// Status is filled in by the backend and indicates whether the pod should be allowed.
  // +optional
  optional ImageReviewStatus status = 3;
}

// ImageReviewContainerSpec is a description of a container within the pod creation request.
message ImageReviewContainerSpec {
  // This can be in the form image:tag or image@SHA:012345679abcdef.
  // +optional
  optional string image = 1;
}

message ExternalMetricSource {
  // metricName is the name of the metric in question.
  optional string metricName = 1;

  // metricSelector is used to identify a specific time series
  // within a given metric.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector metricSelector = 2;

  // targetValue is the target value of the metric (as a quantity).

  // is allowed in the "volumes" field.
  // +optional
  repeated AllowedFlexVolume allowedFlexVolumes = 18;

  // AllowedCSIDrivers is an allowlist of inline CSI drivers that must be explicitly set to be embedded within a pod spec.
  // An empty value indicates that any CSI driver can be used for inline ephemeral volumes.
  // +optional
  repeated AllowedCSIDriver allowedCSIDrivers = 23;

  // +listType=set
  repeated string verbs = 4;
}

// APIVersionDiscovery holds a list of APIResourceDiscovery types that are served for a particular version within an API Group.
message APIVersionDiscovery {
  // version is the name of the version within a group version.
  optional string version = 1;

  // resources is a list of APIResourceDiscovery objects for the corresponding group version.
  // +listType=map

// that should not be included within this rule.
message IPBlock {
  // CIDR is a string representing the IP Block
  // Valid examples are "192.168.1.0/24" or "2001:db8::/64"
  optional string cidr = 1;

  // Except is a slice of CIDRs that should not be included within an IP Block
  // Valid examples are "192.168.1.0/24" or "2001:db8::/64"

  optional int32 nanos = 2;
}

// ObjectMeta is metadata that all persisted resources must have, which includes all objects
// users must create.
message ObjectMeta {
  // Name must be unique within a namespace. Is required when creating resources, although
  // some resources may allow a client to request the generation of an appropriate name

  // List of carps.
  // More info: http://kubernetes.io/docs/user-guide/carps
  repeated Carp items = 2;
}

// CarpSpec is a description of a carp
message CarpSpec {
  // Restart policy for all containers within the carp.
  // One of Always, OnFailure, Never.
  // Default to Always.
  // More info: http://kubernetes.io/docs/user-guide/carp-states#restartpolicy
  // +optional
  optional string restartPolicy = 3;

  // names are only unique within a namespace.
  optional string volumeName = 1;

  // volumeNamespace specifies the scope of the volume within StorageOS.  If no
  // namespace is specified then the Pod's namespace will be used.  This allows the
  // Kubernetes name scoping to be mirrored within StorageOS for tighter integration.

message ExternalMetricSource {
  // metricName is the name of the metric in question.
  optional string metricName = 1;

  // metricSelector is used to identify a specific time series
  // within a given metric.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector metricSelector = 2;

  // targetValue is the target value of the metric (as a quantity).

  // +optional
  optional NonResourceAttributes nonResourceAttributes = 2;
}

// SelfSubjectRulesReview enumerates the set of actions the current user can perform within a namespace.
// The returned list of actions may be incomplete depending on the server's authorization mode,
// and any errors experienced during the evaluation. SelfSubjectRulesReview should be used by UIs to show/hide actions,