// readOnlyRootFilesystem when set to true will force containers to run with a read only root file
  // system.  If the container specifically requests to run with a non-read only root file system
  // the PSP should deny the pod.
  // If set to false the container may run with a read only root file system if it wishes but it
  // will not be forced to.
  // +optional
  optional bool readOnlyRootFilesystem = 14;

message PolicyRulesWithSubjects {
  // subjects is the list of normal user, serviceaccount, or group that this rule cares about.
  // There must be at least one member in this slice.
  // A slice that includes both the system:authenticated and system:unauthenticated user groups matches every request.
  // +listType=atomic
  // Required.
  repeated Subject subjects = 1;

message PolicyRulesWithSubjects {
  // subjects is the list of normal user, serviceaccount, or group that this rule cares about.
  // There must be at least one member in this slice.
  // A slice that includes both the system:authenticated and system:unauthenticated user groups matches every request.
  // +listType=atomic
  // Required.
  repeated Subject subjects = 1;

// Package-wide variables from generator "generated".
option go_package = "k8s.io/api/events/v1beta1";

// Event is a report of an event somewhere in the cluster. It generally denotes some state change in the system.
// Events have a limited retention time and triggers and messages may evolve
// with time.  Event consumers should not rely on the timing of an event
// with a given Reason reflecting a consistent underlying trigger, or the

// ExternalMetricStatus indicates the current value of a global metric
// not associated with any Kubernetes object.
message ExternalMetricStatus {
  // metricName is the name of a metric used for autoscaling in
  // metric system.
  optional string metricName = 1;

  // metricSelector is used to identify a specific time series
  // within a given metric.
  // +optional

  optional ValidatingAdmissionPolicySpec spec = 2;

  // The status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy
  // behaves in the expected way.
  // Populated by the system.
  // Read-only.
  // +optional
  optional ValidatingAdmissionPolicyStatus status = 3;
}

// ValidatingAdmissionPolicyBinding binds the ValidatingAdmissionPolicy with paramerized resources.

  // The set of valid time zone names and the time zone offset is loaded from the system-wide time zone
  // database by the API server during CronJob validation and the controller manager during execution.
  // If no system-wide time zone database can be found a bundled version of the database is used instead.

  // SideEffects states whether this webhook has side effects.
  // Acceptable values are: Unknown, None, Some, NoneOnDryRun
  // Webhooks with side effects MUST implement a reconciliation system, since a request may be
  // rejected by a future step in the admission chain and the side effects therefore need to be undone.
  // Requests with the dryRun attribute will be auto-rejected if they match a webhook with

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // spec represents specification of the desired attach/detach volume behavior.
  // Populated by the Kubernetes system.
  optional VolumeAttachmentSpec spec = 2;

  // status represents status of the VolumeAttachment request.
  // Populated by the entity completing the attach or detach
  // operation, i.e. the external-attacher.

  // +optional
  optional CarpSpec spec = 2;

  // Most recently observed status of the carp.
  // This data may not be up to date.
  // Populated by the system.
  // Read-only.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
  // +optional
  optional CarpStatus status = 3;
}

message CarpCondition {