// `JobPodFailurePolicy` feature gate (disabled by default).
  // +optional
  optional PodFailurePolicy podFailurePolicy = 11;

  // Specifies the number of retries before marking this job failed.
  // Defaults to 6
  // +optional
  optional int32 backoffLimit = 7;

  // A label query over pods that should match the pod count.
  // Normally, the system sets this field for you.

...

  // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
  // +optional
  optional ResourceRequirements resources = 2;

  // volumeName is the binding reference to the PersistentVolume backing this claim.
  // +optional
  optional string volumeName = 3;

  // storageClassName is the name of the StorageClass required by the claim.

1. When `GenerateSecret` is called, the `SecretManager` is expected to return a new certificate. This can occur in a few ways.
   1. The most common method (pictured above) is to sign a new certificate by calling the configured CA. Typically, this is Istiod.
   1. If the certificate is not yet expired, the `SecretManager` also can return a cache response. In practice, this would

  // If specified, the time in seconds before the operation should be retried. Some errors may indicate
  // the client must take an alternate action - for those errors this field may indicate how long to wait
  // before taking the alternate action.
  // +optional
  optional int32 retryAfterSeconds = 5;
}

// TableOptions are used when a Table is requested by the caller.