// +optional
  optional bool seLinuxMount = 8;
}

// DEPRECATED - This group version of CSINode is deprecated by storage/v1/CSINode.
// See the release notes for more information.
// CSINode holds information about all CSI drivers installed on a node.
// CSI drivers do not need to create the CSINode object directly. As long as
// they use the node-driver-registrar sidecar container, the kubelet will

  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items holds a list of StorageVersion
  repeated StorageVersion items = 2;
}

// StorageVersionSpec is an empty spec.
message StorageVersionSpec {
}

  // given RuntimeClass. For more details, see
  //  https://kubernetes.io/docs/concepts/scheduling-eviction/pod-overhead/
  // +optional
  optional Overhead overhead = 3;

  // scheduling holds the scheduling constraints to ensure that pods running
  // with this RuntimeClass are scheduled to nodes that support it.
  // If scheduling is nil, this RuntimeClass is assumed to be supported by all
  // nodes.
  // +optional

  // given RuntimeClass. For more details, see
  // https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md
  // +optional
  optional Overhead overhead = 2;

  // scheduling holds the scheduling constraints to ensure that pods running
  // with this RuntimeClass are scheduled to nodes that support it.
  // If scheduling is nil, this RuntimeClass is assumed to be supported by all
  // nodes.
  // +optional

                                    type: string
                                  credentialName:
                                    description: The name of the secret that holds
                                      the TLS certs for the client including the CA
                                      certificates.
                                    type: string

  // for cluster-scoped resources and non-empty for namespaced
  // resources.
  // +optional
  optional string namespace = 4;
}

// ResourceHandle holds opaque resource data for processing by a specific kubelet plugin.
message ResourceHandle {
  // DriverName specifies the name of the resource driver whose kubelet

  // This field is beta-level in 1.8
  // +optional
  repeated string policyTypes = 4;
}

// NetworkPolicyStatus describes the current state of the NetworkPolicy.
message NetworkPolicyStatus {
  // conditions holds an array of metav1.Condition that describe the state of the NetworkPolicy.
  // Current service state
  // +optional
  // +patchMergeKey=type
  // +patchStrategy=merge
  // +listType=map
  // +listMapKey=type

  repeated string operations = 1;

  // Rule is embedded, it describes other criteria of the rule, like
  // APIGroups, APIVersions, Resources, etc.
  optional Rule rule = 2;
}

// ServiceReference holds a reference to Service.legacy.k8s.io
message ServiceReference {
  // `namespace` is the namespace of the service.
  // Required
  optional string namespace = 1;

  // `name` is the name of the service.

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // List of MutatingWebhookConfiguration.
  repeated MutatingWebhookConfiguration items = 2;
}

// ServiceReference holds a reference to Service.legacy.k8s.io
message ServiceReference {
  // `namespace` is the namespace of the service.
  // Required
  optional string namespace = 1;

  // `name` is the name of the service.

option go_package = "k8s.io/api/rbac/v1alpha1";

// AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole
message AggregationRule {
  // ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules.
  // If any of the selectors match, then the ClusterRole's permissions will be added
  // +optional