a SecurityContext.
 // Deprecated: use SupplementalGroupsStrategyType from policy API Group instead.
-SupplementalGroupsStrategyType: string // enumSupplementalGroupsStrategyType
+SupplementalGroupsStrategyType :: string // enumSupplementalGroupsStrategyType
 
-enumSupplementalGroupsStrategyType:
+enumSupplementalGroupsStrategyType ::
 	SupplementalGroupsStrategyMustRunAs |
 	SupplementalGroupsStrategyRunAsAny
 
 // SupplementalGroupsStrategyMustRunAs means that container must run as a particular gid.
 // Deprecated: use SupplementalGroupsStrategyMustRunAs from policy API Group instead.
-SupplementalGroupsStrategyMustRunAs: SupplementalGroupsStrategyType & "MustRunAs"
+SupplementalGroupsStrategyMustRunAs :: SupplementalGroupsStrategyType & "MustRunAs"
 
 // SupplementalGroupsStrategyRunAsAny means that container may make requests for any gid.
 // Deprecated: use SupplementalGroupsStrategyRunAsAny from policy API Group instead.
-SupplementalGroupsStrategyRunAsAny: SupplementalGroupsStrategyType & "RunAsAny"
+SupplementalGroupsStrategyRunAsAny :: SupplementalGroupsStrategyType & "RunAsAny"
 
 // RuntimeClassStrategyOptions define the strategy that will dictate the allowable RuntimeClasses
 // for a pod.
-RuntimeClassStrategyOptions: {
+RuntimeClassStrategyOptions :: {
 	// allowedRuntimeClassNames is a whitelist of RuntimeClass names that may be specified on a pod.
 	// A value of "*" means that any RuntimeClass name is allowed, and must be the only item in the
 	// list. An empty list requires the RuntimeClassName field to be unset.
@@ -1155,11 +1182,13 @@
 	defaultRuntimeClassName?: null | string @go(DefaultRuntimeClassName,*string) @protobuf(2,bytes,opt)
 }
 
-AllowAllRuntimeClassNames: "*"
+AllowAllRuntimeClassNames :: "*"
 
 // PodSecurityPolicyList is a list of PodSecurityPolicy objects.
 // Deprecated: use PodSecurityPolicyList from policy API Group instead.
-PodSecurityPolicyList: metav1.TypeMeta & {
+PodSecurityPolicyList :: {
+	(metav1.TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -1171,7 +1200,9 @@
 
 // DEPRECATED 1.9 - This group version of NetworkPolicy is deprecated by networking/v1/NetworkPolicy.
 // NetworkPolicy describes what network traffic is allowed for a set of Pods
-NetworkPolicy: metav1.TypeMeta & {
+NetworkPolicy :: {
+	(metav1.TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -1185,20 +1216,20 @@
 // DEPRECATED 1.9 - This group version of PolicyType is deprecated by networking/v1/PolicyType.
 // Policy Type string describes the NetworkPolicy type
 // This type is beta-level in 1.8
-PolicyType: string // enumPolicyType
+PolicyType :: string // enumPolicyType
 
-enumPolicyType:
+enumPolicyType ::
 	PolicyTypeIngress |
 	PolicyTypeEgress
 
 // PolicyTypeIngress is a NetworkPolicy that affects ingress traffic on selected pods
-PolicyTypeIngress: PolicyType & "Ingress"
+PolicyTypeIngress :: PolicyType & "Ingress"
 
 // PolicyTypeEgress is a NetworkPolicy that affects egress traffic on selected pods
-PolicyTypeEgress: PolicyType & "Egress"
+PolicyTypeEgress :: PolicyType & "Egress"
 
 // DEPRECATED 1.9 - This group version of NetworkPolicySpec is deprecated by networking/v1/NetworkPolicySpec.
-NetworkPolicySpec: {
+NetworkPolicySpec :: {
 	// Selects the pods to which this NetworkPolicy object applies.  The array of ingress rules
 	// is applied to any pods selected by this field. Multiple network policies can select the
 	// same set of pods.  In this case, the ingress rules for each are combined additively.
@@ -1242,7 +1273,7 @@
 
 // DEPRECATED 1.9 - This group version of NetworkPolicyIngressRule is deprecated by networking/v1/NetworkPolicyIngressRule.
 // This NetworkPolicyIngressRule matches traffic if and only if the traffic matches both ports AND from.
-NetworkPolicyIngressRule: {
+NetworkPolicyIngressRule :: {
 	// List of ports which should be made accessible on the pods selected for this rule.
 	// Each item in this list is combined using a logical OR.
 	// If this field is empty or missing, this rule matches all ports (traffic not restricted by port).
@@ -1264,7 +1295,7 @@
 // NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods
 // matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to.
 // This type is beta-level in 1.8
-NetworkPolicyEgressRule: {
+NetworkPolicyEgressRule :: {
 	// List of destination ports for outgoing traffic.
 	// Each item in this list is combined using a logical OR. If this field is
 	// empty or missing, this rule matches all ports (traffic not restricted by port).
@@ -1283,7 +1314,7 @@
 }
 
 // DEPRECATED 1.9 - This group version of NetworkPolicyPort is deprecated by networking/v1/NetworkPolicyPort.
-NetworkPolicyPort: {
+NetworkPolicyPort :: {
 	// Optional.  The protocol (TCP, UDP, or SCTP) which traffic must match.
 	// If not specified, this field defaults to TCP.
 	// +optional
@@ -1302,7 +1333,7 @@
 // IPBlock describes a particular CIDR (Ex. "192.168.1.1/24") that is allowed to the pods
 // matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs that should
 // not be included within this rule.
-IPBlock: {
+IPBlock :: {
 	// CIDR is a string representing the IP Block
 	// Valid examples are "192.168.1.1/24"
 	cidr: string @go(CIDR) @protobuf(1,bytes)
@@ -1315,7 +1346,7 @@
 }
 
 // DEPRECATED 1.9 - This group version of NetworkPolicyPeer is deprecated by networking/v1/NetworkPolicyPeer.
-NetworkPolicyPeer: {
+NetworkPolicyPeer :: {
 	// This is a label selector which selects Pods. This field follows standard label
 	// selector semantics; if present but empty, it selects all pods.
 	//
@@ -1342,7 +1373,9 @@
 
 // DEPRECATED 1.9 - This group version of NetworkPolicyList is deprecated by networking/v1/NetworkPolicyList.
 // Network Policy List is a list of NetworkPolicy objects.
-NetworkPolicyList: metav1.TypeMeta & {
+NetworkPolicyList :: {
+	(metav1.TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/api/resource/amount_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/api/resource/amount_go_gen.cue
index e7d7544..7756e4a 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/api/resource/amount_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/api/resource/amount_go_gen.cue
@@ -7,9 +7,9 @@
 // Scale is used for getting and setting the base-10 scaled value.
 // Base-2 scales are omitted for mathematical simplicity.
 // See Quantity.ScaledValue for more details.
-Scale: int32 // enumScale
+Scale :: int32 // enumScale
 
-enumScale:
+enumScale ::
 	Nano |
 	Micro |
 	Milli |
@@ -20,12 +20,12 @@
 	Peta |
 	Exa
 
-Nano:  Scale & -9
-Micro: Scale & -6
-Milli: Scale & -3
-Kilo:  Scale & 3
-Mega:  Scale & 6
-Giga:  Scale & 9
-Tera:  Scale & 12
-Peta:  Scale & 15
-Exa:   Scale & 18
+Nano ::  Scale & -9
+Micro :: Scale & -6
+Milli :: Scale & -3
+Kilo ::  Scale & 3
+Mega ::  Scale & 6
+Giga ::  Scale & 9
+Tera ::  Scale & 12
+Peta ::  Scale & 15
+Exa ::   Scale & 18
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/api/resource/quantity_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/api/resource/quantity_go_gen.cue
index 56713df..e121546 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/api/resource/quantity_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/api/resource/quantity_go_gen.cue
@@ -62,19 +62,19 @@
 // +protobuf.options.(gogoproto.goproto_stringer)=false
 // +k8s:deepcopy-gen=true
 // +k8s:openapi-gen=true
-Quantity: _
+Quantity :: _
 
 // CanonicalValue allows a quantity amount to be converted to a string.
-CanonicalValue: _
+CanonicalValue :: _
 
 // Format lists the three possible formattings of a quantity.
-Format: string // enumFormat
+Format :: string // enumFormat
 
-enumFormat:
+enumFormat ::
 	DecimalExponent |
 	BinarySI |
 	DecimalSI
 
-DecimalExponent: Format & "DecimalExponent"
-BinarySI:        Format & "BinarySI"
-DecimalSI:       Format & "DecimalSI"
+DecimalExponent :: Format & "DecimalExponent"
+BinarySI ::        Format & "BinarySI"
+DecimalSI ::       Format & "DecimalSI"
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/duration_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/duration_go_gen.cue
index 8f91746..8479f49 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/duration_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/duration_go_gen.cue
@@ -7,4 +7,4 @@
 // Duration is a wrapper around time.Duration which supports correct
 // marshaling to YAML and JSON. In particular, it marshals into strings, which
 // can be used as map keys in json.
-Duration: _
+Duration :: _
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/group_version_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/group_version_go_gen.cue
index 3ccfb01..fdc98a3 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/group_version_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/group_version_go_gen.cue
@@ -8,7 +8,7 @@
 // concepts during lookup stages without having partially valid types
 //
 // +protobuf.options.(gogoproto.goproto_stringer)=false
-GroupResource: {
+GroupResource :: {
 	group:    string @go(Group) @protobuf(1,bytes,opt)
 	resource: string @go(Resource) @protobuf(2,bytes,opt)
 }
@@ -17,7 +17,7 @@
 // to avoid automatic coersion.  It doesn't use a GroupVersion to avoid custom marshalling
 //
 // +protobuf.options.(gogoproto.goproto_stringer)=false
-GroupVersionResource: {
+GroupVersionResource :: {
 	group:    string @go(Group) @protobuf(1,bytes,opt)
 	version:  string @go(Version) @protobuf(2,bytes,opt)
 	resource: string @go(Resource) @protobuf(3,bytes,opt)
@@ -27,7 +27,7 @@
 // concepts during lookup stages without having partially valid types
 //
 // +protobuf.options.(gogoproto.goproto_stringer)=false
-GroupKind: {
+GroupKind :: {
 	group: string @go(Group) @protobuf(1,bytes,opt)
 	kind:  string @go(Kind) @protobuf(2,bytes,opt)
 }
@@ -36,7 +36,7 @@
 // to avoid automatic coersion.  It doesn't use a GroupVersion to avoid custom marshalling
 //
 // +protobuf.options.(gogoproto.goproto_stringer)=false
-GroupVersionKind: {
+GroupVersionKind :: {
 	group:   string @go(Group) @protobuf(1,bytes,opt)
 	version: string @go(Version) @protobuf(2,bytes,opt)
 	kind:    string @go(Kind) @protobuf(3,bytes,opt)
@@ -45,4 +45,4 @@
 // GroupVersion contains the "group" and the "version", which uniquely identifies the API.
 //
 // +protobuf.options.(gogoproto.goproto_stringer)=false
-GroupVersion: _
+GroupVersion :: _
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/meta_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/meta_go_gen.cue
index 14faa1c..9944f9e 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/meta_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/meta_go_gen.cue
@@ -5,29 +5,29 @@
 package v1
 
 // TODO: move this, Object, List, and Type to a different package
-ObjectMetaAccessor: _
+ObjectMetaAccessor :: _
 
 // Object lets you work with object metadata from any of the versioned or
 // internal API objects. Attempting to set or retrieve a field on an object that does
 // not support that field (Name, UID, Namespace on lists) will be a no-op and return
 // a default value.
-Object: _
+Object :: _
 
 // ListMetaAccessor retrieves the list interface from an object
-ListMetaAccessor: _
+ListMetaAccessor :: _
 
 // Common lets you work with core metadata from any of the versioned or
 // internal API objects. Attempting to set or retrieve a field on an object that does
 // not support that field will be a no-op and return a default value.
 // TODO: move this, and TypeMeta and ListMeta, to a different package
-Common: _
+Common :: _
 
 // ListInterface lets you work with list metadata from any of the versioned or
 // internal API objects. Attempting to set or retrieve a field on an object that does
 // not support that field will be a no-op and return a default value.
 // TODO: move this, and TypeMeta and ListMeta, to a different package
-ListInterface: _
+ListInterface :: _
 
 // Type exposes the type and APIVersion of versioned or internal API objects.
 // TODO: move this, and TypeMeta and ListMeta, to a different package
-Type: _
+Type :: _
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_go_gen.cue
index b5d5d89..4097996 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/micro_time_go_gen.cue
@@ -4,11 +4,11 @@
 
 package v1
 
-RFC3339Micro: "2006-01-02T15:04:05.000000Z07:00"
+RFC3339Micro :: "2006-01-02T15:04:05.000000Z07:00"
 
 // MicroTime is version of Time with microsecond level precision.
 //
 // +protobuf.options.marshal=false
 // +protobuf.as=Timestamp
 // +protobuf.options.(gogoproto.goproto_stringer)=false
-MicroTime: _
+MicroTime :: _
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/register_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/register_go_gen.cue
index f987f04..edb4dbb 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/register_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/register_go_gen.cue
@@ -4,6 +4,6 @@
 
 package v1
 
-GroupName: "meta.k8s.io"
+GroupName :: "meta.k8s.io"
 
-WatchEventKind: "WatchEvent"
+WatchEventKind :: "WatchEvent"
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/time_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/time_go_gen.cue
index d83638f..52a66e8 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/time_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/time_go_gen.cue
@@ -11,4 +11,4 @@
 // +protobuf.options.marshal=false
 // +protobuf.as=Timestamp
 // +protobuf.options.(gogoproto.goproto_stringer)=false
-Time: _
+Time :: _
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/time_proto_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/time_proto_go_gen.cue
index d6c8f76..0219f06 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/time_proto_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/time_proto_go_gen.cue
@@ -7,7 +7,7 @@
 // Timestamp is a struct that is equivalent to Time, but intended for
 // protobuf marshalling/unmarshalling. It is generated into a serialization
 // that matches Time. Do not use in Go structs.
-Timestamp: {
+Timestamp :: {
 	// Represents seconds of UTC time since Unix epoch
 	// 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
 	// 9999-12-31T23:59:59Z inclusive.
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/types_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/types_go_gen.cue
index 1593bb5..fe0634c 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/types_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/types_go_gen.cue
@@ -23,7 +23,7 @@
 // Structures that are versioned or persisted should inline TypeMeta.
 //
 // +k8s:deepcopy-gen=false
-TypeMeta: {
+TypeMeta :: {
 	// Kind is a string value representing the REST resource this object represents.
 	// Servers may infer this from the endpoint the client submits requests to.
 	// Cannot be updated.
@@ -42,7 +42,7 @@
 
 // ListMeta describes metadata that synthetic resources must have, including lists and
 // various status objects. A resource may have only one of {ObjectMeta, ListMeta}.
-ListMeta: {
+ListMeta :: {
 	// selfLink is a URL representing this object.
 	// Populated by the system.
 	// Read-only.
@@ -84,12 +84,12 @@
 	remainingItemCount?: null | int64 @go(RemainingItemCount,*int64) @protobuf(4,bytes,opt)
 }
 
-FinalizerOrphanDependents: "orphan"
-FinalizerDeleteDependents: "foregroundDeletion"
+FinalizerOrphanDependents :: "orphan"
+FinalizerDeleteDependents :: "foregroundDeletion"
 
 // ObjectMeta is metadata that all persisted resources must have, which includes all objects
 // users must create.
-ObjectMeta: {
+ObjectMeta :: {
 	// Name must be unique within a namespace. Is required when creating resources, although
 	// some resources may allow a client to request the generation of an appropriate name
 	// automatically. Name is primarily intended for creation idempotence and configuration
@@ -257,24 +257,24 @@
 }
 
 // NamespaceDefault means the object is in the default namespace which is applied when not specified by clients
-NamespaceDefault: "default"
+NamespaceDefault :: "default"
 
 // NamespaceAll is the default argument to specify on a context when you want to list or filter resources across all namespaces
-NamespaceAll: ""
+NamespaceAll :: ""
 
 // NamespaceNone is the argument for a context when there is no namespace.
-NamespaceNone: ""
+NamespaceNone :: ""
 
 // NamespaceSystem is the system namespace where we place system components.
-NamespaceSystem: "kube-system"
+NamespaceSystem :: "kube-system"
 
 // NamespacePublic is the namespace where we place public info (ConfigMaps)
-NamespacePublic: "kube-public"
+NamespacePublic :: "kube-public"
 
 // OwnerReference contains enough information to let you identify an owning
 // object. An owning object must be in the same namespace as the dependent, or
 // be cluster-scoped, so there is no namespace field.
-OwnerReference: {
+OwnerReference :: {
 	// API version of the referent.
 	apiVersion: string @go(APIVersion) @protobuf(5,bytes,opt)
 
@@ -305,7 +305,9 @@
 }
 
 // ListOptions is the query options to a standard REST list call.
-ListOptions: TypeMeta & {
+ListOptions :: {
+	(TypeMeta)
+
 	// A selector to restrict the list of returned objects by their labels.
 	// Defaults to everything.
 	// +optional
@@ -386,7 +388,9 @@
 
 // ExportOptions is the query options to the standard REST get call.
 // Deprecated. Planned for removal in 1.18.
-ExportOptions: TypeMeta & {
+ExportOptions :: {
+	(TypeMeta)
+
 	// Should this value be exported.  Export strips fields that a user can not specify.
 	// Deprecated. Planned for removal in 1.18.
 	export: bool @go(Export) @protobuf(1,varint,opt)
@@ -397,7 +401,9 @@
 }
 
 // GetOptions is the standard query options to the standard REST get call.
-GetOptions: TypeMeta & {
+GetOptions :: {
+	(TypeMeta)
+
 	// When specified:
 	// - if unset, then the result is returned from remote storage based on quorum-read flag;
 	// - if it's 0, then we simply return what we currently have in cache, no guarantee;
@@ -407,33 +413,35 @@
 
 // DeletionPropagation decides if a deletion will propagate to the dependents of
 // the object, and how the garbage collector will handle the propagation.
-DeletionPropagation: string // enumDeletionPropagation
+DeletionPropagation :: string // enumDeletionPropagation
 
-enumDeletionPropagation:
+enumDeletionPropagation ::
 	DeletePropagationOrphan |
 	DeletePropagationBackground |
 	DeletePropagationForeground
 
 // Orphans the dependents.
-DeletePropagationOrphan: DeletionPropagation & "Orphan"
+DeletePropagationOrphan :: DeletionPropagation & "Orphan"
 
 // Deletes the object from the key-value store, the garbage collector will
 // delete the dependents in the background.
-DeletePropagationBackground: DeletionPropagation & "Background"
+DeletePropagationBackground :: DeletionPropagation & "Background"
 
 // The object exists in the key-value store until the garbage collector
 // deletes all the dependents whose ownerReference.blockOwnerDeletion=true
 // from the key-value store.  API sever will put the "foregroundDeletion"
 // finalizer on the object, and sets its deletionTimestamp.  This policy is
 // cascading, i.e., the dependents will be deleted with Foreground.
-DeletePropagationForeground: DeletionPropagation & "Foreground"
+DeletePropagationForeground :: DeletionPropagation & "Foreground"
 
 // DryRunAll means to complete all processing stages, but don't
 // persist changes to storage.
-DryRunAll: "All"
+DryRunAll :: "All"
 
 // DeleteOptions may be provided when deleting an API object.
-DeleteOptions: TypeMeta & {
+DeleteOptions :: {
+	(TypeMeta)
+
 	// The duration in seconds before the object should be deleted. Value must be non-negative integer.
 	// The value zero indicates delete immediately. If this value is nil, the default grace period for the
 	// specified type will be used.
@@ -474,7 +482,9 @@
 }
 
 // CreateOptions may be provided when creating an API object.
-CreateOptions: TypeMeta & {
+CreateOptions :: {
+	(TypeMeta)
+
 	// When present, indicates that modifications should not be
 	// persisted. An invalid or unrecognized dryRun directive will
 	// result in an error response and no further processing of the
@@ -493,7 +503,9 @@
 
 // PatchOptions may be provided when patching an API object.
 // PatchOptions is meant to be a superset of UpdateOptions.
-PatchOptions: TypeMeta & {
+PatchOptions :: {
+	(TypeMeta)
+
 	// When present, indicates that modifications should not be
 	// persisted. An invalid or unrecognized dryRun directive will
 	// result in an error response and no further processing of the
@@ -521,7 +533,9 @@
 
 // UpdateOptions may be provided when updating an API object.
 // All fields in UpdateOptions should also be present in PatchOptions.
-UpdateOptions: TypeMeta & {
+UpdateOptions :: {
+	(TypeMeta)
+
 	// When present, indicates that modifications should not be
 	// persisted. An invalid or unrecognized dryRun directive will
 	// result in an error response and no further processing of the
@@ -539,7 +553,7 @@
 }
 
 // Preconditions must be fulfilled before an operation (update, delete, etc.) is carried out.
-Preconditions: {
+Preconditions :: {
 	// Specifies the target UID.
 	// +optional
 	uid?: null | types.UID @go(UID,*types.UID) @protobuf(1,bytes,opt,casttype=k8s.io/apimachinery/pkg/types.UID)
@@ -550,7 +564,9 @@
 }
 
 // Status is a return value for calls that don't return other objects.
-Status: TypeMeta & {
+Status :: {
+	(TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -591,7 +607,7 @@
 // must ignore fields that do not match the defined type of each attribute,
 // and should assume that any attribute may be empty, invalid, or under
 // defined.
-StatusDetails: {
+StatusDetails :: {
 	// The name attribute of the resource associated with the status StatusReason
 	// (when there is a single name which can be described).
 	// +optional
@@ -625,16 +641,16 @@
 	retryAfterSeconds?: int32 @go(RetryAfterSeconds) @protobuf(5,varint,opt)
 }
 
-StatusSuccess: "Success"
-StatusFailure: "Failure"
+StatusSuccess :: "Success"
+StatusFailure :: "Failure"
 
 // StatusReason is an enumeration of possible failure causes.  Each StatusReason
 // must map to a single HTTP status code, but multiple reasons may map
 // to the same HTTP status code.
 // TODO: move to apiserver
-StatusReason: string // enumStatusReason
+StatusReason :: string // enumStatusReason
 
-enumStatusReason:
+enumStatusReason ::
 	StatusReasonUnknown |
 	StatusReasonUnauthorized |
 	StatusReasonForbidden |
@@ -658,14 +674,14 @@
 // StatusReasonUnknown means the server has declined to indicate a specific reason.
 // The details field may contain other information about this error.
 // Status code 500.
-StatusReasonUnknown: StatusReason & ""
+StatusReasonUnknown :: StatusReason & ""
 
 // StatusReasonUnauthorized means the server can be reached and understood the request, but requires
 // the user to present appropriate authorization credentials (identified by the WWW-Authenticate header)
 // in order for the action to be completed. If the user has specified credentials on the request, the
 // server considers them insufficient.
 // Status code 401
-StatusReasonUnauthorized: StatusReason & "Unauthorized"
+StatusReasonUnauthorized :: StatusReason & "Unauthorized"
 
 // StatusReasonForbidden means the server can be reached and understood the request, but refuses
 // to take any further action.  It is the result of the server being configured to deny access for some reason
@@ -676,7 +692,7 @@
 //                   resource.
 //   "id"   string - the identifier of the forbidden resource
 // Status code 403
-StatusReasonForbidden: StatusReason & "Forbidden"
+StatusReasonForbidden :: StatusReason & "Forbidden"
 
 // StatusReasonNotFound means one or more resources required for this operation
 // could not be found.
@@ -686,26 +702,26 @@
 //                   resource.
 //   "id"   string - the identifier of the missing resource
 // Status code 404
-StatusReasonNotFound: StatusReason & "NotFound"
+StatusReasonNotFound :: StatusReason & "NotFound"
 
 // StatusReasonAlreadyExists means the resource you are creating already exists.
 // Details (optional):
 //   "kind" string - the kind attribute of the conflicting resource
 //   "id"   string - the identifier of the conflicting resource
 // Status code 409
-StatusReasonAlreadyExists: StatusReason & "AlreadyExists"
+StatusReasonAlreadyExists :: StatusReason & "AlreadyExists"
 
 // StatusReasonConflict means the requested operation cannot be completed
 // due to a conflict in the operation. The client may need to alter the
 // request. Each resource may define custom details that indicate the
 // nature of the conflict.
 // Status code 409
-StatusReasonConflict: StatusReason & "Conflict"
+StatusReasonConflict :: StatusReason & "Conflict"
 
 // StatusReasonGone means the item is no longer available at the server and no
 // forwarding address is known.
 // Status code 410
-StatusReasonGone: StatusReason & "Gone"
+StatusReasonGone :: StatusReason & "Gone"
 
 // StatusReasonInvalid means the requested create or update operation cannot be
 // completed due to invalid data provided as part of the request. The client may
@@ -718,7 +734,7 @@
 //                   provided resource that was invalid.  The code, message, and
 //                   field attributes will be set.
 // Status code 422
-StatusReasonInvalid: StatusReason & "Invalid"
+StatusReasonInvalid :: StatusReason & "Invalid"
 
 // StatusReasonServerTimeout means the server can be reached and understood the request,
 // but cannot complete the action in a reasonable time. The client should retry the request.
@@ -730,7 +746,7 @@
 //   "id"   string - the operation that is being attempted.
 //   "retryAfterSeconds" int32 - the number of seconds before the operation should be retried
 // Status code 500
-StatusReasonServerTimeout: StatusReason & "ServerTimeout"
+StatusReasonServerTimeout :: StatusReason & "ServerTimeout"
 
 // StatusReasonTimeout means that the request could not be completed within the given time.
 // Clients can get this response only when they specified a timeout param in the request,
@@ -740,7 +756,7 @@
 // Details (optional):
 //   "retryAfterSeconds" int32 - the number of seconds before the operation should be retried
 // Status code 504
-StatusReasonTimeout: StatusReason & "Timeout"
+StatusReasonTimeout :: StatusReason & "Timeout"
 
 // StatusReasonTooManyRequests means the server experienced too many requests within a
 // given window and that the client must wait to perform the action again. A client may
@@ -749,59 +765,59 @@
 // Details (optional):
 //   "retryAfterSeconds" int32 - the number of seconds before the operation should be retried
 // Status code 429
-StatusReasonTooManyRequests: StatusReason & "TooManyRequests"
+StatusReasonTooManyRequests :: StatusReason & "TooManyRequests"
 
 // StatusReasonBadRequest means that the request itself was invalid, because the request
 // doesn't make any sense, for example deleting a read-only object.  This is different than
 // StatusReasonInvalid above which indicates that the API call could possibly succeed, but the
 // data was invalid.  API calls that return BadRequest can never succeed.
 // Status code 400
-StatusReasonBadRequest: StatusReason & "BadRequest"
+StatusReasonBadRequest :: StatusReason & "BadRequest"
 
 // StatusReasonMethodNotAllowed means that the action the client attempted to perform on the
 // resource was not supported by the code - for instance, attempting to delete a resource that
 // can only be created. API calls that return MethodNotAllowed can never succeed.
 // Status code 405
-StatusReasonMethodNotAllowed: StatusReason & "MethodNotAllowed"
+StatusReasonMethodNotAllowed :: StatusReason & "MethodNotAllowed"
 
 // StatusReasonNotAcceptable means that the accept types indicated by the client were not acceptable
 // to the server - for instance, attempting to receive protobuf for a resource that supports only json and yaml.
 // API calls that return NotAcceptable can never succeed.
 // Status code 406
-StatusReasonNotAcceptable: StatusReason & "NotAcceptable"
+StatusReasonNotAcceptable :: StatusReason & "NotAcceptable"
 
 // StatusReasonRequestEntityTooLarge means that the request entity is too large.
 // Status code 413
-StatusReasonRequestEntityTooLarge: StatusReason & "RequestEntityTooLarge"
+StatusReasonRequestEntityTooLarge :: StatusReason & "RequestEntityTooLarge"
 
 // StatusReasonUnsupportedMediaType means that the content type sent by the client is not acceptable
 // to the server - for instance, attempting to send protobuf for a resource that supports only json and yaml.
 // API calls that return UnsupportedMediaType can never succeed.
 // Status code 415
-StatusReasonUnsupportedMediaType: StatusReason & "UnsupportedMediaType"
+StatusReasonUnsupportedMediaType :: StatusReason & "UnsupportedMediaType"
 
 // StatusReasonInternalError indicates that an internal error occurred, it is unexpected
 // and the outcome of the call is unknown.
 // Details (optional):
 //   "causes" - The original error
 // Status code 500
-StatusReasonInternalError: StatusReason & "InternalError"
+StatusReasonInternalError :: StatusReason & "InternalError"
 
 // StatusReasonExpired indicates that the request is invalid because the content you are requesting
 // has expired and is no longer available. It is typically associated with watches that can't be
 // serviced.
 // Status code 410 (gone)
-StatusReasonExpired: StatusReason & "Expired"
+StatusReasonExpired :: StatusReason & "Expired"
 
 // StatusReasonServiceUnavailable means that the request itself was valid,
 // but the requested service is unavailable at this time.
 // Retrying the request after some time might succeed.
 // Status code 503
-StatusReasonServiceUnavailable: StatusReason & "ServiceUnavailable"
+StatusReasonServiceUnavailable :: StatusReason & "ServiceUnavailable"
 
 // StatusCause provides more information about an api.Status failure, including
 // cases when multiple errors are encountered.
-StatusCause: {
+StatusCause :: {
 	// A machine-readable description of the cause of the error. If this value is
 	// empty there is no information available.
 	// +optional
@@ -828,9 +844,9 @@
 // CauseType is a machine readable value providing more detail about what
 // occurred in a status response. An operation may have multiple causes for a
 // status (whether Failure or Success).
-CauseType: string // enumCauseType
+CauseType :: string // enumCauseType
 
-enumCauseType:
+enumCauseType ::
 	CauseTypeFieldValueNotFound |
 	CauseTypeFieldValueRequired |
 	CauseTypeFieldValueDuplicate |
@@ -841,35 +857,37 @@
 
 // CauseTypeFieldValueNotFound is used to report failure to find a requested value
 // (e.g. looking up an ID).
-CauseTypeFieldValueNotFound: CauseType & "FieldValueNotFound"
+CauseTypeFieldValueNotFound :: CauseType & "FieldValueNotFound"
 
 // CauseTypeFieldValueRequired is used to report required values that are not
 // provided (e.g. empty strings, null values, or empty arrays).
-CauseTypeFieldValueRequired: CauseType & "FieldValueRequired"
+CauseTypeFieldValueRequired :: CauseType & "FieldValueRequired"
 
 // CauseTypeFieldValueDuplicate is used to report collisions of values that must be
 // unique (e.g. unique IDs).
-CauseTypeFieldValueDuplicate: CauseType & "FieldValueDuplicate"
+CauseTypeFieldValueDuplicate :: CauseType & "FieldValueDuplicate"
 
 // CauseTypeFieldValueInvalid is used to report malformed values (e.g. failed regex
 // match).
-CauseTypeFieldValueInvalid: CauseType & "FieldValueInvalid"
+CauseTypeFieldValueInvalid :: CauseType & "FieldValueInvalid"
 
 // CauseTypeFieldValueNotSupported is used to report valid (as per formatting rules)
 // values that can not be handled (e.g. an enumerated string).
-CauseTypeFieldValueNotSupported: CauseType & "FieldValueNotSupported"
+CauseTypeFieldValueNotSupported :: CauseType & "FieldValueNotSupported"
 
 // CauseTypeUnexpectedServerResponse is used to report when the server responded to the client
 // without the expected return type. The presence of this cause indicates the error may be
 // due to an intervening proxy or the server software malfunctioning.
-CauseTypeUnexpectedServerResponse: CauseType & "UnexpectedServerResponse"
+CauseTypeUnexpectedServerResponse :: CauseType & "UnexpectedServerResponse"
 
 // FieldManagerConflict is used to report when another client claims to manage this field,
 // It should only be returned for a request using server-side apply.
-CauseTypeFieldManagerConflict: CauseType & "FieldManagerConflict"
+CauseTypeFieldManagerConflict :: CauseType & "FieldManagerConflict"
 
 // List holds a list of objects, which may not be known by the server.
-List: TypeMeta & {
+List :: {
+	(TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -884,7 +902,9 @@
 //
 // +protobuf.options.(gogoproto.goproto_stringer)=false
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-APIVersions: TypeMeta & {
+APIVersions :: {
+	(TypeMeta)
+
 	// versions are the api versions that are available.
 	versions: [...string] @go(Versions,[]string) @protobuf(1,bytes,rep)
 
@@ -900,14 +920,18 @@
 
 // APIGroupList is a list of APIGroup, to allow clients to discover the API at
 // /apis.
-APIGroupList: TypeMeta & {
+APIGroupList :: {
+	(TypeMeta)
+
 	// groups is a list of APIGroup.
 	groups: [...APIGroup] @go(Groups,[]APIGroup) @protobuf(1,bytes,rep)
 }
 
 // APIGroup contains the name, the supported versions, and the preferred version
 // of a group.
-APIGroup: TypeMeta & {
+APIGroup :: {
+	(TypeMeta)
+
 	// name is the name of the group.
 	name: string @go(Name) @protobuf(1,bytes,opt)
 
@@ -931,7 +955,7 @@
 }
 
 // ServerAddressByClientCIDR helps the client to determine the server address that they should use, depending on the clientCIDR that they match.
-ServerAddressByClientCIDR: {
+ServerAddressByClientCIDR :: {
 	// The CIDR with which clients can match their IP to figure out the server address that they should use.
 	clientCIDR: string @go(ClientCIDR) @protobuf(1,bytes,opt)
 
@@ -942,7 +966,7 @@
 
 // GroupVersion contains the "group/version" and "version" string of a version.
 // It is made a struct to keep extensibility.
-GroupVersionForDiscovery: {
+GroupVersionForDiscovery :: {
 	// groupVersion specifies the API group and version in the form "group/version"
 	groupVersion: string @go(GroupVersion) @protobuf(1,bytes,opt)
 
@@ -952,7 +976,7 @@
 }
 
 // APIResource specifies the name of a resource and whether it is namespaced.
-APIResource: {
+APIResource :: {
 	// name is the plural name of the resource.
 	name: string @go(Name) @protobuf(1,bytes,opt)
 
@@ -1000,12 +1024,14 @@
 //
 // +protobuf.nullable=true
 // +protobuf.options.(gogoproto.goproto_stringer)=false
-Verbs: [...string]
+Verbs :: [...string]
 
 // APIResourceList is a list of APIResource, it is used to expose the name of the
 // resources supported in a specific group and version, and if the resource
 // is namespaced.
-APIResourceList: TypeMeta & {
+APIResourceList :: {
+	(TypeMeta)
+
 	// groupVersion is the group and version this APIResourceList is for.
 	groupVersion: string @go(GroupVersion) @protobuf(1,bytes,opt)
 
@@ -1015,19 +1041,19 @@
 
 // RootPaths lists the paths available at root.
 // For example: "/healthz", "/apis".
-RootPaths: {
+RootPaths :: {
 	// paths are the paths available at root.
 	paths: [...string] @go(Paths,[]string) @protobuf(1,bytes,rep)
 }
 
 // Patch is provided to give a concrete name and type to the Kubernetes PATCH request body.
-Patch: {
+Patch :: {
 }
 
 // A label selector is a label query over a set of resources. The result of matchLabels and
 // matchExpressions are ANDed. An empty label selector matches all objects. A null
 // label selector matches no objects.
-LabelSelector: {
+LabelSelector :: {
 	// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
 	// map is equivalent to an element of matchExpressions, whose key field is "key", the
 	// operator is "In", and the values array contains only "value". The requirements are ANDed.
@@ -1041,7 +1067,7 @@
 
 // A label selector requirement is a selector that contains values, a key, and an operator that
 // relates the key and values.
-LabelSelectorRequirement: {
+LabelSelectorRequirement :: {
 	// key is the label key that the selector applies to.
 	// +patchMergeKey=key
 	// +patchStrategy=merge
@@ -1060,22 +1086,22 @@
 }
 
 // A label selector operator is the set of operators that can be used in a selector requirement.
-LabelSelectorOperator: string // enumLabelSelectorOperator
+LabelSelectorOperator :: string // enumLabelSelectorOperator
 
-enumLabelSelectorOperator:
+enumLabelSelectorOperator ::
 	LabelSelectorOpIn |
 	LabelSelectorOpNotIn |
 	LabelSelectorOpExists |
 	LabelSelectorOpDoesNotExist
 
-LabelSelectorOpIn:           LabelSelectorOperator & "In"
-LabelSelectorOpNotIn:        LabelSelectorOperator & "NotIn"
-LabelSelectorOpExists:       LabelSelectorOperator & "Exists"
-LabelSelectorOpDoesNotExist: LabelSelectorOperator & "DoesNotExist"
+LabelSelectorOpIn ::           LabelSelectorOperator & "In"
+LabelSelectorOpNotIn ::        LabelSelectorOperator & "NotIn"
+LabelSelectorOpExists ::       LabelSelectorOperator & "Exists"
+LabelSelectorOpDoesNotExist :: LabelSelectorOperator & "DoesNotExist"
 
 // ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource
 // that the fieldset applies to.
-ManagedFieldsEntry: {
+ManagedFieldsEntry :: {
 	// Manager is an identifier of the workflow managing these fields.
 	manager?: string @go(Manager) @protobuf(1,bytes,opt)
 
@@ -1103,14 +1129,14 @@
 }
 
 // ManagedFieldsOperationType is the type of operation which lead to a ManagedFieldsEntry being created.
-ManagedFieldsOperationType: string // enumManagedFieldsOperationType
+ManagedFieldsOperationType :: string // enumManagedFieldsOperationType
 
-enumManagedFieldsOperationType:
+enumManagedFieldsOperationType ::
 	ManagedFieldsOperationApply |
 	ManagedFieldsOperationUpdate
 
-ManagedFieldsOperationApply:  ManagedFieldsOperationType & "Apply"
-ManagedFieldsOperationUpdate: ManagedFieldsOperationType & "Update"
+ManagedFieldsOperationApply ::  ManagedFieldsOperationType & "Apply"
+ManagedFieldsOperationUpdate :: ManagedFieldsOperationType & "Update"
 
 // FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.
 //
@@ -1123,13 +1149,15 @@
 // If a key maps to an empty Fields value, the field that key represents is part of the set.
 //
 // The exact format is defined in sigs.k8s.io/structured-merge-diff
-FieldsV1: _
+FieldsV1 :: _
 
 // Table is a tabular representation of a set of API resources. The server transforms the
 // object into a set of preferred columns for quickly reviewing the objects.
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +protobuf=false
-Table: TypeMeta & {
+Table :: {
+	(TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
@@ -1145,7 +1173,7 @@
 
 // TableColumnDefinition contains information about a column returned in the Table.
 // +protobuf=false
-TableColumnDefinition: {
+TableColumnDefinition :: {
 	// name is a human readable name for the column.
 	name: string @go(Name)
 
@@ -1172,7 +1200,7 @@
 
 // TableRow is an individual row in a table.
 // +protobuf=false
-TableRow: {
+TableRow :: {
 	// cells will be as wide as the column definitions array and may contain strings, numbers (float64 or
 	// int64), booleans, simple maps, lists, or null. See the type field of the column definition for a
 	// more detailed description.
@@ -1197,7 +1225,7 @@
 
 // TableRowCondition allows a row to be marked with additional information.
 // +protobuf=false
-TableRowCondition: {
+TableRowCondition :: {
 	// Type of row condition. The only defined value is 'Completed' indicating that the
 	// object this row represents has reached a completed state and may be given less visual
 	// priority than other rows. Clients are not required to honor any conditions but should
@@ -1216,46 +1244,48 @@
 	message?: string @go(Message)
 }
 
-RowConditionType: string // enumRowConditionType
+RowConditionType :: string // enumRowConditionType
 
-enumRowConditionType:
+enumRowConditionType ::
 	RowCompleted
 
 // RowCompleted means the underlying resource has reached completion and may be given less
 // visual priority than other resources.
-RowCompleted: RowConditionType & "Completed"
+RowCompleted :: RowConditionType & "Completed"
 
-ConditionStatus: string // enumConditionStatus
+ConditionStatus :: string // enumConditionStatus
 
-enumConditionStatus:
+enumConditionStatus ::
 	ConditionTrue |
 	ConditionFalse |
 	ConditionUnknown
 
-ConditionTrue:    ConditionStatus & "True"
-ConditionFalse:   ConditionStatus & "False"
-ConditionUnknown: ConditionStatus & "Unknown"
+ConditionTrue ::    ConditionStatus & "True"
+ConditionFalse ::   ConditionStatus & "False"
+ConditionUnknown :: ConditionStatus & "Unknown"
 
 // IncludeObjectPolicy controls which portion of the object is returned with a Table.
-IncludeObjectPolicy: string // enumIncludeObjectPolicy
+IncludeObjectPolicy :: string // enumIncludeObjectPolicy
 
-enumIncludeObjectPolicy:
+enumIncludeObjectPolicy ::
 	IncludeNone |
 	IncludeMetadata |
 	IncludeObject
 
 // IncludeNone returns no object.
-IncludeNone: IncludeObjectPolicy & "None"
+IncludeNone :: IncludeObjectPolicy & "None"
 
 // IncludeMetadata serializes the object containing only its metadata field.
-IncludeMetadata: IncludeObjectPolicy & "Metadata"
+IncludeMetadata :: IncludeObjectPolicy & "Metadata"
 
 // IncludeObject contains the full object.
-IncludeObject: IncludeObjectPolicy & "Object"
+IncludeObject :: IncludeObjectPolicy & "Object"
 
 // TableOptions are used when a Table is requested by the caller.
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-TableOptions: TypeMeta & {
+TableOptions :: {
+	(TypeMeta)
+
 	// includeObject decides whether to include each object along with its columnar information.
 	// Specifying "None" will return no object, specifying "Object" will return the full object contents, and
 	// specifying "Metadata" (the default) will return the object's metadata in the PartialObjectMetadata kind
@@ -1266,7 +1296,9 @@
 // PartialObjectMetadata is a generic representation of any object with ObjectMeta. It allows clients
 // to get access to a particular ObjectMeta schema without knowing the details of the version.
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-PartialObjectMetadata: TypeMeta & {
+PartialObjectMetadata :: {
+	(TypeMeta)
+
 	// Standard object's metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 	// +optional
@@ -1275,7 +1307,9 @@
 
 // PartialObjectMetadataList contains a list of objects containing only their metadata
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-PartialObjectMetadataList: TypeMeta & {
+PartialObjectMetadataList :: {
+	(TypeMeta)
+
 	// Standard list metadata.
 	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 	// +optional
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/watch_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/watch_go_gen.cue
index 16fd5c0..1874729 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/watch_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/apis/meta/v1/watch_go_gen.cue
@@ -14,7 +14,7 @@
 // +protobuf=true
 // +k8s:deepcopy-gen=true
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-WatchEvent: {
+WatchEvent :: {
 	type: string @go(Type) @protobuf(1,bytes,opt)
 
 	// Object is:
@@ -27,4 +27,4 @@
 
 // InternalEvent makes watch.Event versioned
 // +protobuf=false
-InternalEvent: watch.Event
+InternalEvent :: watch.Event
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/codec_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/codec_go_gen.cue
index 85e4a84..3ffad36 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/codec_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/codec_go_gen.cue
@@ -5,14 +5,14 @@
 package runtime
 
 // NoopEncoder converts an Decoder to a Serializer or Codec for code that expects them but only uses decoding.
-NoopEncoder: {
+NoopEncoder :: {
 	Decoder: Decoder
 }
 
 // NoopDecoder converts an Encoder to a Serializer or Codec for code that expects them but only uses encoding.
-NoopDecoder: {
+NoopDecoder :: {
 	Encoder: Encoder
 }
 
 // GroupVersioners implements GroupVersioner and resolves to the first exact match for any kind.
-GroupVersioners: [...GroupVersioner]
+GroupVersioners :: [...GroupVersioner]
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/converter_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/converter_go_gen.cue
index 440e800..71b3fec 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/converter_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/converter_go_gen.cue
@@ -6,4 +6,4 @@
 
 // UnstructuredConverter is an interface for converting between interface{}
 // and map[string]interface representation.
-UnstructuredConverter: _
+UnstructuredConverter :: _
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/helper_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/helper_go_gen.cue
index 5c81374..445f642 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/helper_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/helper_go_gen.cue
@@ -5,16 +5,16 @@
 package runtime
 
 // MultiObjectTyper returns the types of objects across multiple schemes in order.
-MultiObjectTyper: [...ObjectTyper]
+MultiObjectTyper :: [...ObjectTyper]
 
 // WithVersionEncoder serializes an object and ensures the GVK is set.
-WithVersionEncoder: {
+WithVersionEncoder :: {
 	Version:     GroupVersioner
 	Encoder:     Encoder
 	ObjectTyper: ObjectTyper
 }
 
 // WithoutVersionDecoder clears the group version kind of a deserialized object.
-WithoutVersionDecoder: {
+WithoutVersionDecoder :: {
 	Decoder: Decoder
 }
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/interfaces_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/interfaces_go_gen.cue
index 013d0ba..20c842d 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/interfaces_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/interfaces_go_gen.cue
@@ -7,36 +7,36 @@
 // APIVersionInternal may be used if you are registering a type that should not
 // be considered stable or serialized - it is a convention only and has no
 // special behavior in this package.
-APIVersionInternal: "__internal"
+APIVersionInternal :: "__internal"
 
 // GroupVersioner refines a set of possible conversion targets into a single option.
-GroupVersioner: _
+GroupVersioner :: _
 
 // Encoder writes objects to a serialized form
-Encoder: _
+Encoder :: _
 
 // Decoder attempts to load an object from data.
-Decoder: _
+Decoder :: _
 
 // Serializer is the core interface for transforming objects into a serialized format and back.
 // Implementations may choose to perform conversion of the object, but no assumptions should be made.
-Serializer: _
+Serializer :: _
 
 // Codec is a Serializer that deals with the details of versioning objects. It offers the same
 // interface as Serializer, so this is a marker to consumers that care about the version of the objects
 // they receive.
-Codec: Serializer
+Codec :: Serializer
 
 // ParameterCodec defines methods for serializing and deserializing API objects to url.Values and
 // performing any necessary conversion. Unlike the normal Codec, query parameters are not self describing
 // and the desired version must be specified.
-ParameterCodec: _
+ParameterCodec :: _
 
 // Framer is a factory for creating readers and writers that obey a particular framing pattern.
-Framer: _
+Framer :: _
 
 // SerializerInfo contains information about a specific serialization format
-SerializerInfo: {
+SerializerInfo :: {
 	// MediaType is the value that represents this serializer over the wire.
 	MediaType: string
 
@@ -62,7 +62,7 @@
 }
 
 // StreamSerializerInfo contains information about a specific stream serialization format
-StreamSerializerInfo: {
+StreamSerializerInfo :: {
 	// EncodesAsText indicates this serializer can be encoded to UTF-8 safely.
 	EncodesAsText: bool
 
@@ -76,55 +76,55 @@
 // NegotiatedSerializer is an interface used for obtaining encoders, decoders, and serializers
 // for multiple supported media types. This would commonly be accepted by a server component
 // that performs HTTP content negotiation to accept multiple formats.
-NegotiatedSerializer: _
+NegotiatedSerializer :: _
 
 // StorageSerializer is an interface used for obtaining encoders, decoders, and serializers
 // that can read and write data at rest. This would commonly be used by client tools that must
 // read files, or server side storage interfaces that persist restful objects.
-StorageSerializer: _
+StorageSerializer :: _
 
 // NestedObjectEncoder is an optional interface that objects may implement to be given
 // an opportunity to encode any nested Objects / RawExtensions during serialization.
-NestedObjectEncoder: _
+NestedObjectEncoder :: _
 
 // NestedObjectDecoder is an optional interface that objects may implement to be given
 // an opportunity to decode any nested Objects / RawExtensions during serialization.
-NestedObjectDecoder: _
+NestedObjectDecoder :: _
 
-ObjectDefaulter: _
+ObjectDefaulter :: _
 
-ObjectVersioner: _
+ObjectVersioner :: _
 
 // ObjectConvertor converts an object to a different version.
-ObjectConvertor: _
+ObjectConvertor :: _
 
 // ObjectTyper contains methods for extracting the APIVersion and Kind
 // of objects.
-ObjectTyper: _
+ObjectTyper :: _
 
 // ObjectCreater contains methods for instantiating an object by kind and version.
-ObjectCreater: _
+ObjectCreater :: _
 
 // EquivalentResourceMapper provides information about resources that address the same underlying data as a specified resource
-EquivalentResourceMapper: _
+EquivalentResourceMapper :: _
 
 // EquivalentResourceRegistry provides an EquivalentResourceMapper interface,
 // and allows registering known resource[/subresource] -> kind
-EquivalentResourceRegistry: _
+EquivalentResourceRegistry :: _
 
 // ResourceVersioner provides methods for setting and retrieving
 // the resource version from an API object.
-ResourceVersioner: _
+ResourceVersioner :: _
 
 // SelfLinker provides methods for setting and retrieving the SelfLink field of an API object.
-SelfLinker: _
+SelfLinker :: _
 
 // Object interface must be supported by all API types registered with Scheme. Since objects in a scheme are
 // expected to be serialized to the wire, the interface an Object must provide to the Scheme allows
 // serializers to set the kind, version, and group the object is represented as. An Object may choose
 // to return a no-op ObjectKindAccessor in cases where it is not expected to be serialized.
-Object: _
+Object :: _
 
 // Unstructured objects store values as map[string]interface{}, with only values that can be serialized
 // to JSON allowed.
-Unstructured: _
+Unstructured :: _
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator_go_gen.cue
index 468dbf3..06820e8 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator_go_gen.cue
@@ -5,10 +5,10 @@
 package runtime
 
 // Pair of strings. We keed the name of fields and the doc
-Pair: {
+Pair :: {
 	Name: string
 	Doc:  string
 }
 
 // KubeTypes is an array to represent all available types in a parsed file. [0] is for the type itself
-KubeTypes: [...Pair]
+KubeTypes :: [...Pair]
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/types_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/types_go_gen.cue
index c258f4e..a0a7e95 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/types_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/types_go_gen.cue
@@ -18,7 +18,7 @@
 // +k8s:deepcopy-gen=false
 // +protobuf=true
 // +k8s:openapi-gen=true
-TypeMeta: {
+TypeMeta :: {
 	// +optional
 	apiVersion?: string @go(APIVersion) @protobuf(1,bytes,opt)
 
@@ -26,9 +26,9 @@
 	kind?: string @go(Kind) @protobuf(2,bytes,opt)
 }
 
-ContentTypeJSON:     "application/json"
-ContentTypeYAML:     "application/yaml"
-ContentTypeProtobuf: "application/vnd.kubernetes.protobuf"
+ContentTypeJSON ::     "application/json"
+ContentTypeYAML ::     "application/yaml"
+ContentTypeProtobuf :: "application/vnd.kubernetes.protobuf"
 
 // RawExtension is used to hold extensions in external versions.
 //
@@ -75,7 +75,7 @@
 // +k8s:deepcopy-gen=true
 // +protobuf=true
 // +k8s:openapi-gen=true
-RawExtension: _
+RawExtension :: _
 
 // Unknown allows api objects with unknown types to be passed-through. This can be used
 // to deal with the API objects from a plug-in. Unknown objects still have functioning
@@ -87,14 +87,14 @@
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +protobuf=true
 // +k8s:openapi-gen=true
-Unknown: _
+Unknown :: _
 
 // VersionedObjects is used by Decoders to give callers a way to access all versions
 // of an object during the decoding process.
 //
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +k8s:deepcopy-gen=true
-VersionedObjects: {
+VersionedObjects :: {
 	// Objects is the set of objects retrieved during decoding, in order of conversion.
 	// The 0 index is the object as serialized on the wire. If conversion has occurred,
 	// other objects may be present. The right most object is the same as would be returned
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/types_proto_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/types_proto_go_gen.cue
index 65eb876..50626df 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/types_proto_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/runtime/types_proto_go_gen.cue
@@ -4,6 +4,6 @@
 
 package runtime
 
-ProtobufMarshaller: _
+ProtobufMarshaller :: _
 
-ProtobufReverseMarshaller: _
+ProtobufReverseMarshaller :: _
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/types/namespacedname_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/types/namespacedname_go_gen.cue
index 1164c06..f308da9 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/types/namespacedname_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/types/namespacedname_go_gen.cue
@@ -4,9 +4,9 @@
 
 package types
 
-NamespacedName: {
+NamespacedName :: {
 	Namespace: string
 	Name:      string
 }
 
-Separator: 47 // '/'
+Separator :: 47 // '/'
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/types/nodename_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/types/nodename_go_gen.cue
index 042edea..5289541 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/types/nodename_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/types/nodename_go_gen.cue
@@ -28,4 +28,4 @@
 //   For AWS, the InstanceID is not yet suitable for use as a Node.Name, so we actually use the
 //   PrivateDnsName for the Node.Name.  And this is _not_ always the same as the hostname: if
 //   we are using a custom DHCP domain it won't be.
-NodeName: string
+NodeName :: string
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/types/patch_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/types/patch_go_gen.cue
index 25ac855..76eeff8 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/types/patch_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/types/patch_go_gen.cue
@@ -7,15 +7,15 @@
 // Similarly to above, these are constants to support HTTP PATCH utilized by
 // both the client and server that didn't make sense for a whole package to be
 // dedicated to.
-PatchType: string // enumPatchType
+PatchType :: string // enumPatchType
 
-enumPatchType:
+enumPatchType ::
 	JSONPatchType |
 	MergePatchType |
 	StrategicMergePatchType |
 	ApplyPatchType
 
-JSONPatchType:           PatchType & "application/json-patch+json"
-MergePatchType:          PatchType & "application/merge-patch+json"
-StrategicMergePatchType: PatchType & "application/strategic-merge-patch+json"
-ApplyPatchType:          PatchType & "application/apply-patch+yaml"
+JSONPatchType ::           PatchType & "application/json-patch+json"
+MergePatchType ::          PatchType & "application/merge-patch+json"
+StrategicMergePatchType :: PatchType & "application/strategic-merge-patch+json"
+ApplyPatchType ::          PatchType & "application/apply-patch+yaml"
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/types/uid_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/types/uid_go_gen.cue
index b207a70..fbd0932 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/types/uid_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/types/uid_go_gen.cue
@@ -7,4 +7,4 @@
 // UID is a type that holds unique ID values, including UUIDs.  Because we
 // don't ONLY use UUIDs, this is an alias to string.  Being a type captures
 // intent and helps make sure that UIDs and names do not get conflated.
-UID: string
+UID :: string
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/util/intstr/intstr_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/util/intstr/intstr_go_gen.cue
index a8d644a..e77c8a5 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/util/intstr/intstr_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/util/intstr/intstr_go_gen.cue
@@ -13,14 +13,14 @@
 // +protobuf=true
 // +protobuf.options.(gogoproto.goproto_stringer)=false
 // +k8s:openapi-gen=true
-IntOrString: _
+IntOrString :: _
 
 // Type represents the stored type of IntOrString.
-Type: int // enumType
+Type :: int // enumType
 
-enumType:
+enumType ::
 	Int |
 	String
 
-Int:    Type & 0
-String: Type & 1
+Int ::    Type & 0
+String :: Type & 1
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/watch/filter_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/watch/filter_go_gen.cue
index e066bbe..e20ae6d 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/watch/filter_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/watch/filter_go_gen.cue
@@ -5,6 +5,6 @@
 package watch
 
 // Recorder records all events that are sent from the watch until it is closed.
-Recorder: {
+Recorder :: {
 	Interface: Interface
 }
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/watch/mux_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/watch/mux_go_gen.cue
index d6eb54d..e37e769 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/watch/mux_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/watch/mux_go_gen.cue
@@ -6,11 +6,11 @@
 
 // FullChannelBehavior controls how the Broadcaster reacts if a watcher's watch
 // channel is full.
-FullChannelBehavior: int // enumFullChannelBehavior
+FullChannelBehavior :: int // enumFullChannelBehavior
 
-enumFullChannelBehavior:
+enumFullChannelBehavior ::
 	WaitIfChannelFull |
 	DropIfChannelFull
 
-WaitIfChannelFull: FullChannelBehavior & 0
-DropIfChannelFull: FullChannelBehavior & 1
+WaitIfChannelFull :: FullChannelBehavior & 0
+DropIfChannelFull :: FullChannelBehavior & 1
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/watch/streamwatcher_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/watch/streamwatcher_go_gen.cue
index 8ef5e72..ac496d2 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/watch/streamwatcher_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/watch/streamwatcher_go_gen.cue
@@ -5,8 +5,8 @@
 package watch
 
 // Decoder allows StreamWatcher to watch any stream for which a Decoder can be written.
-Decoder: _
+Decoder :: _
 
 // Reporter hides the details of how an error is turned into a runtime.Object for
 // reporting on a watch stream since this package may not import a higher level report.
-Reporter: _
+Reporter :: _
diff --git a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/watch/watch_go_gen.cue b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/watch/watch_go_gen.cue
index 2cfced5..02b6b22 100644
--- a/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/watch/watch_go_gen.cue
+++ b/doc/tutorial/kubernetes/quick/pkg/k8s.io/apimachinery/pkg/watch/watch_go_gen.cue
@@ -9,28 +9,28 @@
 )
 
 // Interface can be implemented by anything that knows how to watch and report changes.
-Interface: _
+Interface :: _
 
 // EventType defines the possible types of events.
-EventType: string // enumEventType
+EventType :: string // enumEventType
 
-enumEventType:
+enumEventType ::
 	Added |
 	Modified |
 	Deleted |
 	Bookmark |
 	Error
 
-Added:           EventType & "ADDED"
-Modified:        EventType & "MODIFIED"
-Deleted:         EventType & "DELETED"
-Bookmark:        EventType & "BOOKMARK"
-Error:           EventType & "ERROR"
-DefaultChanSize: int32 & 100
+Added ::           EventType & "ADDED"
+Modified ::        EventType & "MODIFIED"
+Deleted ::         EventType & "DELETED"
+Bookmark ::        EventType & "BOOKMARK"
+Error ::           EventType & "ERROR"
+DefaultChanSize :: int32 & 100
 
 // Event represents a single event to a watched resource.
 // +k8s:deepcopy-gen=true
-Event: {
+Event :: {
 	Type: EventType
 
 	// Object is:
@@ -46,11 +46,11 @@
 }
 
 // FakeWatcher lets you test anything that consumes a watch.Interface; threadsafe.
-FakeWatcher: {
+FakeWatcher :: {
 	Stopped: bool
 }
 
 // RaceFreeFakeWatcher lets you test anything that consumes a watch.Interface; threadsafe.
-RaceFreeFakeWatcher: {
+RaceFreeFakeWatcher :: {
 	Stopped: bool
 }
diff --git a/doc/tutorial/kubernetes/quick/services/frontend/kube.cue b/doc/tutorial/kubernetes/quick/services/frontend/kube.cue
index ce4c25e..b2a3007 100644
--- a/doc/tutorial/kubernetes/quick/services/frontend/kube.cue
+++ b/doc/tutorial/kubernetes/quick/services/frontend/kube.cue
@@ -1,6 +1,6 @@
 package kube
 
-_component: "frontend"
+Component :: "frontend"
 
 deployment <X> spec template: {
 	metadata annotations: {
diff --git a/doc/tutorial/kubernetes/quick/services/infra/kube.cue b/doc/tutorial/kubernetes/quick/services/infra/kube.cue
index c8d7b2a..3403c30 100644
--- a/doc/tutorial/kubernetes/quick/services/infra/kube.cue
+++ b/doc/tutorial/kubernetes/quick/services/infra/kube.cue
@@ -1,3 +1,3 @@
 package kube
 
-_component: "infra"
+Component :: "infra"
diff --git a/doc/tutorial/kubernetes/quick/services/k8s_defs.cue b/doc/tutorial/kubernetes/quick/services/k8s_defs.cue
index 22781b7..06b27eb 100644
--- a/doc/tutorial/kubernetes/quick/services/k8s_defs.cue
+++ b/doc/tutorial/kubernetes/quick/services/k8s_defs.cue
@@ -6,7 +6,7 @@
   apps_v1beta1 "k8s.io/api/apps/v1beta1"
 )
 
-service <Name>: v1.Service & {}
-deployment <Name>: extensions_v1beta1.Deployment & {}
-daemonSet <Name>: extensions_v1beta1.DaemonSet & {}
-statefulSet <Name>: apps_v1beta1.StatefulSet & {}
+service <Name>: v1.Service
+deployment <Name>: extensions_v1beta1.Deployment
+daemonSet <Name>: extensions_v1beta1.DaemonSet
+statefulSet <Name>: apps_v1beta1.StatefulSet
diff --git a/doc/tutorial/kubernetes/quick/services/kitchen/kube.cue b/doc/tutorial/kubernetes/quick/services/kitchen/kube.cue
index 602a713..e607ec4 100644
--- a/doc/tutorial/kubernetes/quick/services/kitchen/kube.cue
+++ b/doc/tutorial/kubernetes/quick/services/kitchen/kube.cue
@@ -1,6 +1,6 @@
 package kube
 
-_component: "kitchen"
+Component :: "kitchen"
 
 deployment <Name> spec template: {
 	metadata annotations "prometheus.io.scrape": "true"
@@ -19,26 +19,26 @@
 	}]
 }
 
-deployment <Name> spec template spec: {
-	_hasDisks: *true | bool
+deployment <ID> spec template spec: {
+	hasDisks :: *true | bool
 
 	volumes: [{
-		name: *"\(Name)-disk" | string
-		gcePersistentDisk pdName: *"\(Name)-disk" | string
+		name: *"\(ID)-disk" | string
+		gcePersistentDisk pdName: *"\(ID)-disk" | string
 		gcePersistentDisk fsType: "ext4"
 	}, {
-		name: *"secret-\(Name)" | string
-		secret secretName: *"\(Name)-secrets" | string
-	}, ...] if _hasDisks
+		name: *"secret-\(ID)" | string
+		secret secretName: *"\(ID)-secrets" | string
+	}, ...] if hasDisks
 
 	containers: [{
 		volumeMounts: [{
-			name:      *"\(Name)-disk" | string
+			name:      *"\(ID)-disk" | string
 			mountPath: *"/logs" | string
 		}, {
 			mountPath: *"/etc/certs" | string
-			name:      *"secret-\(Name)" | string
+			name:      *"secret-\(ID)" | string
 			readOnly:  true
 		}, ...]
-	}] if _hasDisks // field comprehension using just "if"
+	}] if hasDisks // field comprehension using just "if"
 }
diff --git a/doc/tutorial/kubernetes/quick/services/kitchen/souschef/kube.cue b/doc/tutorial/kubernetes/quick/services/kitchen/souschef/kube.cue
index 1a6f39a..82e6533 100644
--- a/doc/tutorial/kubernetes/quick/services/kitchen/souschef/kube.cue
+++ b/doc/tutorial/kubernetes/quick/services/kitchen/souschef/kube.cue
@@ -4,4 +4,6 @@
 	image: "gcr.io/myproj/souschef:v0.5.3"
 }]
 
-deployment souschef spec template spec _hasDisks: false
+deployment souschef spec template spec: {
+	hasDisks :: false
+}
diff --git a/doc/tutorial/kubernetes/quick/services/kube.cue b/doc/tutorial/kubernetes/quick/services/kube.cue
index 6be6276..a66ef9f 100644
--- a/doc/tutorial/kubernetes/quick/services/kube.cue
+++ b/doc/tutorial/kubernetes/quick/services/kube.cue
@@ -1,14 +1,14 @@
 package kube
 
-service <Name>: {
+service <ID>: {
 	apiVersion: "v1"
 	kind:       "Service"
 	metadata: {
-		name: Name
+		name: ID
 		labels: {
-			app:       Name       // by convention
-			domain:    "prod"     // always the same in the given files
-			component: _component // varies per directory
+			app:       ID        // by convention
+			domain:    "prod"    // always the same in the given files
+			component: Component // varies per directory
 		}
 	}
 	spec: {
@@ -22,62 +22,63 @@
 	}
 }
 
-deployment <Name>: {
+deployment <ID>: {
 	apiVersion: "extensions/v1beta1"
 	kind:       "Deployment"
-	metadata name: Name
+	metadata name: ID
 	spec: {
 		// 1 is the default, but we allow any number
 		replicas: *1 | int
 		template: {
 			metadata labels: {
-				app:       Name
+				app:       ID
 				domain:    "prod"
-				component: _component
+				component: Component
 			}
 			// we always have one namesake container
-			spec containers: [{name: Name}]
+			spec containers: [{name: ID}]
 		}
 	}
 }
 
-_component: string
+Component :: string
 
-daemonSet <Name>: _spec & {
+daemonSet <ID>: _spec & {
 	apiVersion: "extensions/v1beta1"
 	kind:       "DaemonSet"
-	_name:      Name
+	Name ::     ID
 }
 
-statefulSet <Name>: _spec & {
+statefulSet <ID>: _spec & {
 	apiVersion: "apps/v1beta1"
 	kind:       "StatefulSet"
-	_name:      Name
+	Name ::     ID
 }
 
-deployment <Name>: _spec & {
+deployment <ID>: _spec & {
 	apiVersion: "extensions/v1beta1"
 	kind:       "Deployment"
-	_name:      Name
+	Name ::     ID
 	spec replicas: *1 | int
 }
 
-configMap <Name>: {
-	metadata name: Name
-	metadata labels component: _component
+configMap <ID>: {
+	metadata name: ID
+	metadata labels component: Component
 }
 
 _spec: {
-	_name: string
-	metadata name: _name
-	metadata labels component: _component
+	Name :: string
+
+	metadata name: Name
+	metadata labels component: Component
 	spec template: {
 		metadata labels: {
-			app:       _name
-			component: _component
+			app:       Name
+			component: Component
 			domain:    "prod"
 		}
-		spec containers: [{name: _name}]
+		spec containers: [{name: Name}]
 	}
 }
 
diff --git a/doc/tutorial/kubernetes/quick/services/mon/kube.cue b/doc/tutorial/kubernetes/quick/services/mon/kube.cue
index 52d1d07..1db3b13 100644
--- a/doc/tutorial/kubernetes/quick/services/mon/kube.cue
+++ b/doc/tutorial/kubernetes/quick/services/mon/kube.cue
@@ -1,3 +1,3 @@
 package kube
 
-_component: "mon"
+Component :: "mon"
diff --git a/doc/tutorial/kubernetes/quick/services/proxy/kube.cue b/doc/tutorial/kubernetes/quick/services/proxy/kube.cue
index 6288fcc..2c4dc2e 100644
--- a/doc/tutorial/kubernetes/quick/services/proxy/kube.cue
+++ b/doc/tutorial/kubernetes/quick/services/proxy/kube.cue
@@ -1,3 +1,3 @@
 package kube
 
-_component: "proxy"
+Component :: "proxy"
diff --git a/doc/tutorial/kubernetes/testdata/quick.out b/doc/tutorial/kubernetes/testdata/quick.out
index 11452dc..c0dba49 100644
--- a/doc/tutorial/kubernetes/testdata/quick.out
+++ b/doc/tutorial/kubernetes/testdata/quick.out
@@ -8,8 +8,9 @@
 }
 statefulSet: {
 }
-_component: string
+Component :: string
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -33,7 +34,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -47,8 +47,9 @@
 }
 statefulSet: {
 }
-_component: "frontend"
+Component :: "frontend"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -72,7 +73,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -108,6 +108,7 @@
 deployment: {
     bartender: {
         kind:       "Deployment"
+        Name ::     "bartender"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "bartender"
@@ -142,15 +143,15 @@
             }
             replicas: 1
         }
-        _name: "bartender"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "frontend"
+Component :: "frontend"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -174,7 +175,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -210,6 +210,7 @@
 deployment: {
     breaddispatcher: {
         kind:       "Deployment"
+        Name ::     "breaddispatcher"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "breaddispatcher"
@@ -244,15 +245,15 @@
             }
             replicas: 1
         }
-        _name: "breaddispatcher"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "frontend"
+Component :: "frontend"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -276,7 +277,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -312,6 +312,7 @@
 deployment: {
     host: {
         kind:       "Deployment"
+        Name ::     "host"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "host"
@@ -346,15 +347,15 @@
             }
             replicas: 2
         }
-        _name: "host"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "frontend"
+Component :: "frontend"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -378,7 +379,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -414,6 +414,7 @@
 deployment: {
     maitred: {
         kind:       "Deployment"
+        Name ::     "maitred"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "maitred"
@@ -448,15 +449,15 @@
             }
             replicas: 1
         }
-        _name: "maitred"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "frontend"
+Component :: "frontend"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -480,7 +481,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -516,6 +516,7 @@
 deployment: {
     valeter: {
         kind:       "Deployment"
+        Name ::     "valeter"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "valeter"
@@ -550,15 +551,15 @@
             }
             replicas: 1
         }
-        _name: "valeter"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "frontend"
+Component :: "frontend"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -582,7 +583,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -618,6 +618,7 @@
 deployment: {
     waiter: {
         kind:       "Deployment"
+        Name ::     "waiter"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "waiter"
@@ -651,15 +652,15 @@
             }
             replicas: 5
         }
-        _name: "waiter"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "frontend"
+Component :: "frontend"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -683,7 +684,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -719,6 +719,7 @@
 deployment: {
     waterdispatcher: {
         kind:       "Deployment"
+        Name ::     "waterdispatcher"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "waterdispatcher"
@@ -753,15 +754,15 @@
             }
             replicas: 1
         }
-        _name: "waterdispatcher"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "frontend"
+Component :: "frontend"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -785,7 +786,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -799,8 +799,9 @@
 }
 statefulSet: {
 }
-_component: "infra"
+Component :: "infra"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -824,7 +825,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -860,6 +860,7 @@
 deployment: {
     download: {
         kind:       "Deployment"
+        Name ::     "download"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "download"
@@ -889,15 +890,15 @@
             }
             replicas: 1
         }
-        _name: "download"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "infra"
+Component :: "infra"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -921,7 +922,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -967,6 +967,7 @@
 statefulSet: {
     etcd: {
         kind:       "StatefulSet"
+        Name ::     "etcd"
         apiVersion: "apps/v1beta1"
         metadata: {
             name: "etcd"
@@ -1071,11 +1072,11 @@
                 }
             }]
         }
-        _name: "etcd"
     }
 }
-_component: "infra"
+Component :: "infra"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -1099,7 +1100,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -1135,6 +1135,7 @@
 deployment: {
     events: {
         kind:       "Deployment"
+        Name ::     "events"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "events"
@@ -1196,15 +1197,15 @@
             }
             replicas: 2
         }
-        _name: "events"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "infra"
+Component :: "infra"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -1228,7 +1229,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -1266,6 +1266,7 @@
 deployment: {
     tasks: {
         kind:       "Deployment"
+        Name ::     "tasks"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "tasks"
@@ -1312,15 +1313,15 @@
             }
             replicas: 1
         }
-        _name: "tasks"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "infra"
+Component :: "infra"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -1344,7 +1345,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -1380,6 +1380,7 @@
 deployment: {
     updater: {
         kind:       "Deployment"
+        Name ::     "updater"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "updater"
@@ -1420,15 +1421,15 @@
             }
             replicas: 1
         }
-        _name: "updater"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "infra"
+Component :: "infra"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -1452,7 +1453,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -1490,6 +1490,7 @@
 deployment: {
     watcher: {
         kind:       "Deployment"
+        Name ::     "watcher"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "watcher"
@@ -1532,15 +1533,15 @@
             }
             replicas: 1
         }
-        _name: "watcher"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "infra"
+Component :: "infra"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -1564,7 +1565,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -1578,8 +1578,9 @@
 }
 statefulSet: {
 }
-_component: "kitchen"
+Component :: "kitchen"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -1603,7 +1604,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -1639,6 +1639,7 @@
 deployment: {
     caller: {
         kind:       "Deployment"
+        Name ::     "caller"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "caller"
@@ -1705,20 +1706,20 @@
                             }
                         }
                     }]
-                    _hasDisks: true
+                    hasDisks :: true
                 }
             }
             replicas: 3
         }
-        _name: "caller"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "kitchen"
+Component :: "kitchen"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -1742,7 +1743,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -1778,6 +1778,7 @@
 deployment: {
     dishwasher: {
         kind:       "Deployment"
+        Name ::     "dishwasher"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "dishwasher"
@@ -1844,20 +1845,20 @@
                             }
                         }
                     }]
-                    _hasDisks: true
+                    hasDisks :: true
                 }
             }
             replicas: 5
         }
-        _name: "dishwasher"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "kitchen"
+Component :: "kitchen"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -1881,7 +1882,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -1917,6 +1917,7 @@
 deployment: {
     expiditer: {
         kind:       "Deployment"
+        Name ::     "expiditer"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "expiditer"
@@ -1974,20 +1975,20 @@
                             }
                         }
                     }]
-                    _hasDisks: true
+                    hasDisks :: true
                 }
             }
             replicas: 1
         }
-        _name: "expiditer"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "kitchen"
+Component :: "kitchen"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -2011,7 +2012,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -2047,6 +2047,7 @@
 deployment: {
     headchef: {
         kind:       "Deployment"
+        Name ::     "headchef"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "headchef"
@@ -2104,20 +2105,20 @@
                             }
                         }
                     }]
-                    _hasDisks: true
+                    hasDisks :: true
                 }
             }
             replicas: 1
         }
-        _name: "headchef"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "kitchen"
+Component :: "kitchen"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -2141,7 +2142,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -2177,6 +2177,7 @@
 deployment: {
     linecook: {
         kind:       "Deployment"
+        Name ::     "linecook"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "linecook"
@@ -2234,20 +2235,20 @@
                             }
                         }
                     }]
-                    _hasDisks: true
+                    hasDisks :: true
                 }
             }
             replicas: 1
         }
-        _name: "linecook"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "kitchen"
+Component :: "kitchen"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -2271,7 +2272,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -2307,6 +2307,7 @@
 deployment: {
     pastrychef: {
         kind:       "Deployment"
+        Name ::     "pastrychef"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "pastrychef"
@@ -2364,20 +2365,20 @@
                             }
                         }
                     }]
-                    _hasDisks: true
+                    hasDisks :: true
                 }
             }
             replicas: 1
         }
-        _name: "pastrychef"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "kitchen"
+Component :: "kitchen"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -2401,7 +2402,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -2437,6 +2437,7 @@
 deployment: {
     souschef: {
         kind:       "Deployment"
+        Name ::     "souschef"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "souschef"
@@ -2473,20 +2474,20 @@
                             }
                         }
                     }]
-                    _hasDisks: false
+                    hasDisks :: false
                 }
             }
             replicas: 1
         }
-        _name: "souschef"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "kitchen"
+Component :: "kitchen"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -2510,7 +2511,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -2524,8 +2524,9 @@
 }
 statefulSet: {
 }
-_component: "mon"
+Component :: "mon"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -2549,7 +2550,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -2619,6 +2619,7 @@
 deployment: {
     alertmanager: {
         kind:       "Deployment"
+        Name ::     "alertmanager"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "alertmanager"
@@ -2673,15 +2674,15 @@
             }
             replicas: 1
         }
-        _name: "alertmanager"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "mon"
+Component :: "mon"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -2705,7 +2706,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -2741,6 +2741,7 @@
 deployment: {
     grafana: {
         kind:       "Deployment"
+        Name ::     "grafana"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "grafana"
@@ -2802,15 +2803,15 @@
             }
             replicas: 1
         }
-        _name: "grafana"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "mon"
+Component :: "mon"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -2834,7 +2835,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -2877,6 +2877,7 @@
 daemonSet: {
     "node-exporter": {
         kind:       "DaemonSet"
+        Name ::     "node-exporter"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "node-exporter"
@@ -2941,13 +2942,13 @@
                 }
             }
         }
-        _name: "node-exporter"
     }
 }
 statefulSet: {
 }
-_component: "mon"
+Component :: "mon"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -2971,7 +2972,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -3253,6 +3253,7 @@
 deployment: {
     prometheus: {
         kind:       "Deployment"
+        Name ::     "prometheus"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "prometheus"
@@ -3310,15 +3311,15 @@
                 }
             }
         }
-        _name: "prometheus"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "mon"
+Component :: "mon"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -3342,7 +3343,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -3356,8 +3356,9 @@
 }
 statefulSet: {
 }
-_component: "proxy"
+Component :: "proxy"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -3381,7 +3382,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -3482,6 +3482,7 @@
 deployment: {
     authproxy: {
         kind:       "Deployment"
+        Name ::     "authproxy"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "authproxy"
@@ -3522,15 +3523,15 @@
             }
             replicas: 1
         }
-        _name: "authproxy"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "proxy"
+Component :: "proxy"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -3554,7 +3555,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -3592,6 +3592,7 @@
 deployment: {
     goget: {
         kind:       "Deployment"
+        Name ::     "goget"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "goget"
@@ -3631,15 +3632,15 @@
             }
             replicas: 1
         }
-        _name: "goget"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "proxy"
+Component :: "proxy"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -3663,7 +3664,6 @@
             }
         }
     }
-    _name: string
 }
 
 
@@ -3872,6 +3872,7 @@
 deployment: {
     nginx: {
         kind:       "Deployment"
+        Name ::     "nginx"
         apiVersion: "extensions/v1beta1"
         metadata: {
             name: "nginx"
@@ -3923,15 +3924,15 @@
             }
             replicas: 1
         }
-        _name: "nginx"
     }
 }
 daemonSet: {
 }
 statefulSet: {
 }
-_component: "proxy"
+Component :: "proxy"
 _spec: {
+    Name :: string
     metadata: {
         name: string
         labels: {
@@ -3955,5 +3956,4 @@
             }
         }
     }
-    _name: string
 }
\ No newline at end of file