// +structType=atomic
message Subject {
  // Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
  // If the Authorizer does not recognized the kind value, the Authorizer should report an error.
  optional string kind = 1;

  // APIGroup holds the API group of the referenced subject.
  // Defaults to "" for ServiceAccount subjects.

  // server defined, clients may only use the continue value from a previous query result with identical
  // query parameters (except for the value of continue) and the server may reject a continue value it
  // does not recognize. If the specified continue value is no longer valid whether due to expiration
  // (generally five to fifteen minutes) or a configuration change on the server, the server will

  // the Pod hostname takes the form `$(job-name)-$(index)`.
  //
  // More completion modes can be added in the future.
  // If the Job controller observes a mode that it doesn't recognize, which
  // is possible during upgrades due to version skew, the controller
  // skips updates for the Job.
  // +optional
  optional string completionMode = 9;

  //
  // Clients should expect to handle additional values by ignoring
  // any values not recognized.
  //
  // "Deny" and "Warn" may not be used together since this combination
  // needlessly duplicates the validation failure both in the
  // API response body and the HTTP warning headers.
  //
  // Required.

// or a value for non-objects such as user and group names.
message Subject {
  // Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
  // If the Authorizer does not recognized the kind value, the Authorizer should report an error.
  optional string kind = 1;

  // APIVersion holds the API group and version of the referenced subject.
  // Defaults to "v1" for ServiceAccount subjects.

// or a value for non-objects such as user and group names.
message Subject {
  // Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
  // If the Authorizer does not recognized the kind value, the Authorizer should report an error.
  optional string kind = 1;

  // APIGroup holds the API group of the referenced subject.
  // Defaults to "" for ServiceAccount subjects.