optional string uid = 1;

  // Kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)
  optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind kind = 2;

  // Resource is the fully-qualified resource being requested (for example, v1.pods)
  optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionResource resource = 3;

In ambient mode, the CNI plugin is effectively just a shim to catch pod creation events and notify the CNI agent early enough to set up network redirection before the pod is fully started. This is necessary because the CNI plugin is effectively the first thing to see a scheduled pod - before the K8S control plane will see things like the pod IP or networking info, the CNI will - but the CNI plugin alone is not sufficient to...

                              maximum: 4294967295
                              minimum: 0
                              type: integer
                            service:
                              description: The fully qualified service name for this
                                cluster.
                              type: string
                            subset:

  // immutable after creation. The following address types are currently
  // supported:
  // * IPv4: Represents an IPv4 Address.
  // * IPv6: Represents an IPv6 Address.
  // * FQDN: Represents a Fully Qualified Domain Name.
  optional string addressType = 4;

  // endpoints is a list of unique endpoints in this slice. Each slice may
  // include a maximum of 1000 endpoints.
  // +listType=atomic

  optional string expression = 2;
}

// MutatingWebhook describes an admission webhook and the resources and operations it applies to.
message MutatingWebhook {
  // The name of the admission webhook.
  // Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
  // "imagepolicy" is the name of the webhook, and kubernetes.io is the name
  // of the organization.
  // Required.
  optional string name = 1;

  optional string expression = 2;
}

// MutatingWebhook describes an admission webhook and the resources and operations it applies to.
message MutatingWebhook {
  // The name of the admission webhook.
  // Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
  // "imagepolicy" is the name of the webhook, and kubernetes.io is the name
  // of the organization.
  // Required.
  optional string name = 1;

  * In practice, this largely means that references are fully qualified in the API. IP Addresses (generally) have a network associated with them, node names have a cluster associated with them, etc.

// the related backend services. Incoming requests are first evaluated for a host
// match, then routed to the backend associated with the matching IngressRuleValue.
message IngressRule {
  // host is the fully qualified domain name of a network host, as defined by RFC 3986.
  // Note the following deviations from the "host" part of the
  // URI as defined in RFC 3986:

// the related backend services. Incoming requests are first evaluated for a host
// match, then routed to the backend associated with the matching IngressRuleValue.
message IngressRule {
  // host is the fully qualified domain name of a network host, as defined by RFC 3986.
  // Note the following deviations from the "host" part of the
  // URI as defined in RFC 3986:

                              maximum: 4294967295
                              minimum: 0
                              type: integer
                            service:
                              description: The fully qualified service name for this
                                cluster.
                              type: string
                            subset: