optional SubjectAccessReviewStatus status = 3;
}

// SelfSubjectAccessReviewSpec is a description of the access request.  Exactly one of ResourceAuthorizationAttributes
// and NonResourceAuthorizationAttributes must be set
message SelfSubjectAccessReviewSpec {
  // ResourceAuthorizationAttributes describes information for a resource access request
  // +optional
  optional ResourceAttributes resourceAttributes = 1;

  // +optional
  repeated string resourceNames = 4;

  // NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
  // Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // nodeTopology defines which nodes have access to the storage
  // for which capacity was reported. If not set, the storage is
  // not accessible from any node in the cluster. If empty, the
  // storage is accessible from all nodes. This field is
  // immutable.
  //

  optional SubjectAccessReviewStatus status = 3;
}

// SelfSubjectAccessReviewSpec is a description of the access request.  Exactly one of ResourceAuthorizationAttributes
// and NonResourceAuthorizationAttributes must be set
message SelfSubjectAccessReviewSpec {
  // ResourceAuthorizationAttributes describes information for a resource access request
  // +optional
  optional ResourceAttributes resourceAttributes = 1;

  //
  // Required.
  optional string name = 1;

  // Expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
  // CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:
  //
  // 'object' - The object from the incoming request. The value is null for DELETE requests.

// to deal with the API objects from a plug-in. Unknown objects still have functioning
// TypeMeta features-- kind, version, etc.
// TODO: Make this object have easy access to field based accessors and settors for
// metadata and field mutatation.
//
// +k8s:deepcopy-gen=true
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
// +protobuf=true

  //   Requests for this signer are never auto-approved by kube-controller-manager, and can be issued by the "csrsigning" controller in kube-controller-manager.
  //
  // More details are available at https://k8s.io/docs/reference/access-authn-authz/certificate-signing-requests/#kubernetes-signers
  //
  // Custom signerNames can also be specified. The signer defines:
  //  1. Trust distribution: how trust (CA bundles) are distributed.

  // only if the traffic matches at least one port in the list.
  // +optional
  repeated NetworkPolicyPort ports = 1;

  // List of sources which should be able to access the pods selected for this rule.
  // Items in this list are combined using a logical OR operation.
  // If this field is empty or missing, this rule matches all sources (traffic not restricted by source).

  // +optional
  optional bool blockOwnerDeletion = 7;
}

// PartialObjectMetadata is a generic representation of any object with ObjectMeta. It allows clients
// to get access to a particular ObjectMeta schema without knowing the details of the version.
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
message PartialObjectMetadata {
  // Standard object's metadata.

  // VolumeClaimTemplates when the StatefulSet is scaled down. The default
  // policy of `Retain` causes PVCs to not be affected by a scaledown. The
  // `Delete` policy causes the associated PVCs for any excess pods above
  // the replica count to be deleted.
  optional string whenScaled = 2;
}

// A StatefulSetSpec is the specification of a StatefulSet.
message StatefulSetSpec {