// +optional
  optional bool privileged = 1;

  // defaultAddCapabilities is the default set of capabilities that will be added to the container
  // unless the pod spec specifically drops the capability.  You may not list a capability in both
  // defaultAddCapabilities and requiredDropCapabilities. Capabilities added here are implicitly
  // allowed, and need not be included in the allowedCapabilities list.
  // +optional

  // may contain a short description of what is wrong.  Kubernetes
  // may truncate excessively long errors when displaying to the user.
  // +optional
  optional string reason = 2;

  // AuditAnnotations will be added to the attributes object of the
  // admission controller request using 'AddAnnotation'.  The keys should
  // be prefix-less (i.e., the admission controller will add an
  // appropriate prefix).
  // +optional

  // Maximal length of the note is 1kB, but libraries should be prepared to
  // handle values up to 64kB.
  // +optional
  optional string note = 10;

  // type is the type of this event (Normal, Warning), new types could be added in the future.
  // It is machine-readable.
  // +optional
  optional string type = 11;

  // deprecatedSource is the deprecated field assuring backward compatibility with core.v1 Event type.
  // +optional

  //
  // An "Approved" condition is added via the /approval subresource,
  // indicating the request was approved and should be issued by the signer.
  //
  // A "Denied" condition is added via the /approval subresource,
  // indicating the request was denied and should not be issued by the signer.
  //
  // A "Failed" condition is added via the /status subresource,

  // set because it cannot be automatically converted.
  optional string apiVersion = 3;

  // Time is the timestamp of when the ManagedFields entry was added. The
  // timestamp will also be updated if a field is added, the manager
  // changes any of the owned fields value or removes a field. The
  // timestamp does not update when a field is removed from the entry
  // because another manager took it over.

  // +optional
  optional string username = 1;

  // A unique value that identifies this user across time. If this user is
  // deleted and another user by the same name is added, they will have
  // different UIDs.
  // +optional
  optional string uid = 2;

  // The names of groups this user is a part of.
  // +optional
  repeated string groups = 3;

  // Maximal length of the note is 1kB, but libraries should be prepared to
  // handle values up to 64kB.
  // +optional
  optional string note = 10;

  // type is the type of this event (Normal, Warning), new types could be added in the future.
  // It is machine-readable.
  // This field cannot be empty for new Events.
  optional string type = 11;

  // deprecatedSource is the deprecated field assuring backward compatibility with core.v1 Event type.

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastUpdateTime = 4;

  // lastTransitionTime is the time the condition last transitioned from one status to another.
  // If unset, when a new condition type is added or an existing condition's status is changed,
  // the server defaults this to the current time.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 5;
}

message AggregationRule {
  // ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
  // If any of the selectors match, then the ClusterRole's permissions will be added
  // +optional
  repeated k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector clusterRoleSelectors = 1;
}

  // deallocated.
  //
  // The driver then must deallocate this claim and reset the field
  // together with clearing the Allocation field.
  //
  // While DeallocationRequested is set, no new consumers may be added to
  // ReservedFor.
  // +optional
  optional bool deallocationRequested = 4;
}

// ResourceClaimTemplate is used to produce ResourceClaim objects.
message ResourceClaimTemplate {