// resulting attributes are.
//
// This is an alpha type and requires enabling the DynamicResourceAllocation
// feature gate.
message ResourceClaim {
  // Standard object metadata
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec describes the desired attributes of a resource that then needs

  // Status is filled in by the server and indicates whether the request is allowed or not
  // +optional
  optional SubjectAccessReviewStatus status = 3;
}

// NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface
message NonResourceAttributes {
  // Path is the URL path of the request
  // +optional
  optional string path = 1;

  // Verb is the standard HTTP verb

  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Status is filled in by the server with the user attributes.
  optional SelfSubjectReviewStatus status = 2;
}

// SelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.
message SelfSubjectReviewStatus {
  // User attributes of the user making this request.
  // +optional
  optional k8s.io.api.authentication.v1.UserInfo userInfo = 1;

}

// AdmissionReview describes an admission review request/response.
message AdmissionReview {
  // Request describes the attributes for the admission request.
  // +optional
  optional AdmissionRequest request = 1;

  // Response describes the attributes for the admission response.
  // +optional
  optional AdmissionResponse response = 2;

  //
  // 'object' - The object from the incoming request. The value is null for DELETE requests.
  // 'oldObject' - The existing object. The value is null for CREATE requests.
  // 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).
  // 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.

}

// AdmissionReview describes an admission review request/response.
message AdmissionReview {
  // Request describes the attributes for the admission request.
  // +optional
  optional AdmissionRequest request = 1;

  // Response describes the attributes for the admission response.
  // +optional
  optional AdmissionResponse response = 2;

  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Status is filled in by the server with the user attributes.
  optional SelfSubjectReviewStatus status = 2;
}

// SelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.
message SelfSubjectReviewStatus {
  // User attributes of the user making this request.
  // +optional
  optional k8s.io.api.authentication.v1.UserInfo userInfo = 1;
}

  // Populated by the API server on creation and immutable.
  // +listType=atomic
  // +optional
  repeated string groups = 4;

  // extra contains extra attributes of the user that created the CertificateSigningRequest.
  // Populated by the API server on creation and immutable.
  // +optional
  map<string, ExtraValue> extra = 6;
}

  // Status is filled in by the server and indicates whether the request is allowed or not
  // +optional
  optional SubjectAccessReviewStatus status = 3;
}

// NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface
message NonResourceAttributes {
  // Path is the URL path of the request
  // +optional
  optional string path = 1;

  // Verb is the standard HTTP verb

// field of a Status object defines what attributes will be set. Clients
// must ignore fields that do not match the defined type of each attribute,
// and should assume that any attribute may be empty, invalid, or under
// defined.
message StatusDetails {
  // The name attribute of the resource associated with the status StatusReason