//  "server auth", "client auth",
  //  "code signing", "email protection", "s/mime",
  //  "ipsec end system", "ipsec tunnel", "ipsec user",
  //  "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"
  // +listType=atomic
  repeated string usages = 5;

  // username contains the name of the user that created the CertificateSigningRequest.
  // Populated by the API server on creation and immutable.

  // Accessible property names are escaped according to the following rules when accessed in the expression:
  // - '__' escapes to '__underscores__'
  // - '.' escapes to '__dot__'
  // - '-' escapes to '__dash__'
  // - '/' escapes to '__slash__'
  // - Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:

// A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator
// that relates the scope name and values.
message ScopedResourceSelectorRequirement {
  // The name of the scope that the selector applies to.
  optional string scopeName = 1;

  // Represents a scope's relationship to a set of values.
  // Valid operators are In, NotIn, Exists, DoesNotExist.
  optional string operator = 2;