// The singular form of a resource should always be an optional element - when in doubt use the canonical resource name.
  optional string singularResource = 4;

  // verbs is a list of supported API operation types (this includes
  // but is not limited to get, list, watch, create, update, patch,
  // delete, deletecollection, and proxy).
  // +listType=set
  repeated string verbs = 5;

  // the backend (e.g., etcd).
  optional string encodingVersion = 2;

  // The API server can decode objects encoded in these versions.
  // The encodingVersion must be included in the decodableVersions.
  // +listType=set
  repeated string decodableVersions = 3;
}

// Storage version of a specific resource.
message StorageVersion {
  // The name is <group>.<resource>.

  // endpoint. These key/value pairs must conform with the label format.
  // https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
  // Topology may include a maximum of 16 key/value pairs. This includes, but
  // is not limited to the following well known keys:
  // * kubernetes.io/hostname: the value indicates the hostname of the node
  //   where the endpoint is located. This should match the corresponding

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 2;

  // items contains each of the included items.
  repeated k8s.io.apimachinery.pkg.apis.meta.v1.PartialObjectMetadata items = 1;

  // Derived information about the request.
  // +optional
  optional CertificateSigningRequestStatus status = 3;
}

message CertificateSigningRequestCondition {
  // type of the condition. Known conditions include "Approved", "Denied", and "Failed".
  optional string type = 1;

  // Status of the condition, one of True, False, Unknown.
  // Approved, Denied, and Failed conditions may not be "False" or "Unknown".

  // +optional
  repeated ImageReviewContainerSpec containers = 1;

  // Annotations is a list of key-value pairs extracted from the Pod's annotations.
  // It only includes keys which match the pattern `*.image-policy.k8s.io/*`.
  // It is up to each webhook backend to determine how to interpret these annotations, if at all.
  // +optional
  map<string, string> annotations = 2;

  // named with the signer name as a prefix (translating slashes to colons).
  // For example, for the signer name `example.com/foo`, valid
  // ClusterTrustBundle object names include `example.com:foo:abc` and
  // `example.com:foo:v1`.
  //
  // If signerName is empty, then the ClusterTrustBundle object's name must
  // not have such a prefix.
  //

  // * IPv6: Represents an IPv6 Address.
  // * FQDN: Represents a Fully Qualified Domain Name.
  optional string addressType = 4;

  // endpoints is a list of unique endpoints in this slice. Each slice may
  // include a maximum of 1000 endpoints.
  // +listType=atomic
  repeated Endpoint endpoints = 2;

  // ports specifies the list of network ports exposed by each endpoint in