optional string warning = 3;
}

message MatchCondition {
  // Name is an identifier for this match condition, used for strategic merging of MatchConditions,
  // as well as providing an identifier for logging purposes. A good name should be descriptive of
  // the associated expression.
  // Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and

message GroupSubject {
  // name is the user group that matches, or "*" to match all user groups.
  // See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some
  // well-known group names.
  // Required.
  optional string name = 1;
}

// LimitResponse defines how to handle requests that can not be executed right now.
// +union
message LimitResponse {

message GroupSubject {
  // name is the user group that matches, or "*" to match all user groups.
  // See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some
  // well-known group names.
  // Required.
  optional string name = 1;
}

// LimitResponse defines how to handle requests that can not be executed right now.
// +union
message LimitResponse {

message HorizontalPodAutoscalerSpec {
  // scaleTargetRef points to the target resource to scale, and is used to the pods for which metrics
  // should be collected, as well as to actually change the replica count.
  optional CrossVersionObjectReference scaleTargetRef = 1;

  // minReplicas is the lower limit for the number of replicas to which the autoscaler

  // validity duration so a client must check the delta between the notBefore and
  // and notAfter fields in the issued certificate to determine the actual duration.
  //
  // The v1.22+ in-tree implementations of the well-known Kubernetes signers will
  // honor this field as long as the requested duration is not greater than the
  // maximum duration they will honor per the --cluster-signing-duration CLI

}

// RuntimeClassSpec is a specification of a RuntimeClass. It contains parameters
// that are required to describe the RuntimeClass to the Container Runtime
// Interface (CRI) implementation, as well as any other components that need to
// understand how the pod will be run. The RuntimeClassSpec is immutable.
message RuntimeClassSpec {
  // runtimeHandler specifies the underlying runtime and configuration that the

// MatchCondition represents a condition which must be fulfilled for a request to be sent to a webhook.
message MatchCondition {
  // Name is an identifier for this match condition, used for strategic merging of MatchConditions,
  // as well as providing an identifier for logging purposes. A good name should be descriptive of
  // the associated expression.
  // Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and

  // https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
  // Topology may include a maximum of 16 key/value pairs. This includes, but
  // is not limited to the following well known keys:
  // * kubernetes.io/hostname: the value indicates the hostname of the node
  //   where the endpoint is located. This should match the corresponding
  //   node label.

message GroupSubject {
  // name is the user group that matches, or "*" to match all user groups.
  // See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some
  // well-known group names.
  // Required.
  optional string name = 1;
}

// LimitResponse defines how to handle requests that can not be executed right now.
// +union
message LimitResponse {

message GroupSubject {
  // name is the user group that matches, or "*" to match all user groups.
  // See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some
  // well-known group names.
  // Required.
  optional string name = 1;
}

// LimitResponse defines how to handle requests that can not be executed right now.
// +union
message LimitResponse {