// this list must have at least one matching (by name) volumeMount in one
  // container in the template. A claim in this list takes precedence over
  // any volumes in the template, with the same name.
  // TODO: Define the behavior if a claim already exists with the same name.
  // +optional
  repeated k8s.io.api.core.v1.PersistentVolumeClaim volumeClaimTemplates = 4;

  // this list must have at least one matching (by name) volumeMount in one
  // container in the template. A claim in this list takes precedence over
  // any volumes in the template, with the same name.
  // TODO: Define the behavior if a claim already exists with the same name.
  // +optional
  repeated k8s.io.api.core.v1.PersistentVolumeClaim volumeClaimTemplates = 4;

  // If set, indicates that the range of ports from port to endPort, inclusive,
  // should be allowed by the policy. This field cannot be defined if the port field
  // is not defined or if the port field is defined as a named (string) port.
  // The endPort must be equal or greater than port.
  // +optional
  optional int32 endPort = 3;
}

  //
  // More details are available at https://k8s.io/docs/reference/access-authn-authz/certificate-signing-requests/#kubernetes-signers
  //
  // Custom signerNames can also be specified. The signer defines:
  //  1. Trust distribution: how trust (CA bundles) are distributed.
  //  2. Permitted subjects: and behavior when a disallowed subject is requested.

  // Status is filled in by the server and indicates the set of actions a user can perform.
  // +optional
  optional SubjectRulesReviewStatus status = 3;
}

// SelfSubjectRulesReviewSpec defines the specification for SelfSubjectRulesReview.
message SelfSubjectRulesReviewSpec {
  // Namespace to evaluate rules for. Required.
  optional string namespace = 1;
}

message AllowedFlexVolume {
  // driver is the name of the Flexvolume driver.
  optional string driver = 1;
}

// AllowedHostPath defines the host volume conditions that will be enabled by a policy
// for pods to use. It requires the path prefix to be defined.
message AllowedHostPath {
  // pathPrefix is the path prefix that the host volume must match.
  // It does not support `*`.

  // A binding is invalid if spec.paramRef.name refers to a non-existent resource.
  //
  // failurePolicy does not define how validations that evaluate to false are handled.
  //
  // When failurePolicy is set to Fail, ValidatingAdmissionPolicyBinding validationActions
  // define how failures are enforced.
  //
  // Allowed values are Ignore or Fail. Defaults to Fail.
  // +optional

// match, then routed to the backend associated with the matching IngressRuleValue.
message IngressRule {
  // host is the fully qualified domain name of a network host, as defined by RFC 3986.
  // Note the following deviations from the "host" part of the
  // URI as defined in RFC 3986:
  // 1. IPs are not allowed. Currently an IngressRuleValue can only apply to
  //    the IP in the Spec of the parent Ingress.

  repeated k8s.io.api.admissionregistration.v1.RuleWithOperations rules = 3;

  // FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
  // allowed values are Ignore or Fail. Defaults to Ignore.
  // +optional
  optional string failurePolicy = 4;

  // matchPolicy defines how the "rules" list is used to match incoming requests.
  // Allowed values are "Exact" or "Equivalent".
  //

  // PodSchedulingSpec.PotentialNodes. This may get increased in the
  // future, but not reduced.
  //
  // +listType=set
  // +optional
  repeated string unsuitableNodes = 2;
}

// ResourceClaimSpec defines how a resource is to be allocated.
message ResourceClaimSpec {
  // ResourceClassName references the driver and additional parameters
  // via the name of a ResourceClass that was created as part of the