// feature gate.
message PodSchedulingContext {
  // Standard object metadata
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec describes where resources for the Pod are needed.
  optional PodSchedulingContextSpec spec = 2;

  // Status describes where resources for the Pod can be allocated.
  // +optional
  optional PodSchedulingContextStatus status = 3;
}

  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
  // +optional
  optional CronJobSpec spec = 2;

  // Current status of a cron job.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
  // +optional
  optional CronJobStatus status = 3;
}

// CronJobList is a collection of cron jobs.

message StorageVersion {
  // The name is <group>.<resource>.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec is an empty spec. It is here to comply with Kubernetes API style.
  optional StorageVersionSpec spec = 2;

  // API server instances report the version they can decode and the version they
  // encode objects to when persisting objects in the backend.

    grant_type: the OAuth2 spec says it is required and MUST be the fixed string "password".
        This dependency is strict about it. If you want to be permissive, use instead the
        OAuth2PasswordRequestForm dependency class.
    username: username string. The OAuth2 spec requires the exact field name "username".
    password: password string. The OAuth2 spec requires the exact field name "password".

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec holds information about the request being evaluated.  spec.namespace must be equal to the namespace
  // you made the request against.  If empty, it is defaulted.
  optional SubjectAccessReviewSpec spec = 2;

  // Status is filled in by the server and indicates whether the request is allowed or not
  // +optional

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // spec contains the specification of the Lease.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
  // +optional
  optional LeaseSpec spec = 2;
}

// LeaseList is a list of Lease objects.
message LeaseList {
  // Standard list metadata.

- if deployed by operator,  `kubectl patch felixconfigurations default --type='json' -p='[{"op": "add", "path": "/spec/workloadSourceSpoofing", "value": "Any"}]'`
- if deployed by manifest, add env `FELIX_WORKLOADSOURCESPOOFING` with value `Any` in `spec.template.spec.containers.env` for daemonset `calico-node`. (This will allow PODs with specified annotation to skip the rpf check. )

### GKE notes

  // one StatefulSet to another.
  // If set, replica indices will be in the range:
  //   [.spec.ordinals.start, .spec.ordinals.start + .spec.replicas).
  // If unset, defaults to 0. Replica indices will be in the range:
  //   [0, .spec.replicas).
  // +optional
  optional int32 start = 1;
}

// StatefulSetPersistentVolumeClaimRetentionPolicy describes the policy used for PVCs

  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
  // +optional
  optional CronJobSpec spec = 2;

  // Current status of a cron job.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
  // +optional
  optional CronJobStatus status = 3;
}

// CronJobList is a collection of cron jobs.

        - name: NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: INSTANCE_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: SERVICE_ACCOUNT
          valueFrom:
            fieldRef:
              fieldPath: spec.serviceAccountName
        {{- if .Values.meshConfig.defaultConfig.proxyMetadata }}