// Annotations is a list of key-value pairs extracted from the Pod's annotations.
  // It only includes keys which match the pattern `*.image-policy.k8s.io/*`.
  // It is up to each webhook backend to determine how to interpret these annotations, if at all.
  // +optional
  map<string, string> annotations = 2;

  // Namespace is the namespace the pod is being created in.
  // +optional
  optional string namespace = 3;
}

message EndpointConditions {
  // ready indicates that this endpoint is prepared to receive traffic,
  // according to whatever system is managing the endpoint. A nil value
  // indicates an unknown state. In most cases consumers should interpret this
  // unknown state as ready. For compatibility reasons, ready should never be
  // "true" for terminating endpoints.
  // +optional
  optional bool ready = 1;

message EndpointConditions {
  // ready indicates that this endpoint is prepared to receive traffic,
  // according to whatever system is managing the endpoint. A nil value
  // indicates an unknown state. In most cases consumers should interpret this
  // unknown state as ready. For compatibility reasons, ready should never be
  // "true" for terminating endpoints, except when the normal readiness
  // behavior is being explicitly overridden, for example when the associated

private val QUOTED_STRING_DELIMITERS = "\"\\".encodeUtf8()
private val TOKEN_DELIMITERS = "\t ,=".encodeUtf8()

/**
 * Parse RFC 7235 challenges. This is awkward because we need to look ahead to know how to
 * interpret a token.
 *
 * For example, the first line has a parameter name/value pair and the second line has a single
 * token68:
 *
 * ```
 * WWW-Authenticate: Digest foo=bar
 * WWW-Authenticate: Digest foo=
 * ```
 *