// Requests will be matched against the Host field in the following way:
  // 1. If Host is precise, the request matches this rule if the http host header is equal to Host.
  // 2. If Host is a wildcard, then the request matches this rule if the http host header
  // is to equal to the suffix (removing the first label) of the wildcard rule.
  // +optional
  optional string host = 1;

  // The field is populated by the apiserver only if the
  // StorageVersionHash feature gate is enabled.
  // This field will remain optional even if it graduates.
  // +optional
  optional string storageVersionHash = 10;
}

// APIResourceList is a list of APIResource, it is used to expose the name of the
// resources supported in a specific group and version, and if the resource
// is namespaced.
message APIResourceList {

  // SubResource is the subresource being requested, if any (for example, "status" or "scale")
  // +optional
  optional string subResource = 4;

  // RequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale).
  // If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.
  //

  // Rolling update config params. Present only if DeploymentStrategyType =
  // RollingUpdate.
  // ---
  // TODO: Update this to follow our convention for oneOf, whatever we decide it
  // to be.
  // +optional
  optional RollingUpdateDeployment rollingUpdate = 2;
}

// ReplicaSet ensures that a specified number of pod replicas are running at any given time.
message ReplicaSet {

  // This field is set via the /status subresource. Once populated, this field is immutable.
  //
  // If the certificate signing request is denied, a condition of type "Denied" is added and this field remains empty.
  // If the signer cannot issue the certificate, a condition of type "Failed" is added and this field remains empty.
  //
  // Validation requirements:

// SelfSubjectReview contains the user information that the kube-apiserver has about the user making this request.
// When using impersonation, users will receive the user info of the user being impersonated.  If impersonation or
// request header authentication is used, any extra keys will have their case ignored and returned as lowercase.
message SelfSubjectReview {
  // Standard object's metadata.

  // APIs may return other objects types at their discretion, such as error conditions, requests for alternate representations, or other operation specific behavior.
  // This value will be null if an APIService reports subresources but supports no operations on the parent resource
  optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind responseKind = 2;

  // SubResource is the subresource being requested, if any (for example, "status" or "scale")
  // +optional
  optional string subResource = 4;

  // RequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale).
  // If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.
  //

message SubjectAccessReviewStatus {
  // Allowed is required. True if the action would be allowed, false otherwise.
  optional bool allowed = 1;

  // Denied is optional. True if the action would be denied, otherwise
  // false. If both allowed is false and denied is false, then the
  // authorizer has no opinion on whether to authorize the action. Denied
  // may not be true if Allowed is true.
  // +optional
  optional bool denied = 4;

  optional bytes request = 1;

  // Requested signer for the request. It is a qualified name in the form:
  // `scope-hostname.io/name`.
  // If empty, it will be defaulted:
  //  1. If it's a kubelet client certificate, it is assigned
  //     "kubernetes.io/kube-apiserver-client-kubelet".
  //  2. If it's a kubelet serving certificate, it is assigned
  //     "kubernetes.io/kubelet-serving".