//
  // Required.
  optional string name = 1;

  // Expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
  // CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:
  //
  // 'object' - The object from the incoming request. The value is null for DELETE requests.

  optional SubjectAccessReviewStatus status = 3;
}

// SelfSubjectAccessReviewSpec is a description of the access request.  Exactly one of ResourceAuthorizationAttributes
// and NonResourceAuthorizationAttributes must be set
message SelfSubjectAccessReviewSpec {
  // ResourceAuthorizationAttributes describes information for a resource access request
  // +optional
  optional ResourceAttributes resourceAttributes = 1;

// to deal with the API objects from a plug-in. Unknown objects still have functioning
// TypeMeta features-- kind, version, etc.
// TODO: Make this object have easy access to field based accessors and settors for
// metadata and field mutatation.
//
// +k8s:deepcopy-gen=true
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
// +protobuf=true

  // "*" matches all verbs. If it is present, it must be the only entry.
  // +listType=set
  // Required.
  repeated string verbs = 1;

  // `nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty.
  // For example:
  //   - "/healthz" is legal
  //   - "/hea*" is illegal
  //   - "/hea" is legal but matches nothing
  //   - "/hea/*" also matches nothing

  // "*" matches all verbs. If it is present, it must be the only entry.
  // +listType=set
  // Required.
  repeated string verbs = 1;

  // `nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty.
  // For example:
  //   - "/healthz" is legal
  //   - "/hea*" is illegal
  //   - "/hea" is legal but matches nothing
  //   - "/hea/*" also matches nothing

  optional SubjectAccessReviewStatus status = 3;
}

// SelfSubjectAccessReviewSpec is a description of the access request.  Exactly one of ResourceAuthorizationAttributes
// and NonResourceAuthorizationAttributes must be set
message SelfSubjectAccessReviewSpec {
  // ResourceAuthorizationAttributes describes information for a resource access request
  // +optional
  optional ResourceAttributes resourceAttributes = 1;

  //   Requests for this signer are never auto-approved by kube-controller-manager, and can be issued by the "csrsigning" controller in kube-controller-manager.
  //
  // More details are available at https://k8s.io/docs/reference/access-authn-authz/certificate-signing-requests/#kubernetes-signers
  //
  // Custom signerNames can also be specified. The signer defines:
  //  1. Trust distribution: how trust (CA bundles) are distributed.

  // targetAverageUtilization is the target value of the average of the
  // resource metric across all relevant pods, represented as a percentage of
  // the requested value of the resource for the pods.
  // +optional
  optional int32 targetAverageUtilization = 2;

  // targetAverageValue is the target value of the average of the
  // resource metric across all relevant pods, as a raw value (instead of as

// IntOrString is a type that can hold an int32 or a string.  When used in
// JSON or YAML marshalling and unmarshalling, it produces or consumes the
// inner type.  This allows you to have, for example, a JSON field that can
// accept a name or number.
// TODO: Rename to Int32OrString
//
// +protobuf=true
// +protobuf.options.(gogoproto.goproto_stringer)=false
// +k8s:openapi-gen=true
message IntOrString {
  optional int64 type = 1;

  // averageValue is the target value of the average of the
  // metric across all relevant pods (as a quantity)
  // +optional
  optional k8s.io.apimachinery.pkg.api.resource.Quantity averageValue = 3;

  // averageUtilization is the target value of the average of the
  // resource metric across all relevant pods, represented as a percentage of
  // the requested value of the resource for the pods.