// 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).
  // 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
  //   See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
  // 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
  //   request resource.

  // This list may be empty, but only if `clusterScope` is true.
  // +optional
  // +listType=set
  repeated string namespaces = 5;
}

// ServiceAccountSubject holds detailed information for service-account-kind subject.
message ServiceAccountSubject {
  // `namespace` is the namespace of matching ServiceAccount objects.
  // Required.
  optional string namespace = 1;

  // This list may be empty, but only if `clusterScope` is true.
  // +optional
  // +listType=set
  repeated string namespaces = 5;
}

// ServiceAccountSubject holds detailed information for service-account-kind subject.
message ServiceAccountSubject {
  // `namespace` is the namespace of matching ServiceAccount objects.
  // Required.
  optional string namespace = 1;

  // 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).
  // 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
  //   See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
  // 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
  //   request resource.

  // metrics contains the specifications for which to use to calculate the
  // desired replica count (the maximum replica count across all metrics will
  // be used).  The desired replica count is calculated multiplying the
  // ratio between the target value and the current value by the current
  // number of pods.  Ergo, metrics used must decrease as the pod count is
  // increased, and vice-versa.  See the individual metric source types for

  optional int32 replicas = 1;

  // selector is a label query over pods that should match the replicas count. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
  // +optional
  map<string, string> selector = 2;

  // targetSelector is the label selector for pods that should match the replicas count. This is a serializated
  // version of both map-based and more expressive set-based selectors. This is done to

}

// EventSeries contain information on series of events, i.e. thing that was/is happening
// continuously for some time.
message EventSeries {
  // count is the number of occurrences in this series up to the last heartbeat time.
  optional int32 count = 1;

  // lastObservedTime is the time when last Event from the series was seen before last heartbeat.

message ScaleStatus {
  // replicas is the actual number of observed instances of the scaled object.
  optional int32 replicas = 1;

  // selector is the label query over pods that should match the replicas count. This is same
  // as the label selector but in the string format to avoid introspection
  // by clients. The string will be in the same format as the query-param syntax.

// +protobuf.options.(gogoproto.goproto_stringer)=false
message ExtraValue {
  // items, if empty, will result in an empty slice

  repeated string items = 1;
}

// TokenRequest requests a token for a given service account.
message TokenRequest {
  // Standard object's metadata.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
  // +optional

  // if a fstype is defined and the volume's access mode contains ReadWriteOnce.
  //
  // +optional
  optional string fsGroupPolicy = 5;

  // tokenRequests indicates the CSI driver needs pods' service account
  // tokens it is mounting volume for to do necessary authentication. Kubelet
  // will pass the tokens in VolumeContext in the CSI NodePublishVolume calls.