// +optional
  optional NonResourceAttributes nonResourceAttributes = 2;

  // User is the user you're testing for.
  // If you specify "User" but not "Groups", then is it interpreted as "What if User were not a member of any groups
  // +optional
  optional string user = 3;

  // Groups is the groups you're testing for.
  // +optional
  repeated string groups = 4;

// at least one member of verbs matches the request, (b) at least one
// member of apiGroups matches the request, (c) at least one member of
// resources matches the request, and (d) either (d1) the request does
// not specify a namespace (i.e., `Namespace==""`) and clusterScope is
// true or (d2) the request specifies a namespace and least one member
// of namespaces matches the request's namespace.

// at least one member of verbs matches the request, (b) at least one
// member of apiGroups matches the request, (c) at least one member of
// resources matches the request, and (d) either (d1) the request does
// not specify a namespace (i.e., `Namespace==""`) and clusterScope is
// true or (d2) the request specifies a namespace and least one member
// of namespaces matches the request's namespace.

  // specify a global default.
  // +optional
  optional IngressBackend backend = 1;

  // tls represents the TLS configuration. Currently the Ingress only supports a
  // single TLS port, 443. If multiple members of this list specify different hosts,
  // they will be multiplexed on the same port according to the hostname specified
  // through the SNI TLS extension, if the ingress controller fulfilling the
  // ingress supports SNI.

// at least one member of verbs matches the request, (b) at least one
// member of apiGroups matches the request, (c) at least one member of
// resources matches the request, and (d) either (d1) the request does
// not specify a namespace (i.e., `Namespace==""`) and clusterScope is
// true or (d2) the request specifies a namespace and least one member
// of namespaces matches the request's namespace.

// at least one member of verbs matches the request, (b) at least one
// member of apiGroups matches the request, (c) at least one member of
// resources matches the request, and (d) either (d1) the request does
// not specify a namespace (i.e., `Namespace==""`) and clusterScope is
// true or (d2) the request specifies a namespace and least one member
// of namespaces matches the request's namespace.

  // Note:
  // * the number of additional invocations is not guaranteed to be exactly one.
  // * if additional invocations result in further modifications to the object, webhooks are not guaranteed to be invoked again.
  // * webhooks that use this option may be reordered to minimize the number of additional invocations.

  // +optional
  optional NonResourceAttributes nonResourceAttributes = 2;

  // User is the user you're testing for.
  // If you specify "User" but not "Group", then is it interpreted as "What if User were not a member of any groups
  // +optional
  optional string user = 3;

  // Groups is the groups you're testing for.
  // +optional
  repeated string group = 4;

// Spec to control the desired behavior of daemon set rolling update.
message RollingUpdateDaemonSet {
  // The maximum number of DaemonSet pods that can be unavailable during the
  // update. Value can be an absolute number (ex: 5) or a percentage of total
  // number of DaemonSet pods at the start of the update (ex: 10%). Absolute
  // number is calculated from percentage by rounding up.
  // This cannot be 0 if MaxSurge is 0
  // Default value is 1.

// Spec to control the desired behavior of daemon set rolling update.
message RollingUpdateDaemonSet {
  // The maximum number of DaemonSet pods that can be unavailable during the
  // update. Value can be an absolute number (ex: 5) or a percentage of total
  // number of DaemonSet pods at the start of the update (ex: 10%). Absolute
  // number is calculated from percentage by rounding up.
  // This cannot be 0 if MaxSurge is 0
  // Default value is 1.