optional int32 expirationSeconds = 8;

  // allowedUsages specifies a set of usage contexts the key will be
  // valid for.
  // See:
  // 	https://tools.ietf.org/html/rfc5280#section-4.2.1.3
  // 	https://tools.ietf.org/html/rfc5280#section-4.2.1.12
  //
  // Valid values are:
  //  "signing",
  //  "digital signature",
  //  "content commitment",
  //  "key encipherment",
  //  "key agreement",

  optional string reportingInstance = 5;

  // action is what action was taken/failed regarding to the regarding object. It is machine-readable.
  // This field cannot be empty for new Events and it can have at most 128 characters.
  optional string action = 6;

  // reason is why the action was taken. It is human-readable.

  // NodeSelector is a selector which must be true for the carp to fit on a node.
  // Selector which must match a node's labels for the carp to be scheduled on that node.
  // More info: http://kubernetes.io/docs/user-guide/node-selection/README
  // +optional
  map<string, string> nodeSelector = 7;

  // ServiceAccountName is the name of the ServiceAccount to use to run this carp.