// +optional
  optional string sideEffects = 6;

  // TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,
  // the webhook call will be ignored or the API call will fail based on the
  // failure policy.
  // The timeout value must be between 1 and 30 seconds.
  // Default to 30 seconds.
  // +optional
  optional int32 timeoutSeconds = 7;

  // `validation.policy.admission.k8s.io/validation_failure` audit annotation
  // with a value containing the details of the validation failures, formatted as
  // a JSON list of objects, each with the following fields:
  // - message: The validation failure message string
  // - policy: The resource name of the ValidatingAdmissionPolicy
  // - binding: The resource name of the ValidatingAdmissionPolicyBinding

  optional CertificateSigningRequestSpec spec = 2;

  // status contains information about whether the request is approved or denied,
  // and the certificate issued by the signer, or the failure condition indicating signer failure.
  // +optional
  optional CertificateSigningRequestStatus status = 3;
}

// CertificateSigningRequestCondition describes a condition of a CertificateSigningRequest object

message PodFailurePolicy {
  // A list of pod failure policy rules. The rules are evaluated in order.
  // Once a rule matches a Pod failure, the remaining of the rules are ignored.
  // When no rule matches the Pod failure, the default handling applies - the
  // counter of pod failures is incremented and it is checked against
  // the backoffLimit. At most 20 elements are allowed.

  optional string sideEffects = 6;

  // TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,
  // the webhook call will be ignored or the API call will fail based on the
  // failure policy.
  // The timeout value must be between 1 and 30 seconds.
  // Default to 10 seconds.
  // +optional
  optional int32 timeoutSeconds = 7;