// +optional
  repeated Subject subjects = 2;

  // RoleRef can only reference a ClusterRole in the global namespace.
  // If the RoleRef cannot be resolved, the Authorizer must return an error.
  optional RoleRef roleRef = 3;
}

// ClusterRoleBindingList is a collection of ClusterRoleBindings
message ClusterRoleBindingList {
  // Standard object's metadata.
  // +optional

}

// VolumeAttachmentSpec is the specification of a VolumeAttachment request.
message VolumeAttachmentSpec {
  // attacher indicates the name of the volume driver that MUST handle this
  // request. This is the name returned by GetPluginName().
  optional string attacher = 1;

  // source represents the volume that should be attached.
  optional VolumeAttachmentSource source = 2;

  // token's audiences. A client of the TokenReview API that sets the
  // spec.audiences field should validate that a compatible audience identifier
  // is returned in the status.audiences field to ensure that the TokenReview
  // server is audience aware. If a TokenReview returns an empty
  // status.audience field where status.authenticated is "true", the token is
  // valid against the audience of the Kubernetes API server.
  // +optional

  optional string subresource = 1;

  // responseKind describes the group, version, and kind of the serialization schema for the object type this endpoint typically returns.
  // Some subresources do not return normal resources, these will have null return types.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind responseKind = 2;

  // acceptedTypes describes the kinds that this endpoint accepts.

  // the admission webhook to add additional context to the audit log for this request.
  // +optional
  map<string, string> auditAnnotations = 6;

  // warnings is a list of warning messages to return to the requesting API client.
  // Warning messages describe a problem the client making the API request should correct or be aware of.
  // Limit warnings to 120 characters if possible.

// When using impersonation, users will receive the user info of the user being impersonated.  If impersonation or
// request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
message SelfSubjectReview {
  // Standard object's metadata.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
  // +optional

  // the admission webhook to add additional context to the audit log for this request.
  // +optional
  map<string, string> auditAnnotations = 6;

  // warnings is a list of warning messages to return to the requesting API client.
  // Warning messages describe a problem the client making the API request should correct or be aware of.
  // Limit warnings to 120 characters if possible.

  // token's audiences. A client of the TokenReview API that sets the
  // spec.audiences field should validate that a compatible audience identifier
  // is returned in the status.audiences field to ensure that the TokenReview
  // server is audience aware. If a TokenReview returns an empty
  // status.audience field where status.authenticated is "true", the token is
  // valid against the audience of the Kubernetes API server.
  // +optional

  // +optional
  repeated Subject subjects = 2;

  // RoleRef can only reference a ClusterRole in the global namespace.
  // If the RoleRef cannot be resolved, the Authorizer must return an error.
  optional RoleRef roleRef = 3;
}

// ClusterRoleBindingList is a collection of ClusterRoleBindings.

  // +optional
  repeated Subject subjects = 2;

  // RoleRef can only reference a ClusterRole in the global namespace.
  // If the RoleRef cannot be resolved, the Authorizer must return an error.
  optional RoleRef roleRef = 3;
}

// ClusterRoleBindingList is a collection of ClusterRoleBindings.