improve IAM module

Signed-off-by: hongming <talonwan@yunify.com>

vendor/k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto

@@ -163,6 +163,7 @@ message DeleteOptions {
 
   // Must be fulfilled before a deletion is carried out. If not possible, a 409 Conflict status will be
   // returned.
+  // +k8s:conversion-gen=false
   // +optional
   optional Preconditions preconditions = 2;
 
@@ -416,9 +417,6 @@ message ListOptions {
   // If this is not a watch, this field is ignored.
   // If the feature gate WatchBookmarks is not enabled in apiserver,
   // this field is ignored.
-  //
-  // This field is beta.
-  //
   // +optional
   optional bool allowWatchBookmarks = 9;
 
@@ -663,6 +661,15 @@ message ObjectMeta {
   // is an identifier for the responsible component that will remove the entry
   // from the list. If the deletionTimestamp of the object is non-nil, entries
   // in this list can only be removed.
+  // Finalizers may be processed and removed in any order.  Order is NOT enforced
+  // because it introduces significant risk of stuck finalizers.
+  // finalizers is a shared field, any actor with permission can reorder it.
+  // If the finalizer list is processed in order, then this can lead to a situation
+  // in which the component responsible for the first finalizer in the list is
+  // waiting for a signal (field value, external system, or other) produced by a
+  // component responsible for a finalizer later in the list, resulting in a deadlock.
+  // Without enforced ordering finalizers are free to order amongst themselves and
+  // are not vulnerable to ordering changes in the list.
   // +optional
   // +patchStrategy=merge
   repeated string finalizers = 14;