//
  // For example:
  // 'pods' means pods.
  // 'pods/log' means the log subresource of pods.
  // '*' means all resources, but not subresources.
  // 'pods/*' means all subresources of pods.
  // '*/scale' means all scale subresources.
  // '*/*' means all resources and their subresources.
  //
  // If wildcard is present, the validation rule will ensure resources do not
  // overlap with each other.

  // +listType=set
  // Required.
  repeated string apiGroups = 2;

  // `resources` is a list of matching resources (i.e., lowercase
  // and plural) with, if desired, subresource.  For example, [
  // "services", "nodes/status" ].  This list may not be empty.
  // "*" matches all resources and, if present, must be the only entry.
  // Required.
  // +listType=set

* Advanced audit policy now supports matching subresources and resource names, but the top level resource no longer matches the subresouce. For example "pods" no longer matches requests to the logs subresource of pods. Use "pods/logs" to match subresources. ([#48836](https://github.com/kubernetes/kubernetes/pull/48836), [@ericchiang](https://github.com/ericchiang))

This release SIG API Machinery focused mainly on CustomResources. For example, subresources for CustomResources are now beta and enabled by default. With this, updates to the `/status` subresource will disallow updates to all fields other than `.status` (not just `.spec` and `.metadata` as before). Also, `required` and `description` can be used at the root of the CRD OpenAPI validation schema when the `/status` subresource is enabled.

  repeated HPAScalingPolicy policies = 2;
}

// HorizontalPodAutoscaler is the configuration for a horizontal pod
// autoscaler, which automatically manages the replica count of any resource
// implementing the scale subresource based on the metrics specified.
message HorizontalPodAutoscaler {
  // metadata is the standard object metadata.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

}

// HorizontalPodAutoscaler is the configuration for a horizontal pod
// autoscaler, which automatically manages the replica count of any resource
// implementing the scale subresource based on the metrics specified.
message HorizontalPodAutoscaler {
  // metadata is the standard object metadata.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

  // +listType=set
  // Required.
  repeated string apiGroups = 2;

  // `resources` is a list of matching resources (i.e., lowercase
  // and plural) with, if desired, subresource.  For example, [
  // "services", "nodes/status" ].  This list may not be empty.
  // "*" matches all resources and, if present, must be the only entry.
  // Required.
  // +listType=set

  // +listType=set
  // Required.
  repeated string apiGroups = 2;

  // `resources` is a list of matching resources (i.e., lowercase
  // and plural) with, if desired, subresource.  For example, [
  // "services", "nodes/status" ].  This list may not be empty.
  // "*" matches all resources and, if present, must be the only entry.
  // Required.
  // +listType=set

  // +optional
  optional ScaleStatus status = 3;
}

// describes the attributes of a scale subresource
message ScaleSpec {
  // desired number of instances for the scaled object.
  // +optional
  optional int32 replicas = 1;
}

// represents the current status of a scale subresource.
message ScaleStatus {
  // actual number of observed instances of the scaled object.

        * requests from a node for a TLS client certificate for itself are approved if the CSR creator has `create` permission on the `certificatesigningrequests` resource and the `selfnodeclient` subresource in the `certificates.k8s.io` API group