// If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails.
  // If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced
  // as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string

  // DisruptionAllowed condition. The following are known values for the reason field
  // (additional reasons could be added in the future):
  // - SyncFailed: The controller encountered an error and wasn't able to compute
  //               the number of allowed disruptions. Therefore no disruptions are
  //               allowed and the status of the condition will be False.

  // valid against the audience of the Kubernetes API server.
  // +optional
  repeated string audiences = 4;

  // Error indicates that the token couldn't be checked
  // +optional
  optional string error = 3;
}

// UserInfo holds the information about the user needed to implement the
// user.Info interface.
message UserInfo {

  // Reason is optional.  It indicates why a request was allowed or denied.
  // +optional
  optional string reason = 2;

  // EvaluationError is an indication that some error occurred during the authorization check.
  // It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
  // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.

  optional string patchType = 5;

  // AuditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted).
  // MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with
  // admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by

  // +optional
  optional VolumeError detachError = 4;
}

// VolumeError captures an error encountered during a volume operation.
message VolumeError {
  // time represents the time the error was encountered.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time time = 1;

  // message represents the error encountered during Attach or Detach operation.

  // +optional
  repeated Subject subjects = 2;

  // RoleRef can only reference a ClusterRole in the global namespace.
  // If the RoleRef cannot be resolved, the Authorizer must return an error.
  optional RoleRef roleRef = 3;
}

// ClusterRoleBindingList is a collection of ClusterRoleBindings
message ClusterRoleBindingList {
  // Standard object's metadata.
  // +optional

}

// IngressPortStatus represents the error condition of a service port
message IngressPortStatus {
  // port is the port number of the ingress port.
  optional int32 port = 1;

  // protocol is the protocol of the ingress port.
  // The supported values are: "TCP", "UDP", "SCTP"
  optional string protocol = 2;

  // error is to record the problem with the service port

  // Reason is optional.  It indicates why a request was allowed or denied.
  // +optional
  optional string reason = 2;

  // EvaluationError is an indication that some error occurred during the authorization check.
  // It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
  // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.

  //   2. If ALL matchConditions evaluate to TRUE, the webhook is called.
  //   3. If any matchCondition evaluates to an error (but none are FALSE):
  //      - If failurePolicy=Fail, reject the request
  //      - If failurePolicy=Ignore, the error is ignored and the webhook is skipped
  //
  // This is an alpha feature and managed by the AdmissionWebhookMatchConditions feature gate.
  //