{
  "description": "Subject matches the originator of a request, as identified by the request authentication system. There are three ways of matching an originator; by user, group, or service account.",
  "properties": {
    "group": {
      "$ref": "/api/_definitions.json#/$defs/io.k8s.api.flowcontrol.v1beta3.GroupSubject",
      "description": "`group` matches based on user group name."
    },
    "kind": {
      "description": "`kind` indicates which one of the other fields is non-empty. Required",
      "type": [
        "string",
        "null"
      ]
    },
    "serviceAccount": {
      "$ref": "/api/_definitions.json#/$defs/io.k8s.api.flowcontrol.v1beta3.ServiceAccountSubject",
      "description": "`serviceAccount` matches ServiceAccounts."
    },
    "user": {
      "$ref": "/api/_definitions.json#/$defs/io.k8s.api.flowcontrol.v1beta3.UserSubject",
      "description": "`user` matches based on username."
    }
  },
  "required": [
    "kind"
  ],
  "type": "object",
  "x-kubernetes-unions": [
    {
      "discriminator": "kind",
      "fields-to-discriminateBy": {
        "group": "Group",
        "serviceAccount": "ServiceAccount",
        "user": "User"
      }
    }
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://kubernetes.io/api/subject/flowcontrol/v1beta3"
}