// +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec holds information about the pod being evaluated
  optional ImageReviewSpec spec = 2;

  // Status is filled in by the backend and indicates whether the pod should be allowed.
  // +optional
  optional ImageReviewStatus status = 3;
}

// ImageReviewContainerSpec is a description of a container within the pod creation request.

  // Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when
  // the rolling update starts, such that the total number of old and new pods do not exceed
  // 130% of desired pods. Once old pods have been killed,
  // new ReplicaSet can be scaled up further, ensuring that total number of pods running
  // at any time during the update is at most 130% of desired pods.
  // +optional

  // required.
  // +listType=atomic
  // +optional
  repeated AuditAnnotation auditAnnotations = 5;

  // MatchConditions is a list of conditions that must be met for a request to be validated.
  // Match conditions filter requests that have already been matched by the rules,
  // namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
  // There are a maximum of 64 match conditions allowed.
  //