optional string warning = 3;
}

message MatchCondition {
  // Name is an identifier for this match condition, used for strategic merging of MatchConditions,
  // as well as providing an identifier for logging purposes. A good name should be descriptive of
  // the associated expression.
  // Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and

message GroupSubject {
  // name is the user group that matches, or "*" to match all user groups.
  // See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some
  // well-known group names.
  // Required.
  optional string name = 1;
}

// LimitResponse defines how to handle requests that can not be executed right now.
// +union
message LimitResponse {

message GroupSubject {
  // name is the user group that matches, or "*" to match all user groups.
  // See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some
  // well-known group names.
  // Required.
  optional string name = 1;
}

// LimitResponse defines how to handle requests that can not be executed right now.
// +union
message LimitResponse {

message HorizontalPodAutoscalerSpec {
  // scaleTargetRef points to the target resource to scale, and is used to the pods for which metrics
  // should be collected, as well as to actually change the replica count.
  optional CrossVersionObjectReference scaleTargetRef = 1;

  // minReplicas is the lower limit for the number of replicas to which the autoscaler

  //
  // Users of ClusterTrustBundles, including Kubelet, are free to reorder and
  // deduplicate certificate blocks in this file according to their own logic,
  // as well as to drop PEM block headers and inter-block data.
  optional string trustBundle = 2;

//
// Note that the quantity will NEVER be internally represented by a
// floating point number. That is the whole point of this exercise.
//
// Non-canonical values will still parse as long as they are well formed,
// but will be re-emitted in their canonical form. (So always use canonical
// form, or don't diff.)
//
// This format is intended to make it difficult to use these numbers without

message HorizontalPodAutoscalerSpec {
  // scaleTargetRef points to the target resource to scale, and is used to the pods for which metrics
  // should be collected, as well as to actually change the replica count.
  optional CrossVersionObjectReference scaleTargetRef = 1;

  // minReplicas is the lower limit for the number of replicas to which the autoscaler

message HorizontalPodAutoscalerSpec {
  // scaleTargetRef points to the target resource to scale, and is used to the pods for which metrics
  // should be collected, as well as to actually change the replica count.
  optional CrossVersionObjectReference scaleTargetRef = 1;

  // minReplicas is the lower limit for the number of replicas to which the autoscaler

// to Container and allows separate documentation for the fields of EphemeralContainer.
// When a new field is added to Container it must be added here as well.
message EphemeralContainerCommon {
  // Name of the ephemeral container specified as a DNS_LABEL.
  // This name must be unique among all containers, init containers and ephemeral containers.
  optional string name = 1;

  // validity duration so a client must check the delta between the notBefore and
  // and notAfter fields in the issued certificate to determine the actual duration.
  //
  // The v1.22+ in-tree implementations of the well-known Kubernetes signers will
  // honor this field as long as the requested duration is not greater than the
  // maximum duration they will honor per the --cluster-signing-duration CLI