message CertificateSigningRequestSpec {
  // Base64-encoded PKCS#10 CSR data
  // +listType=atomic
  optional bytes request = 1;

  // Requested signer for the request. It is a qualified name in the form:
  // `scope-hostname.io/name`.
  // If empty, it will be defaulted:
  //  1. If it's a kubelet client certificate, it is assigned
  //     "kubernetes.io/kube-apiserver-client-kubelet".

  // immutable after creation. The following address types are currently
  // supported:
  // * IPv4: Represents an IPv4 Address.
  // * IPv6: Represents an IPv6 Address.
  // * FQDN: Represents a Fully Qualified Domain Name.
  optional string addressType = 4;

  // endpoints is a list of unique endpoints in this slice. Each slice may
  // include a maximum of 1000 endpoints.
  // +listType=atomic

  // Specifies the hostname of the Carp
  // If not specified, the carp's hostname will be set to a system-defined value.
  // +optional
  optional string hostname = 16;

  // If specified, the fully qualified Carp hostname will be "<hostname>.<subdomain>.<carp namespace>.svc.<cluster domain>".
  // If not specified, the carp will not have a domainname at all.
  // +optional
  optional string subdomain = 17;

message AuditAnnotation {
  // key specifies the audit annotation key. The audit annotation keys of
  // a ValidatingAdmissionPolicy must be unique. The key must be a qualified
  // name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length.
  //
  // The key is combined with the resource name of the
  // ValidatingAdmissionPolicy to construct an audit annotation key:

  // When serialized as JSON or YAML, the data is additionally base64-encoded.
  // +listType=atomic
  optional bytes request = 1;

  // signerName indicates the requested signer, and is a qualified name.
  //
  // List/watch requests for CertificateSigningRequests can filter on this field using a "spec.signerName=NAME" fieldSelector.
  //
  // Well-known Kubernetes signers are:

  * In practice, this largely means that references are fully qualified in the API. IP Addresses (generally) have a network associated with them, node names have a cluster associated with them, etc.

// the related backend services. Incoming requests are first evaluated for a host
// match, then routed to the backend associated with the matching IngressRuleValue.
message IngressRule {
  // host is the fully qualified domain name of a network host, as defined by RFC 3986.
  // Note the following deviations from the "host" part of the
  // URI as defined in RFC 3986:
  // 1. IPs are not allowed. Currently an IngressRuleValue can only apply to

// the related backend services. Incoming requests are first evaluated for a host
// match, then routed to the backend associated with the matching IngressRuleValue.
message IngressRule {
  // host is the fully qualified domain name of a network host, as defined by RFC 3986.
  // Note the following deviations from the "host" part of the
  // URI as defined in RFC 3986:
  // 1. IPs are not allowed. Currently an IngressRuleValue can only apply to

        ) return null
        return unaryExpression
    }

    /**
     * When resolving selector expression of a [KtDotQualifiedExpression], we instead resolve the containing qualified expression. This way
     * the corresponding FIR element is the `FirFunctionCall` or `FirPropertyAccessExpression`, etc.
     */

// the related backend services. Incoming requests are first evaluated for a host
// match, then routed to the backend associated with the matching IngressRuleValue.
message IngressRule {
  // Host is the fully qualified domain name of a network host, as defined by RFC 3986.
  // Note the following deviations from the "host" part of the
  // URI as defined in RFC 3986:
  // 1. IPs are not allowed. Currently an IngressRuleValue can only apply to