// +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec holds information about the pod being evaluated
  optional ImageReviewSpec spec = 2;

  // Status is filled in by the backend and indicates whether the pod should be allowed.
  // +optional
  optional ImageReviewStatus status = 3;
}

// ImageReviewContainerSpec is a description of a container within the pod creation request.

  // Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when
  // the rolling update starts, such that the total number of old and new pods do not exceed
  // 130% of desired pods. Once old pods have been killed,
  // new ReplicaSet can be scaled up further, ensuring that total number of pods running
  // at any time during the update is at most 130% of desired pods.
  // +optional

  // required.
  // +listType=atomic
  // +optional
  repeated AuditAnnotation auditAnnotations = 5;

  // MatchConditions is a list of conditions that must be met for a request to be validated.
  // Match conditions filter requests that have already been matched by the rules,
  // namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
  // There are a maximum of 64 match conditions allowed.
  //

  // you made the request against.  If empty, it is defaulted.
  optional SubjectAccessReviewSpec spec = 2;

  // Status is filled in by the server and indicates whether the request is allowed or not
  // +optional
  optional SubjectAccessReviewStatus status = 3;
}

// They are consumed by the kube-scheduler when a CSI driver opts into
// capacity-aware scheduling with CSIDriverSpec.StorageCapacity. The scheduler
// compares the MaximumVolumeSize against the requested size of pending volumes
// to filter out unsuitable nodes. If MaximumVolumeSize is unset, it falls back
// to a comparison against the less precise Capacity. If that is also unset,
// the scheduler assumes that capacity is insufficient and tries some other
// node.

  //
  // Defaults to "Never".
  // +optional
  optional string reinvocationPolicy = 10;

  // MatchConditions is a list of conditions that must be met for a request to be sent to this
  // webhook. Match conditions filter requests that have already been matched by the rules,
  // namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
  // There are a maximum of 64 match conditions allowed.
  //

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec holds information about the request being evaluated
  optional TokenRequestSpec spec = 2;

  // Status is filled in by the server and indicates whether the token can be authenticated.
  // +optional
  optional TokenRequestStatus status = 3;
}

// TokenRequestSpec contains client provided parameters of a token request.

  // `example.com:foo:v1`.
  //
  // If signerName is empty, then the ClusterTrustBundle object's name must
  // not have such a prefix.
  //
  // List/watch requests for ClusterTrustBundles can filter on this field
  // using a `spec.signerName=NAME` field selector.
  //
  // +optional
  optional string signerName = 1;

  // trustBundle contains the individual X.509 trust anchors for this

// capacity-aware scheduling with CSIDriverSpec.StorageCapacity. The scheduler
// compares the MaximumVolumeSize against the requested size of pending volumes
// to filter out unsuitable nodes. If MaximumVolumeSize is unset, it falls back
// to a comparison against the less precise Capacity. If that is also unset,
// the scheduler assumes that capacity is insufficient and tries some other
// node.

  // ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.
  // If specified, these secrets will be passed to individual puller implementations for them to use.
  // More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod
  // +optional
  // +patchMergeKey=name
  // +patchStrategy=merge