}

// RoleBinding references a role, but does not contain it.  It can reference a Role in the same namespace or a ClusterRole in the global namespace.
// It adds who information via Subjects and namespace information by which namespace it exists in.  RoleBindings in a given
// namespace only have effect in that namespace.
message RoleBinding {
  // Standard object's metadata.
  // +optional

message ResourceAttributes {
  // Namespace is the namespace of the action being requested.  Currently, there is no distinction between no namespace and all namespaces
  // "" (empty) is defaulted for LocalSubjectAccessReviews
  // "" (empty) is empty for cluster-scoped resources
  // "" (empty) means "all" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview
  // +optional

  // on whether the namespace for that object matches the selector. If the
  // object itself is a namespace, the matching is performed on
  // object.metadata.labels. If the object is another cluster scoped resource,
  // it never skips the webhook.
  //
  // For example, to run the webhook on any objects whose namespace is not

  // scope represents if this refers to a cluster or namespace scoped resource.
  // This may be set to "Cluster" (default) or "Namespace".
  optional string scope = 4;

  // namespace is the namespace of the resource being referenced. This field is
  // required when scope is set to "Namespace" and must be unset when scope is set to
  // "Cluster".
  // +optional
  optional string namespace = 5;
}

  optional string kind = 2;

  // Name is the name of resource being referenced.
  optional string name = 3;

  // Namespace that contains the referenced resource. Must be empty
  // for cluster-scoped resources and non-empty for namespaced
  // resources.
  // +optional
  optional string namespace = 4;
}

// ResourceHandle holds opaque resource data for processing by a specific kubelet plugin.
message ResourceHandle {

message ResourceAttributes {
  // Namespace is the namespace of the action being requested.  Currently, there is no distinction between no namespace and all namespaces
  // "" (empty) is defaulted for LocalSubjectAccessReviews
  // "" (empty) is empty for cluster-scoped resources
  // "" (empty) means "all" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview
  // +optional

  // rely on the server to generate the name.  If that is the case, this field will contain an empty string.
  // +optional
  optional string name = 5;

  // Namespace is the namespace associated with the request (if any).
  // +optional
  optional string namespace = 6;

  // Operation is the operation being performed. This may be different than the operation
  // requested. e.g. a patch can result in either a CREATE or UPDATE Operation.

  // +optional
  optional string generateName = 2;

  // Namespace defines the space within which each name must be unique. An empty namespace is
  // equivalent to the "default" namespace, but "default" is the canonical representation.
  // Not all objects are required to be scoped to a namespace - the value of this field for
  // those objects will be empty.
  //
  // Must be a DNS_LABEL.

  // rely on the server to generate the name.  If that is the case, this field will contain an empty string.
  // +optional
  optional string name = 5;

  // Namespace is the namespace associated with the request (if any).
  // +optional
  optional string namespace = 6;

  // Operation is the operation being performed. This may be different than the operation
  // requested. e.g. a patch can result in either a CREATE or UPDATE Operation.

  // the Pods matching PodSelector in the Namespaces selected by NamespaceSelector.
  // Otherwise it selects the Pods matching PodSelector in the policy's own Namespace.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector podSelector = 1;

  // Selects Namespaces using cluster-scoped labels. This field follows standard label