//   2. If ALL matchConditions evaluate to TRUE, the webhook is called.
  //   3. If any matchCondition evaluates to an error (but none are FALSE):
  //      - If failurePolicy=Fail, reject the request
  //      - If failurePolicy=Ignore, the error is ignored and the webhook is skipped
  //
  // This is an alpha feature and managed by the AdmissionWebhookMatchConditions feature gate.
  //

// It adds who information via Subjects and namespace information by which namespace it exists in.  RoleBindings in a given
// namespace only have effect in that namespace.
message RoleBinding {
  // Standard object's metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
  // with respect to the current state of the instance.
  // +optional
  // +kubebuilder:validation:Minimum=0
  optional int64 observedGeneration = 3;

  optional int32 readyReplicas = 4;

  // The number of available replicas (ready for at least minReadySeconds) for this replica set.
  // +optional
  optional int32 availableReplicas = 5;

  // ObservedGeneration reflects the generation of the most recently observed ReplicaSet.
  // +optional
  optional int64 observedGeneration = 3;

  // Represents the latest available observations of a replica set's current state.
  // +optional

  optional int32 readyReplicas = 4;

  // The number of available replicas (ready for at least minReadySeconds) for this replica set.
  // +optional
  optional int32 availableReplicas = 5;

  // ObservedGeneration reflects the generation of the most recently observed ReplicaSet.
  // +optional
  optional int64 observedGeneration = 3;

  // Represents the latest available observations of a replica set's current state.
  // +optional

  //     "kubernetes.io/kubelet-serving".
  //  3. Otherwise, it is assigned "kubernetes.io/legacy-unknown".
  // Distribution of trust for signers happens out of band.
  // You can select on this field using `spec.signerName`.
  // +optional
  optional string signerName = 7;

  // expirationSeconds is the requested duration of validity of the issued

  optional int32 readyReplicas = 4;

  // The number of available replicas (ready for at least minReadySeconds) for this replica set.
  // +optional
  optional int32 availableReplicas = 5;

  // ObservedGeneration reflects the generation of the most recently observed ReplicaSet.
  // +optional
  optional int64 observedGeneration = 3;

  // Represents the latest available observations of a replica set's current state.
  // +optional

  //
  // +optional
  // +listType=atomic
  repeated TokenRequest tokenRequests = 6;

  // requiresRepublish indicates the CSI driver wants `NodePublishVolume`
  // being periodically called to reflect any possible change in the mounted
  // volume. This field defaults to false.
  //
  // Note: After a successful initial NodePublishVolume call, subsequent calls

  //   2. If ALL matchConditions evaluate to TRUE, the webhook is called.
  //   3. If any matchCondition evaluates to an error (but none are FALSE):
  //      - If failurePolicy=Fail, reject the request
  //      - If failurePolicy=Ignore, the error is ignored and the webhook is skipped
  //
  // This is an alpha feature and managed by the AdmissionWebhookMatchConditions feature gate.
  //

  // Label query over pods whose evictions are managed by the disruption
  // budget.
  // A null selector will match no pods, while an empty ({}) selector will select
  // all pods within the namespace.
  // +patchStrategy=replace
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;