// if a fstype is defined and the volume's access mode contains ReadWriteOnce.
  //
  // +optional
  optional string fsGroupPolicy = 5;

  // tokenRequests indicates the CSI driver needs pods' service account
  // tokens it is mounting volume for to do necessary authentication. Kubelet
  // will pass the tokens in VolumeContext in the CSI NodePublishVolume calls.

  // +optional
  optional string apiVersion = 3;
}

// ExternalMetricSource indicates how to scale on a metric not associated with
// any Kubernetes object (for example length of queue in cloud
// messaging service, or QPS from loadbalancer running outside of cluster).
message ExternalMetricSource {
  // metric identifies the target metric by name and selector
  optional MetricIdentifier metric = 1;

  // +optional
  optional string apiVersion = 3;
}

// ExternalMetricSource indicates how to scale on a metric not associated with
// any Kubernetes object (for example length of queue in cloud
// messaging service, or QPS from loadbalancer running outside of cluster).
message ExternalMetricSource {
  // metricName is the name of the metric in question.
  optional string metricName = 1;

  // that).
  // This list may be empty, but only if `clusterScope` is true.
  // +optional
  // +listType=set
  repeated string namespaces = 5;
}

// ServiceAccountSubject holds detailed information for service-account-kind subject.
message ServiceAccountSubject {
  // `namespace` is the namespace of matching ServiceAccount objects.
  // Required.
  optional string namespace = 1;

  // that).
  // This list may be empty, but only if `clusterScope` is true.
  // +optional
  // +listType=set
  repeated string namespaces = 5;
}

// ServiceAccountSubject holds detailed information for service-account-kind subject.
message ServiceAccountSubject {
  // `namespace` is the namespace of matching ServiceAccount objects.
  // Required.
  optional string namespace = 1;

  // +optional
  repeated k8s.io.api.core.v1.PersistentVolumeClaim volumeClaimTemplates = 4;

  // serviceName is the name of the service that governs this StatefulSet.
  // This service must exist before the StatefulSet, and is responsible for
  // the network identity of the set. Pods get DNS/hostnames that follow the
  // pattern: pod-specific-string.serviceName.default.svc.cluster.local

  // 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).
  // 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
  //   See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
  // 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the

  // +optional
  optional string apiVersion = 3;
}

// ExternalMetricSource indicates how to scale on a metric not associated with
// any Kubernetes object (for example length of queue in cloud
// messaging service, or QPS from loadbalancer running outside of cluster).
message ExternalMetricSource {
  // metric identifies the target metric by name and selector
  optional MetricIdentifier metric = 1;

  // +optional
  optional string apiVersion = 3;
}

// ExternalMetricSource indicates how to scale on a metric not associated with
// any Kubernetes object (for example length of queue in cloud
// messaging service, or QPS from loadbalancer running outside of cluster).
// Exactly one "target" type should be set.
message ExternalMetricSource {
  // metricName is the name of the metric in question.
  optional string metricName = 1;

  // if a fstype is defined and the volume's access mode contains ReadWriteOnce.
  //
  // +optional
  optional string fsGroupPolicy = 5;

  // tokenRequests indicates the CSI driver needs pods' service account
  // tokens it is mounting volume for to do necessary authentication. Kubelet
  // will pass the tokens in VolumeContext in the CSI NodePublishVolume calls.