m.compileMatcher.Do(func() {
		expressions := make([]cel.ExpressionAccessor, len(m.MutatingWebhook.MatchConditions))
		for i, matchCondition := range m.MutatingWebhook.MatchConditions {
			expressions[i] = &matchconditions.MatchCondition{
				Name:       matchCondition.Name,
				Expression: matchCondition.Expression,
			}
		}
		strictCost := false

	if len(matchConditions) > 0 {
		matchExpressionAccessors := make([]cel.ExpressionAccessor, len(matchConditions))
		for i := range matchConditions {
			matchExpressionAccessors[i] = (*matchconditions.MatchCondition)(&matchConditions[i])
		}

			ClientConfig: validClientConfig,
			SideEffects:  &noSideEffect,
			MatchConditions: []admissionregistration.MatchCondition{{
				Expression: "true",
			}, {
				Expression: "true",
			}},
		}, {
			Name:         "webhook.k8s.io",
			ClientConfig: validClientConfig,
			SideEffects:  &noSideEffect,
			MatchConditions: []admissionregistration.MatchCondition{{
				Name:       "",
				Expression: "true",
			}},
		},

	FailurePolicy    *admissionregistrationv1.FailurePolicyType `json:"failurePolicy,omitempty"`
	AuditAnnotations []AuditAnnotationApplyConfiguration        `json:"auditAnnotations,omitempty"`
	MatchConditions  []MatchConditionApplyConfiguration         `json:"matchConditions,omitempty"`
	Variables        []VariableApplyConfiguration               `json:"variables,omitempty"`
}

// Package-wide variables from generator "generated".
option go_package = "k8s.io/api/admissionregistration/v1";

// MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook.
message MatchCondition {
  // Name is an identifier for this match condition, used for strategic merging of MatchConditions,
  // as well as providing an identifier for logging purposes. A good name should be descriptive of

// Package-wide variables from generator "generated".
option go_package = "k8s.io/api/admissionregistration/v1beta1";

// MatchCondition represents a condition which must be fulfilled for a request to be sent to a webhook.
message MatchCondition {
  // Name is an identifier for this match condition, used for strategic merging of MatchConditions,
  // as well as providing an identifier for logging purposes. A good name should be descriptive of

}

// newWithBackoff allows tests to skip the sleep.

	ConnectionInfo WebhookConnectionInfo

	// matchConditions is a list of conditions that must be met for a request to be sent to this
	// webhook. An empty list of matchConditions matches all requests.
	// There are a maximum of 64 match conditions allowed.
	//
	// The exact matching logic is (in order):
	//   1. If at least one matchCondition evaluates to FALSE, then the webhook is skipped.

			if conditionNames.Has(matchCondition.Name) {
				allErrors = append(allErrors, field.Duplicate(fldPath.Index(i).Child("name"), matchCondition.Name))
			} else {
				conditionNames.Insert(matchCondition.Name)
			}
		}
	}
	return allErrors
}

func validateMatchCondition(v *admissionregistration.MatchCondition, opts validationOptions, fldPath *field.Path) field.ErrorList {
	var allErrors field.ErrorList

	"time"

	"k8s.io/component-base/metrics"
	"k8s.io/component-base/metrics/legacyregistry"
)

// MatcherMetrics defines methods for reporting matchCondition metrics
type MatcherMetrics interface {
	// RecordAuthorizationMatchConditionEvaluation records the total time taken to evaluate matchConditions for an Authorize() call to the given authorizer