// "{ValidatingAdmissionPolicy name}/{key}".
  //
  // If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy
  // and the same audit annotation key, the annotation key will be identical.
  // In this case, the first annotation written with the key will be included
  // in the audit event and all subsequent annotations with the same key
  // will be discarded.
  //
  // Required.
  optional string key = 1;

  // this list must have at least one matching (by name) volumeMount in one
  // container in the template. A claim in this list takes precedence over
  // any volumes in the template, with the same name.
  // TODO: Define the behavior if a claim already exists with the same name.
  // +optional
  repeated k8s.io.api.core.v1.PersistentVolumeClaim volumeClaimTemplates = 4;

  // serviceName is the name of the service that governs this StatefulSet.

  // +optional
  optional string rule = 1;

  // ranges are the allowed ranges of fs groups.  If you would like to force a single
  // fs group then supply a single range with the same start and end. Required for MustRunAs.
  // +optional
  repeated IDRange ranges = 2;
}

// HostPortRange defines a range of host ports that will be enabled by a policy

  optional int32 replicas = 1;

  // selector is the label query over pods that should match the replicas count. This is same
  // as the label selector but in the string format to avoid introspection
  // by clients. The string will be in the same format as the query-param syntax.
  // More info about label selectors: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
  // +optional

  // this list must have at least one matching (by name) volumeMount in one
  // container in the template. A claim in this list takes precedence over
  // any volumes in the template, with the same name.
  // TODO: Define the behavior if a claim already exists with the same name.
  // +optional
  repeated k8s.io.api.core.v1.PersistentVolumeClaim volumeClaimTemplates = 4;

  // serviceName is the name of the service that governs this StatefulSet.

  // implementation will use to handle pods of this class. The possible values
  // are specific to the node & CRI configuration.  It is assumed that all
  // handlers are available on every node, and handlers of the same name are
  // equivalent on every node.
  // For example, a handler called "runc" might specify that the runc OCI
  // runtime (using native Linux containers) will be used to run the containers
  // in a pod.

  // +optional
  optional string username = 1;

  // A unique value that identifies this user across time. If this user is
  // deleted and another user by the same name is added, they will have
  // different UIDs.
  // +optional
  optional string uid = 2;

  // The names of groups this user is a part of.
  // +optional
  repeated string groups = 3;

  // +optional
  optional ResourceClaimStatus status = 3;
}

// ResourceClaimConsumerReference contains enough information to let you
// locate the consumer of a ResourceClaim. The user must be a resource in the same
// namespace as the ResourceClaim.
message ResourceClaimConsumerReference {
  // APIGroup is the group for the resource being referenced. It is
  // empty for the core API. This matches the group in the APIVersion

message IngressClassSpec {
  // controller refers to the name of the controller that should handle this
  // class. This allows for different "flavors" that are controlled by the
  // same controller. For example, you may have different parameters for the
  // same implementing controller. This should be specified as a
  // domain-prefixed path no more than 250 characters in length, e.g.
  // "acme.io/ingress-controller". This field is immutable.

  //
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector nodeTopology = 2;

  // storageClassName represents the name of the StorageClass that the reported capacity applies to.
  // It must meet the same requirements as the name of a StorageClass
  // object (non-empty, DNS subdomain). If that object no longer exists,
  // the CSIStorageCapacity object is obsolete and should be removed by its
  // creator.