// with the token identifies as. Audience-aware token authenticators will
  // verify that the token was intended for at least one of the audiences in
  // this list. If no audiences are provided, the audience will default to the
  // audience of the Kubernetes apiserver.
  // +optional
  repeated string audiences = 2;
}

// TokenReviewStatus is the result of the token authentication request.
message TokenReviewStatus {

}

// EventSeries contain information on series of events, i.e. thing that was/is happening
// continuously for some time. How often to update the EventSeries is up to the event reporters.
// The default event reporter in "k8s.io/client-go/tools/events/event_broadcaster.go" shows
// how this struct is updated on heartbeats and can guide customized reporter implementations.
message EventSeries {

  // Spec holds information about the request being evaluated.  spec.namespace must be equal to the namespace
  // you made the request against.  If empty, it is defaulted.
  optional SubjectAccessReviewSpec spec = 2;

  // Status is filled in by the server and indicates whether the request is allowed or not
  // +optional
  optional SubjectAccessReviewStatus status = 3;
}

  // field.  This field has a default value of 8.
  // +optional
  optional int32 handSize = 2;

  // `queueLengthLimit` is the maximum number of requests allowed to
  // be waiting in a given queue of this priority level at a time;
  // excess requests are rejected.  This value must be positive.  If
  // not specified, it will be defaulted to 50.
  // +optional
  optional int32 queueLengthLimit = 3;

  // field.  This field has a default value of 8.
  // +optional
  optional int32 handSize = 2;

  // `queueLengthLimit` is the maximum number of requests allowed to
  // be waiting in a given queue of this priority level at a time;
  // excess requests are rejected.  This value must be positive.  If
  // not specified, it will be defaulted to 50.
  // +optional
  optional int32 queueLengthLimit = 3;

  // * must consist of lower case alphanumeric characters or '-'.
  // * must start and end with an alphanumeric character.
  // Default is empty string.
  optional string name = 1;

  // protocol represents the IP protocol for this port.
  // Must be UDP, TCP, or SCTP.
  // Default is TCP.
  optional string protocol = 2;

  // port represents the port number of the endpoint.

  // as pods that have status.conditions item with type="Ready",status="True".
  //
  // Valid policies are IfHealthyBudget and AlwaysAllow.
  // If no policy is specified, the default behavior will be used,
  // which corresponds to the IfHealthyBudget policy.
  //
  // IfHealthyBudget policy means that running pods (status.phase="Running"),

  // Defaults to 0 (pod will be considered available as soon as it is ready)
  // +optional
  optional int32 minReadySeconds = 5;

  // revisionHistoryLimit is the number of old ReplicaSets to retain to allow rollback.
  // This is a pointer to distinguish between explicit zero and not specified.
  // Defaults to 2.
  // +optional
  optional int32 revisionHistoryLimit = 6;

  // Defaults to false.
  // +optional
  optional bool stdin = 1;

  // Stdout if true indicates that stdout is to be redirected for the attach call.
  // Defaults to true.
  // +optional
  optional bool stdout = 2;

  // Stderr if true indicates that stderr is to be redirected for the attach call.
  // Defaults to true.
  // +optional
  optional bool stderr = 3;

  // defaultAllowPrivilegeEscalation controls the default setting for whether a
  // process can gain more privileges than its parent process.
  // +optional
  optional bool defaultAllowPrivilegeEscalation = 15;

  // allowPrivilegeEscalation determines if a pod can request to allow
  // privilege escalation. If unspecified, defaults to true.
  // +optional
  optional bool allowPrivilegeEscalation = 16;