}

// VolumeAttachmentSpec is the specification of a VolumeAttachment request.
message VolumeAttachmentSpec {
  // attacher indicates the name of the volume driver that MUST handle this
  // request. This is the name returned by GetPluginName().
  optional string attacher = 1;

  // source represents the volume that should be attached.
  optional VolumeAttachmentSource source = 2;

  // +optional
  optional NonResourceAttributes nonResourceAttributes = 2;
}

// SelfSubjectRulesReview enumerates the set of actions the current user can perform within a namespace.
// The returned list of actions may be incomplete depending on the server's authorization mode,
// and any errors experienced during the evaluation. SelfSubjectRulesReview should be used by UIs to show/hide actions,

  // should be maintained throughout the lifetime of a claim. Each
  // ResourceHandle contains data that should be passed to a specific kubelet
  // plugin once it lands on a node. This data is returned by the driver
  // after a successful allocation and is opaque to Kubernetes. Driver
  // documentation may explain to users how to interpret this data if needed.
  //

  // A selector to restrict the list of returned objects by their labels.
  // Defaults to everything.
  // +optional
  optional string labelSelector = 1;

  // A selector to restrict the list of returned objects by their fields.
  // Defaults to everything.
  // +optional
  optional string fieldSelector = 2;

  // Watch for changes to the described resources and return them as a stream of

  optional string subresource = 1;

  // responseKind describes the group, version, and kind of the serialization schema for the object type this endpoint typically returns.
  // Some subresources do not return normal resources, these will have null return types.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind responseKind = 2;

  // acceptedTypes describes the kinds that this endpoint accepts.

// When using impersonation, users will receive the user info of the user being impersonated.  If impersonation or
// request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
message SelfSubjectReview {
  // Standard object's metadata.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
  // +optional

  // token's audiences. A client of the TokenReview API that sets the
  // spec.audiences field should validate that a compatible audience identifier
  // is returned in the status.audiences field to ensure that the TokenReview
  // server is audience aware. If a TokenReview returns an empty
  // status.audience field where status.authenticated is "true", the token is
  // valid against the audience of the Kubernetes API server.
  // +optional

  // +optional
  repeated Subject subjects = 2;

  // RoleRef can only reference a ClusterRole in the global namespace.
  // If the RoleRef cannot be resolved, the Authorizer must return an error.
  optional RoleRef roleRef = 3;
}

// ClusterRoleBindingList is a collection of ClusterRoleBindings
message ClusterRoleBindingList {
  // Standard object's metadata.
  // +optional

  // +optional
  optional NonResourceAttributes nonResourceAttributes = 2;
}

// SelfSubjectRulesReview enumerates the set of actions the current user can perform within a namespace.
// The returned list of actions may be incomplete depending on the server's authorization mode,
// and any errors experienced during the evaluation. SelfSubjectRulesReview should be used by UIs to show/hide actions,

  // the admission webhook to add additional context to the audit log for this request.
  // +optional
  map<string, string> auditAnnotations = 6;

  // warnings is a list of warning messages to return to the requesting API client.
  // Warning messages describe a problem the client making the API request should correct or be aware of.
  // Limit warnings to 120 characters if possible.