optional string kind = 1;

  // name is the name of the referent; More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
  optional string name = 2;

  // apiVersion is the API version of the referent
  // +optional
  optional string apiVersion = 3;
}

  optional string kind = 1;

  // name is the name of the referent; More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
  optional string name = 2;

  // apiVersion is the API version of the referent
  // +optional
  optional string apiVersion = 3;
}

  // name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length.
  //
  // The key is combined with the resource name of the
  // ValidatingAdmissionPolicy to construct an audit annotation key:
  // "{ValidatingAdmissionPolicy name}/{key}".
  //
  // If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy

message ServiceAccountSubject {
  // `namespace` is the namespace of matching ServiceAccount objects.
  // Required.
  optional string namespace = 1;

  // `name` is the name of matching ServiceAccount objects, or "*" to match regardless of name.
  // Required.
  optional string name = 2;
}

// Subject matches the originator of a request, as identified by the request authentication system. There are three

message ServiceAccountSubject {
  // `namespace` is the namespace of matching ServiceAccount objects.
  // Required.
  optional string namespace = 1;

  // `name` is the name of matching ServiceAccount objects, or "*" to match regardless of name.
  // Required.
  optional string name = 2;
}

// Subject matches the originator of a request, as identified by the request authentication system. There are three

  // this list must have at least one matching (by name) volumeMount in one
  // container in the template. A claim in this list takes precedence over
  // any volumes in the template, with the same name.
  // TODO: Define the behavior if a claim already exists with the same name.
  // +optional
  repeated k8s.io.api.core.v1.PersistentVolumeClaim volumeClaimTemplates = 4;

  // serviceName is the name of the service that governs this StatefulSet.

// AllowedCSIDriver represents a single inline CSI Driver that is allowed to be used.
message AllowedCSIDriver {
  // Name is the registered name of the CSI driver
  optional string name = 1;
}

// AllowedFlexVolume represents a single Flexvolume that is allowed to be used.
message AllowedFlexVolume {
  // driver is the name of the Flexvolume driver.
  optional string driver = 1;
}

// IntOrString is a type that can hold an int32 or a string.  When used in
// JSON or YAML marshalling and unmarshalling, it produces or consumes the
// inner type.  This allows you to have, for example, a JSON field that can
// accept a name or number.
// TODO: Rename to Int32OrString
//
// +protobuf=true
// +protobuf.options.(gogoproto.goproto_stringer)=false
// +k8s:openapi-gen=true
message IntOrString {
  optional int64 type = 1;

  // series is data about the Event series this event represents or nil if it's a singleton Event.
  // +optional
  optional EventSeries series = 3;

  // reportingController is the name of the controller that emitted this Event, e.g. `kubernetes.io/kubelet`.
  // This field cannot be empty for new Events.
  // +optional
  optional string reportingController = 4;

message APIGroupDiscovery {
  // Standard object's metadata.
  // The only field completed will be name. For instance, resourceVersion will be empty.
  // name is the name of the API group whose discovery information is presented here.
  // name is allowed to be "" to represent the legacy, ungroupified resources.