// audit annotation is included with the string value. If the expression
  // evaluates to null or empty string the audit annotation will be omitted.
  // The valueExpression may be no longer than 5kb in length.
  // If the result of the valueExpression is more than 10kb in length, it
  // will be truncated to 10kb.
  //
  // If multiple ValidatingAdmissionPolicyBinding resources match an

  //      implementations prior to v1.22)
  //   2. Signer whose configured maximum is shorter than the requested duration
  //   3. Signer whose configured minimum is longer than the requested duration
  //
  // The minimum valid value for expirationSeconds is 600, i.e. 10 minutes.
  //
  // +optional
  optional int32 expirationSeconds = 8;

  optional string uid = 4;

  // If true, this reference points to the managing controller.
  // +optional
  optional bool controller = 6;

  // If true, AND if the owner has the "foregroundDeletion" finalizer, then
  // the owner cannot be deleted from the key-value store until this
  // reference is removed.
  // See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion

  // storageClassName represents the name of the StorageClass that the reported capacity applies to.
  // It must meet the same requirements as the name of a StorageClass
  // object (non-empty, DNS subdomain). If that object no longer exists,
  // the CSIStorageCapacity object is obsolete and should be removed by its
  // creator.
  // This field is immutable.
  optional string storageClassName = 3;

  // storageClassName represents the name of the StorageClass that the reported capacity applies to.
  // It must meet the same requirements as the name of a StorageClass
  // object (non-empty, DNS subdomain). If that object no longer exists,
  // the CSIStorageCapacity object is obsolete and should be removed by its
  // creator.
  // This field is immutable.
  optional string storageClassName = 3;

}

// ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22.
message ClusterRole {
  // Standard object's metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Rules holds all the PolicyRules for this ClusterRole

}

// ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22.
message ClusterRole {
  // Standard object's metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Rules holds all the PolicyRules for this ClusterRole

  // deprecatedTopology contains topology information part of the v1beta1
  // API. This field is deprecated, and will be removed when the v1beta1
  // API is removed (no sooner than kubernetes v1.24).  While this field can
  // hold values, it is not writable through the v1 API, and any attempts to
  // write to it will be silently ignored. Topology information can be found

  // The grace period is the duration in seconds after the processes running in the carp are sent
  // a termination signal and the time when the processes are forcibly halted with a kill signal.
  // Set this value longer than the expected cleanup time for your process.
  // Defaults to 30 seconds.
  // +optional
  optional int64 terminationGracePeriodSeconds = 4;

  // storageClassName represents the name of the StorageClass that the reported capacity applies to.
  // It must meet the same requirements as the name of a StorageClass
  // object (non-empty, DNS subdomain). If that object no longer exists,
  // the CSIStorageCapacity object is obsolete and should be removed by its
  // creator.
  // This field is immutable.
  optional string storageClassName = 3;