{
    "definitions": {
        "https:__kubernetesjsonschema_dev_master__defs_json_defs_io_k8s_api_authentication_v1_BoundObjectReference": {
            "description": "BoundObjectReference is a reference to an object that a token is bound to.",
            "properties": {
                "apiVersion": {
                    "description": "API version of the referent.",
                    "type": "string"
                },
                "kind": {
                    "description": "Kind of the referent. Valid kinds are 'Pod' and 'Secret'.",
                    "type": "string"
                },
                "name": {
                    "description": "Name of the referent.",
                    "type": "string"
                },
                "uid": {
                    "description": "UID of the referent.",
                    "type": "string"
                }
            },
            "type": "object"
        }
    },
    "description": "TokenRequestSpec contains client provided parameters of a token request.",
    "properties": {
        "audiences": {
            "description": "Audiences are the intendend audiences of the token. A recipient of a token must identitfy themself with an identifier in the list of audiences of the token, and otherwise should reject the token. A token issued for multiple audiences may be used to authenticate against any of the audiences listed but implies a high degree of trust between the target audiences.",
            "items": {
                "type": [
                    "string",
                    "null"
                ]
            },
            "type": [
                "array",
                "null"
            ]
        },
        "boundObjectRef": {
            "$ref": "#/definitions/https:__kubernetesjsonschema_dev_master__defs_json_defs_io_k8s_api_authentication_v1_BoundObjectReference",
            "description": "BoundObjectRef is a reference to an object that the token will be bound to. The token will only be valid for as long as the bound object exists. NOTE: The API server's TokenReview endpoint will validate the BoundObjectRef, but other audiences may not. Keep ExpirationSeconds small if you want prompt revocation."
        },
        "expirationSeconds": {
            "description": "ExpirationSeconds is the requested duration of validity of the request. The token issuer may return a token with a different validity duration so a client needs to check the 'expiration' field in a response.",
            "format": "int64",
            "type": [
                "integer",
                "null"
            ]
        }
    },
    "required": [
        "audiences"
    ],
    "type": "object"
}