// that should be running the daemon pod (i.e. status.desiredNumberScheduled)
  // can have their a new pod created before the old pod is marked as deleted.
  // The update starts by launching new pods on 30% of nodes. Once an updated
  // pod is available (Ready for at least minReadySeconds) the old DaemonSet pod
  // on that node is marked deleted. If the old pod becomes unavailable for any

  // +listType=atomic
  repeated string usages = 5;

  // username contains the name of the user that created the CertificateSigningRequest.
  // Populated by the API server on creation and immutable.
  // +optional
  optional string username = 2;

  // uid contains the uid of the user that created the CertificateSigningRequest.

// JSON stored in RawExtension, turning it into the correct object type, and storing it
// in the Object. (TODO: In the case where the object is of an unknown type, a
// runtime.Unknown object will be created and stored.)
//
// +k8s:deepcopy-gen=true
// +protobuf=true
// +k8s:openapi-gen=true
message RawExtension {
  // Raw is the underlying serialization of this object.
  //

}

// StatefulSetPersistentVolumeClaimRetentionPolicy describes the policy used for PVCs
// created from the StatefulSet VolumeClaimTemplates.
message StatefulSetPersistentVolumeClaimRetentionPolicy {
  // whenDeleted specifies what happens to PVCs created from StatefulSet
  // VolumeClaimTemplates when the StatefulSet is deleted. The default policy
  // of `Retain` causes PVCs to not be affected by StatefulSet deletion. The

}

// ImageReviewSpec is a description of the pod creation request.
message ImageReviewSpec {
  // Containers is a list of a subset of the information in each container of the Pod being created.
  // +optional
  repeated ImageReviewContainerSpec containers = 1;

  // Annotations is a list of key-value pairs extracted from the Pod's annotations.
  // It only includes keys which match the pattern `*.image-policy.k8s.io/*`.

          },
          "expr": "avg(envoy_wasm_envoy_wasm_runtime_null_created)",
          "interval": "",
          "legendFormat": "native",
          "refId": "A"
        },
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "expr": "avg(envoy_wasm_envoy_wasm_runtime_v8_created)",
          "interval": "",
          "legendFormat": "v8",

	// namespaces are in use and therefore we can no longer discern if that is the
	// case from within SPIRE agent container (since the container itself is
	// namespaced). As such, the regex has been relaxed to simply find the pod UID
	// followed by the container ID with allowances for arbitrary punctuation, and
	// container runtime prefixes, etc.
	regexp.MustCompile(`` +

			watchServerReady.Store(true)
		}

		installer := install.NewInstaller(&cfg.InstallConfig, installDaemonReady)

		repair.StartRepair(ctx, cfg.RepairConfig)

		log.Info("Installer created, watching node CNI dir")
		// installer.Run() will block indefinitely, and attempt to permanently "keep"
		// the CNI binary installed.
		if err = installer.Run(ctx); err != nil {

  // allowed, and need not be included in the allowedCapabilities list.
  // +optional
  repeated string defaultAddCapabilities = 2;

  // requiredDropCapabilities are the capabilities that will be dropped from the container.  These
  // are required to be dropped and cannot be added.
  // +optional
  repeated string requiredDropCapabilities = 3;

		},
	}
	tokenReq, err := kubeClient.Kube().CoreV1().ServiceAccounts(wg.Namespace).CreateToken(context.Background(), serviceAccount, token, metav1.CreateOptions{})
	// errors if the token could not be created with the given service account in the given namespace
	if err != nil {
		return fmt.Errorf("could not create a token under service account %s in namespace %s: %v", serviceAccount, wg.Namespace, err)
	}