//   3. Signer whose configured minimum is longer than the requested duration
  //
  // The minimum valid value for expirationSeconds is 600, i.e. 10 minutes.
  //
  // +optional
  optional int32 expirationSeconds = 8;

  // allowedUsages specifies a set of usage contexts the key will be
  // valid for.
  // See:

when a certificate is near expiration (configurable by `SECRET_GRACE_PERIOD_RATIO`, defaulting to half of the expiration plus or minus a few minutes to stagger renewals). If the SDS server
is still interested in this certificate (ie, Envoy is still connected and requesting the certificate), the SDS server will send another request

  //   3. Signer whose configured minimum is longer than the requested duration
  //
  // The minimum valid value for expirationSeconds is 600, i.e. 10 minutes.
  //
  // +optional
  optional int32 expirationSeconds = 8;

  // usages specifies a set of key usages requested in the issued certificate.
  //

  // to the endpoint that served this list to retrieve the next set of available objects. Continuing a
  // consistent list may not be possible if the server configuration has changed or more than a few
  // minutes have passed. The resourceVersion field returned when using this continue value will be
  // identical to the value in the first response, unless you have received this token from an error
  // message.

  // start trying to rotate the token if the token is older than 80 percent of
  // its time to live or if the token is older than 24 hours.Defaults to 1 hour
  // and must be at least 10 minutes.
  // +optional
  optional int64 expirationSeconds = 2;

  // path is the path relative to the mount point of the file to project the
  // token into.
  optional string path = 3;
}