// If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails.
  // If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced
  // as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string

  // DisruptionAllowed condition. The following are known values for the reason field
  // (additional reasons could be added in the future):
  // - SyncFailed: The controller encountered an error and wasn't able to compute
  //               the number of allowed disruptions. Therefore no disruptions are
  //               allowed and the status of the condition will be False.

  // empty there is no information available.
  // +optional
  optional string reason = 1;

  // A human-readable description of the cause of the error.  This field may be
  // presented as-is to a reader.
  // +optional
  optional string message = 2;

  // The field of the resource that has caused this error, as named by its JSON

  optional string patchType = 5;

  // AuditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted).
  // MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with
  // admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by

}

// IngressPortStatus represents the error condition of a service port
message IngressPortStatus {
  // Port is the port number of the ingress port.
  optional int32 port = 1;

  // Protocol is the protocol of the ingress port.
  // The supported values are: "TCP", "UDP", "SCTP"
  optional string protocol = 2;

  // Error is to record the problem with the service port

  // responseKind describes the group, version, and kind of the serialization schema for the object type this endpoint typically returns.
  // APIs may return other objects types at their discretion, such as error conditions, requests for alternate representations, or other operation specific behavior.
  // This value will be null if an APIService reports subresources but supports no operations on the parent resource

  // +optional
  repeated Subject subjects = 2;

  // RoleRef can only reference a ClusterRole in the global namespace.
  // If the RoleRef cannot be resolved, the Authorizer must return an error.
  optional RoleRef roleRef = 3;
}

// ClusterRoleBindingList is a collection of ClusterRoleBindings.
// Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBindings, and will no longer be served in v1.22.

  // +optional
  repeated Subject subjects = 2;

  // RoleRef can only reference a ClusterRole in the global namespace.
  // If the RoleRef cannot be resolved, the Authorizer must return an error.
  optional RoleRef roleRef = 3;
}

// ClusterRoleBindingList is a collection of ClusterRoleBindings.

  // valid against the audience of the Kubernetes API server.
  // +optional
  repeated string audiences = 4;

  // Error indicates that the token couldn't be checked
  // +optional
  optional string error = 3;
}

// UserInfo holds the information about the user needed to implement the
// user.Info interface.
message UserInfo {

  // +optional
  optional VolumeError detachError = 4;
}

// VolumeError captures an error encountered during a volume operation.
message VolumeError {
  // time represents the time the error was encountered.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time time = 1;

  // message represents the error encountered during Attach or Detach operation.