message AuditAnnotation {
  // key specifies the audit annotation key. The audit annotation keys of
  // a ValidatingAdmissionPolicy must be unique. The key must be a qualified
  // name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length.
  //
  // The key is combined with the resource name of the
  // ValidatingAdmissionPolicy to construct an audit annotation key:
  // "{ValidatingAdmissionPolicy name}/{key}".
  //

  // for a GetCapacityRequest with topology and parameters that match the
  // previous fields.
  //
  // The semantic is currently (CSI spec 1.2) defined as:
  // The available capacity, in bytes, of the storage that can be used
  // to provision volumes. If not set, that information is currently
  // unavailable.
  //
  // +optional
  optional k8s.io.apimachinery.pkg.api.resource.Quantity capacity = 4;

  // `caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
  // If unspecified, system trust roots on the apiserver are used.
  // +optional
  optional bytes caBundle = 2;

  // BinaryData can contain byte sequences that are not in the UTF-8 range.
  // The keys stored in BinaryData must not overlap with the ones in
  // the Data field, this is enforced during validation process.
  // Using this field will require 1.10+ apiserver and
  // kubelet.
  // +optional
  map<string, bytes> binaryData = 3;
}

// +protobuf=true
// +k8s:openapi-gen=true
message RawExtension {
  // Raw is the underlying serialization of this object.
  //
  // TODO: Determine how to detect ContentType and ContentEncoding of 'Raw' data.
  optional bytes raw = 1;
}

// TypeMeta is shared by all top level objects. The proper way to use it is to inline it in your type,
// like this:
//
// 	type MyAwesomeAPIObject struct {
// 	     runtime.TypeMeta    `json:",inline"`

  // request contains an x509 certificate signing request encoded in a "CERTIFICATE REQUEST" PEM block.
  // When serialized as JSON or YAML, the data is additionally base64-encoded.
  // +listType=atomic
  optional bytes request = 1;

  // signerName indicates the requested signer, and is a qualified name.
  //
  // List/watch requests for CertificateSigningRequests can filter on this field using a "spec.signerName=NAME" fieldSelector.

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Status status = 3;

  // The patch body. Currently we only support "JSONPatch" which implements RFC 6902.
  // +optional
  optional bytes patch = 4;

  // The type of Patch. Currently we only allow "JSONPatch".
  // +optional
  optional string patchType = 5;

// 	    // +patchStrategy=merge
// 	    // +listType=map
// 	    // +listMapKey=type
// 	    Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
//
// 	    // other fields
// 	}
message Condition {
  // type of condition in CamelCase or in foo.example.com/CamelCase.
  // ---

  // for a GetCapacityRequest with topology and parameters that match the
  // previous fields.
  //
  // The semantic is currently (CSI spec 1.2) defined as:
  // The available capacity, in bytes, of the storage that can be used
  // to provision volumes. If not set, that information is currently
  // unavailable.
  //
  // +optional
  optional k8s.io.apimachinery.pkg.api.resource.Quantity capacity = 4;

}

// CertificateSigningRequestSpec contains the certificate request.
message CertificateSigningRequestSpec {
  // Base64-encoded PKCS#10 CSR data
  // +listType=atomic
  optional bytes request = 1;

  // Requested signer for the request. It is a qualified name in the form:
  // `scope-hostname.io/name`.
  // If empty, it will be defaulted:
  //  1. If it's a kubelet client certificate, it is assigned