//   to allow for explanatory text as described in section 5.2 of RFC7468.
  //
  // If more than one PEM block is present, and the definition of the requested spec.signerName
  // does not indicate otherwise, the first block is the issued certificate,
  // and subsequent blocks should be treated as intermediate certificates and presented in TLS handshakes.
  //

  // some resources may allow a client to request the generation of an appropriate name
  // automatically. Name is primarily intended for creation idempotence and configuration
  // definition.
  // Cannot be updated.
  // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
  // +optional
  optional string name = 1;

// This is one of the types able to be returned from the /api and /apis endpoint and contains an aggregated
// list of API resources (built-ins, Custom Resource Definitions, resources from aggregated servers)
// that a cluster supports.
message APIGroupDiscoveryList {
  // ResourceVersion will not be set, because this does not have a replayable ordering among multiple apiservers.

message TypeChecking {
  // The type checking warnings for each expression.
  // +optional
  // +listType=atomic
  repeated ExpressionWarning expressionWarnings = 1;
}

// ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
message ValidatingAdmissionPolicy {

  // to run this pod.  If no RuntimeClass resource matches the named class, the pod will not be run.
  // If unset or empty, the "legacy" RuntimeClass will be used, which is an implicit class with an
  // empty definition that uses the default runtime handler.
  // More info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class
  // +optional
  optional string runtimeClassName = 29;