message TokenRequest {
  // audience is the intended audience of the token in "TokenRequestSpec".
  // It will default to the audiences of kube apiserver.
  optional string audience = 1;

  // expirationSeconds is the duration of validity of the token in "TokenRequestSpec".
  // It has the same default value of "ExpirationSeconds" in "TokenRequestSpec"
  //
  // +optional
  optional int64 expirationSeconds = 2;
}

  // Spec holds information about the request being evaluated.  spec.namespace must be equal to the namespace
  // you made the request against.  If empty, it is defaulted.
  optional SubjectAccessReviewSpec spec = 2;

  // Status is filled in by the server and indicates whether the request is allowed or not
  // +optional
  optional SubjectAccessReviewStatus status = 3;
}

  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension oldObject = 10;

  // DryRun indicates that modifications will definitely not be persisted for this request.
  // Defaults to false.
  // +optional
  optional bool dryRun = 11;

  // Options is the operation option structure of the operation being performed.

  // field.  This field has a default value of 8.
  // +optional
  optional int32 handSize = 2;

  // `queueLengthLimit` is the maximum number of requests allowed to
  // be waiting in a given queue of this priority level at a time;
  // excess requests are rejected.  This value must be positive.  If
  // not specified, it will be defaulted to 50.
  // +optional
  optional int32 queueLengthLimit = 3;

  // field.  This field has a default value of 8.
  // +optional
  optional int32 handSize = 2;

  // `queueLengthLimit` is the maximum number of requests allowed to
  // be waiting in a given queue of this priority level at a time;
  // excess requests are rejected.  This value must be positive.  If
  // not specified, it will be defaulted to 50.
  // +optional
  optional int32 queueLengthLimit = 3;

  // * must consist of lower case alphanumeric characters or '-'.
  // * must start and end with an alphanumeric character.
  // Default is empty string.
  optional string name = 1;

  // protocol represents the IP protocol for this port.
  // Must be UDP, TCP, or SCTP.
  // Default is TCP.
  optional string protocol = 2;

  // port represents the port number of the endpoint.

  // as pods that have status.conditions item with type="Ready",status="True".
  //
  // Valid policies are IfHealthyBudget and AlwaysAllow.
  // If no policy is specified, the default behavior will be used,
  // which corresponds to the IfHealthyBudget policy.
  //
  // IfHealthyBudget policy means that running pods (status.phase="Running"),

  // VolumeClaimTemplates when the StatefulSet is deleted. The default policy
  // of `Retain` causes PVCs to not be affected by StatefulSet deletion. The
  // `Delete` policy causes those PVCs to be deleted.
  optional string whenDeleted = 1;

  // whenScaled specifies what happens to PVCs created from StatefulSet
  // VolumeClaimTemplates when the StatefulSet is scaled down. The default

  // list. An empty list requires the RuntimeClassName field to be unset.
  repeated string allowedRuntimeClassNames = 1;

  // defaultRuntimeClassName is the default RuntimeClassName to set on the pod.
  // The default MUST be allowed by the allowedRuntimeClassNames list.
  // A value of nil does not mutate the Pod.
  // +optional
  optional string defaultRuntimeClassName = 2;
}

  // If not set, use the default values:
  // - For scale up: 0 (i.e. no stabilization is done).
  // - For scale down: 300 (i.e. the stabilization window is 300 seconds long).
  // +optional
  optional int32 stabilizationWindowSeconds = 3;

  // selectPolicy is used to specify which policy should be used.
  // If not set, the default value Max is used.
  // +optional