// The data must consist only of PEM certificate blocks that parse as valid
  // X.509 certificates.  Each certificate must include a basic constraints
  // extension with the CA bit set.  The API server will reject objects that
  // contain duplicate certificates, or that use PEM block headers.
  //
  // Users of ClusterTrustBundles, including Kubelet, are free to reorder and
  // deduplicate certificate blocks in this file according to their own logic,

  // This field is immutable.
  // +required
  optional int32 perNodeHostBits = 2;

  // ipv4 defines an IPv4 IP block in CIDR notation(e.g. "10.0.0.0/8").
  // At least one of ipv4 and ipv6 must be specified.
  // This field is immutable.
  // +optional
  optional string ipv4 = 3;

  // ipv6 defines an IPv6 IP block in CIDR notation(e.g. "2001:db8::/64").
  // At least one of ipv4 and ipv6 must be specified.
  // This field is immutable.

// until the action is complete, unless the container process fails, in which case the handler is aborted.
message Lifecycle {
  // PostStart is called immediately after a container is created. If the handler fails,
  // the container is terminated and restarted according to its restart policy.
  // Other management of the container blocks until the hook completes.

  // driver can be mounted separately with different `-o context` options. This is
  // typical for storage backends that provide volumes as filesystems on block
  // devices or as independent shared volumes.
  // Kubernetes will call NodeStage / NodePublish with "-o context=xyz" mount
  // option when mounting a ReadWriteOncePod volume used in Pod that has

  //
  // Validation requirements:
  //  1. certificate must contain one or more PEM blocks.
  //  2. All PEM blocks must have the "CERTIFICATE" label, contain no headers, and the encoded data
  //   must be a BER-encoded ASN.1 Certificate structure as described in section 4 of RFC5280.
  //  3. Non-PEM content may appear before or after the "CERTIFICATE" PEM blocks and is unvalidated,

// that should not be included within this rule.
message IPBlock {
  // CIDR is a string representing the IP Block
  // Valid examples are "192.168.1.0/24" or "2001:db8::/64"
  optional string cidr = 1;

  // Except is a slice of CIDRs that should not be included within an IP Block
  // Valid examples are "192.168.1.0/24" or "2001:db8::/64"
  // Except values will be rejected if they are outside the CIDR range

  // from resource lists, and not reachable by name) after the time in this field, once the
  // finalizers list is empty. As long as the finalizers list contains items, deletion is blocked.
  // Once the deletionTimestamp is set, this value may not be unset or be set further into the
  // future, although it may be shortened or the resource may be deleted prior to this time.

  // driver can be mounted separately with different `-o context` options. This is
  // typical for storage backends that provide volumes as filesystems on block
  // devices or as independent shared volumes.
  // Kubernetes will call NodeStage / NodePublish with "-o context=xyz" mount
  // option when mounting a ReadWriteOncePod volume used in Pod that has