optional string kind = 2;

  // Name is the name of resource being referenced
  optional string name = 3;
}

// Subject contains a reference to the object or user identities a role binding applies to.  This can either hold a direct API object reference,
// or a value for non-objects such as user and group names.
// +structType=atomic
message Subject {

// all containers in a pod. RuntimeClasses are manually defined by a
// user or cluster provisioner, and referenced in the PodSpec. The Kubelet is
// responsible for resolving the RuntimeClassName reference before running the
// pod.  For more details, see
// https://kubernetes.io/docs/concepts/containers/runtime-class/
message RuntimeClass {

// all containers in a pod. RuntimeClasses are (currently) manually defined by a
// user or cluster provisioner, and referenced in the PodSpec. The Kubelet is
// responsible for resolving the RuntimeClassName reference before running the
// pod.  For more details, see
// https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class
message RuntimeClass {

  // 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
  //   request resource.
  // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
  //
  // Required.
  optional string expression = 2;
}

// MutatingWebhook describes an admission webhook and the resources and operations it applies to.
message MutatingWebhook {

  optional string uid = 4;

  // If true, this reference points to the managing controller.
  // +optional
  optional bool controller = 6;

  // If true, AND if the owner has the "foregroundDeletion" finalizer, then
  // the owner cannot be deleted from the key-value store until this
  // reference is removed.

  //   Requests for this signer are never auto-approved by kube-controller-manager, and can be issued by the "csrsigning" controller in kube-controller-manager.
  //
  // More details are available at https://k8s.io/docs/reference/access-authn-authz/certificate-signing-requests/#kubernetes-signers
  //
  // Custom signerNames can also be specified. The signer defines:
  //  1. Trust distribution: how trust (CA bundles) are distributed.

  // The only allowed template.spec.restartPolicy value is "Always".
  optional k8s.io.api.core.v1.PodTemplateSpec template = 3;

  // volumeClaimTemplates is a list of claims that pods are allowed to reference.
  // The StatefulSet controller is responsible for mapping network identities to
  // claims in a way that maintains the identity of a pod. Every claim in

// all containers in a pod. RuntimeClasses are (currently) manually defined by a
// user or cluster provisioner, and referenced in the PodSpec. The Kubelet is
// responsible for resolving the RuntimeClassName reference before running the
// pod.  For more details, see
// https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class
message RuntimeClass {

  // The only allowed template.spec.restartPolicy value is "Always".
  optional k8s.io.api.core.v1.PodTemplateSpec template = 3;

  // volumeClaimTemplates is a list of claims that pods are allowed to reference.
  // The StatefulSet controller is responsible for mapping network identities to
  // claims in a way that maintains the identity of a pod. Every claim in

  // 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
  //   request resource.
  // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
  //
  // Required.
  optional string expression = 2;
}

// MutatingWebhook describes an admission webhook and the resources and operations it applies to.
message MutatingWebhook {