// +listType=atomic
  optional bytes request = 1;

  // signerName indicates the requested signer, and is a qualified name.
  //
  // List/watch requests for CertificateSigningRequests can filter on this field using a "spec.signerName=NAME" fieldSelector.
  //
  // Well-known Kubernetes signers are:

  // required.
  // +listType=atomic
  // +optional
  repeated AuditAnnotation auditAnnotations = 5;

  // MatchConditions is a list of conditions that must be met for a request to be validated.
  // Match conditions filter requests that have already been matched by the rules,
  // namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
  // There are a maximum of 64 match conditions allowed.
  //

// They are consumed by the kube-scheduler when a CSI driver opts into
// capacity-aware scheduling with CSIDriverSpec.StorageCapacity. The scheduler
// compares the MaximumVolumeSize against the requested size of pending volumes
// to filter out unsuitable nodes. If MaximumVolumeSize is unset, it falls back
// to a comparison against the less precise Capacity. If that is also unset,
// the scheduler assumes that capacity is insufficient and tries some other
// node.

  //
  // Defaults to "Never".
  // +optional
  optional string reinvocationPolicy = 10;

  // MatchConditions is a list of conditions that must be met for a request to be sent to this
  // webhook. Match conditions filter requests that have already been matched by the rules,
  // namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
  // There are a maximum of 64 match conditions allowed.
  //

  //
  // Defaults to "Never".
  // +optional
  optional string reinvocationPolicy = 10;

  // MatchConditions is a list of conditions that must be met for a request to be sent to this
  // webhook. Match conditions filter requests that have already been matched by the rules,
  // namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
  // There are a maximum of 64 match conditions allowed.
  //

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Status is filled in by the server with the user attributes.
  optional SelfSubjectReviewStatus status = 2;
}

// SelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.
message SelfSubjectReviewStatus {
  // User attributes of the user making this request.
  // +optional

  // you made the request against.  If empty, it is defaulted.
  optional SubjectAccessReviewSpec spec = 2;

  // Status is filled in by the server and indicates whether the request is allowed or not
  // +optional
  optional SubjectAccessReviewStatus status = 3;
}

// capacity-aware scheduling with CSIDriverSpec.StorageCapacity. The scheduler
// compares the MaximumVolumeSize against the requested size of pending volumes
// to filter out unsuitable nodes. If MaximumVolumeSize is unset, it falls back
// to a comparison against the less precise Capacity. If that is also unset,
// the scheduler assumes that capacity is insufficient and tries some other
// node.

  //
  // Users of ClusterTrustBundles, including Kubelet, are free to reorder and
  // deduplicate certificate blocks in this file according to their own logic,
  // as well as to drop PEM block headers and inter-block data.
  optional string trustBundle = 2;

// capacity-aware scheduling with CSIDriverSpec.StorageCapacity. The scheduler
// compares the MaximumVolumeSize against the requested size of pending volumes
// to filter out unsuitable nodes. If MaximumVolumeSize is unset, it falls back
// to a comparison against the less precise Capacity. If that is also unset,
// the scheduler assumes that capacity is insufficient and tries some other
// node.