// See user.Info interface for details.
  // +listType=atomic
  // +optional
  repeated string groups = 4;

  // Extra information about the requesting user.
  // See user.Info interface for details.
  // +optional
  map<string, ExtraValue> extra = 6;
}

message CertificateSigningRequestStatus {
  // Conditions applied to the request, such as approval or denial.
  // +listType=map
  // +listMapKey=type
  // +optional

  // tolerations are appended (excluding duplicates) to pods running with this
  // RuntimeClass during admission, effectively unioning the set of nodes
  // tolerated by the pod and the RuntimeClass.
  // +optional
  // +listType=atomic
  repeated k8s.io.api.core.v1.Toleration tolerations = 2;

  // if it is an empty slice, there will be no requests matching the FlowSchema.
  // +listType=atomic
  // +optional
  repeated PolicyRulesWithSubjects rules = 4;
}

// FlowSchemaStatus represents the current state of a FlowSchema.
message FlowSchemaStatus {
  // `conditions` is a list of the current states of FlowSchema.
  // +listType=map
  // +listMapKey=type
  // +optional
  repeated FlowSchemaCondition conditions = 1;

  // if it is an empty slice, there will be no requests matching the FlowSchema.
  // +listType=atomic
  // +optional
  repeated PolicyRulesWithSubjects rules = 4;
}

// FlowSchemaStatus represents the current state of a FlowSchema.
message FlowSchemaStatus {
  // `conditions` is a list of the current states of FlowSchema.
  // +listType=map
  // +listMapKey=type
  // +optional
  repeated FlowSchemaCondition conditions = 1;

  // capabilities. This must contain at least one address but no more than
  // 100. These are all assumed to be fungible and clients may choose to only
  // use the first element. Refer to: https://issue.k8s.io/106267
  // +listType=set
  repeated string addresses = 1;

  // conditions contains information about the current status of the endpoint.
  optional EndpointConditions conditions = 2;

  // the backend (e.g., etcd).
  optional string encodingVersion = 2;

  // The API server can decode objects encoded in these versions.
  // The encodingVersion must be included in the decodableVersions.
  // +listType=set
  repeated string decodableVersions = 3;
}

// Storage version of a specific resource.
message StorageVersion {
  // The name is <group>.<resource>.

  // +listType=atomic
  repeated PodFailurePolicyOnPodConditionsPattern onPodConditions = 3;
}

// UncountedTerminatedPods holds UIDs of Pods that have terminated but haven't
// been accounted in Job status counters.
message UncountedTerminatedPods {
  // succeeded holds UIDs of succeeded Pods.
  // +listType=set
  // +optional
  repeated string succeeded = 1;

  // single kubelet plugin with no ResourceHandle data attached. The name of
  // the kubelet plugin invoked will match the DriverName set in the
  // ResourceClaimStatus this AllocationResult is embedded in.
  //
  // +listType=atomic
  // +optional
  repeated ResourceHandle resourceHandles = 1;

  // This field will get set by the resource driver after it has allocated
  // the resource to inform the scheduler where it can schedule Pods using

  // through the SNI TLS extension, if the ingress controller fulfilling the
  // ingress supports SNI.
  // +listType=atomic
  // +optional
  repeated IngressTLS tls = 2;

  // rules is a list of host rules used to configure the Ingress. If unspecified,
  // or no rule matches, all traffic is sent to the default backend.
  // +listType=atomic
  // +optional
  repeated IngressRule rules = 3;
}

  // If '*' is present, the length of the slice must be one.
  // Required.
  // +listType=atomic
  repeated string apiGroups = 1;

  // APIVersions is the API versions the resources belong to. '*' is all versions.
  // If '*' is present, the length of the slice must be one.
  // Required.
  // +listType=atomic
  repeated string apiVersions = 2;

  // Resources is a list of resources this rule applies to.