// You must not list a capability in both allowedCapabilities and requiredDropCapabilities.
  // +optional
  repeated string allowedCapabilities = 4;

  // volumes is an allowlist of volume plugins. Empty indicates that
  // no volumes may be used. To allow all volumes you may use '*'.
  // +optional
  repeated string volumes = 5;

// 		runtime.TypeMeta `json:",inline"`
// 		MyPlugin runtime.RawExtension `json:"myPlugin"`
// 	}
//
// 	type PluginA struct {
// 		AOption string `json:"aOption"`
// 	}
//
// // On the wire, the JSON will look something like this:
//
// 	{
// 		"kind":"MyAPIObject",
// 		"apiVersion":"v1",
// 		"myPlugin": {
// 			"kind":"PluginA",
// 			"aOption":"foo",
// 		},
// 	}
//

}

// TokenReview attempts to authenticate a token to a known user.
// Note: TokenReview requests may be cached by the webhook token authenticator
// plugin in the kube-apiserver.
message TokenReview {
  // Standard object's metadata.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
  // +optional

// they use the node-driver-registrar sidecar container, the kubelet will
// automatically populate the CSINode object for the CSI driver as part of
// kubelet plugin registration.
// CSINode has the same name as a node. If the object is missing, it means either
// there are no CSI Drivers available on the node, or the Kubelet version is low
// enough that it doesn't create this object.

  // If null (or empty), it is assumed this allocation will be processed by a
  // single kubelet plugin with no ResourceHandle data attached. The name of
  // the kubelet plugin invoked will match the DriverName set in the
  // ResourceClaimStatus this AllocationResult is embedded in.
  //
  // +listType=atomic
  // +optional
  repeated ResourceHandle resourceHandles = 1;

  optional k8s.io.api.authentication.v1.UserInfo userInfo = 1;
}

// TokenReview attempts to authenticate a token to a known user.
// Note: TokenReview requests may be cached by the webhook token authenticator
// plugin in the kube-apiserver.
message TokenReview {
  // Standard object's metadata.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
  // +optional

  // secretRef is Optional: SecretRef is reference to the secret object containing
  // sensitive information to pass to the plugin scripts. This may be
  // empty if no secret object is specified. If the secret object
  // contains more than one secret, all secrets are passed to the plugin
  // scripts.
  // +optional
  optional SecretReference secretRef = 3;

  // However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
  // from putting the cluster in a state which cannot be recovered from without completely
  // disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called
  // on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.

  // However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
  // from putting the cluster in a state which cannot be recovered from without completely
  // disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called
  // on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.
  repeated RuleWithOperations rules = 3;

// they use the node-driver-registrar sidecar container, the kubelet will
// automatically populate the CSINode object for the CSI driver as part of
// kubelet plugin registration.
// CSINode has the same name as a node. If the object is missing, it means either
// there are no CSI Drivers available on the node, or the Kubelet version is low
// enough that it doesn't create this object.