// used to indicate that an IngressClass should be considered default. When a
// single IngressClass resource has this annotation set to true, new Ingress
// resources without a class specified will be assigned this default class.
message IngressClass {
  // Standard object's metadata.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
  // +optional

  // indicating the request was approved and should be issued by the signer.
  //
  // A "Denied" condition is added via the /approval subresource,
  // indicating the request was denied and should not be issued by the signer.
  //
  // A "Failed" condition is added via the /status subresource,
  // indicating the signer failed to issue the certificate.
  //
  // Approved and Denied conditions are mutually exclusive.

  // For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react
  // by sending a graceful termination signal to the containers in the pod. After that 30 seconds,
  // the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup,
  // remove the pod from the API. In the presence of network partitions, this object may still

  // +listType=atomic
  optional bytes request = 1;

  // Requested signer for the request. It is a qualified name in the form:
  // `scope-hostname.io/name`.
  // If empty, it will be defaulted:
  //  1. If it's a kubelet client certificate, it is assigned
  //     "kubernetes.io/kube-apiserver-client-kubelet".
  //  2. If it's a kubelet serving certificate, it is assigned
  //     "kubernetes.io/kubelet-serving".

// used to indicate that an IngressClass should be considered default. When a
// single IngressClass resource has this annotation set to true, new Ingress
// resources without a class specified will be assigned this default class.
message IngressClass {
  // Standard object's metadata.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
  // +optional

  // +optional
  optional ParamKind paramKind = 1;

  // MatchConstraints specifies what resources this policy is designed to validate.
  // The AdmissionPolicy cares about a request if it matches _all_ Constraints.
  // However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API

// It can be optionally associated with a particular assigner, in which case it
// contains one valid set of trust anchors for that signer. Signers may have
// multiple associated ClusterTrustBundles; each is an independent set of trust
// anchors for that signer. Admission control is used to enforce that only users
// with permissions on the signer can create or modify the corresponding bundle.
message ClusterTrustBundle {
  // metadata contains the object metadata.

  // If this value is nil, the default grace period will be used instead.
  // The grace period is the duration in seconds after the processes running in the carp are sent
  // a termination signal and the time when the processes are forcibly halted with a kill signal.
  // Set this value longer than the expected cleanup time for your process.
  // Defaults to 30 seconds.
  // +optional
  optional int64 terminationGracePeriodSeconds = 4;

  // reports this record in Assigned. Assigned only updates in the status after
  // the record has been checkpointed to disk. When the Kubelet is restarted,
  // it tries to make the Assigned config the Active config by loading and
  // validating the checkpointed payload identified by Assigned.
  // +optional
  optional NodeConfigSource assigned = 1;

  // At least one of ipv4 and ipv6 must be specified.
  // This field is immutable.
  // +optional
  optional string ipv6 = 4;
}

// IPAddress represents a single IP of a single IP Family. The object is designed to be used by APIs
// that operate on IP addresses. The object is used by the Service core API for allocation of IP addresses.
// An IP address can be represented in different formats, to guarantee the uniqueness of the IP,