// fieldValidation instructs the server on how to handle
  // objects in the request (POST/PUT/PATCH) containing unknown
  // or duplicate fields. Valid values are:
  // - Ignore: This will ignore any unknown fields that are silently
  // dropped from the object, and will ignore all but the last duplicate
  // field that the decoder encounters. This is the default behavior
  // prior to v1.23.

  // must be given precedence over this field. The controller may emit a
  // warning if the field and annotation have different values.
  // Implementations of this API should ignore Ingresses without a class
  // specified. An IngressClass resource may be marked as default, which can
  // be used to set a default value for this field. For more information,
  // refer to the IngressClass documentation.

  repeated RuleWithOperations rules = 3;

  // FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
  // allowed values are Ignore or Fail. Defaults to Fail.
  // +optional
  optional string failurePolicy = 4;

  // matchPolicy defines how the "rules" list is used to match incoming requests.
  // Allowed values are "Exact" or "Equivalent".
  //

  // Possible values are:
  //
  // - FailJob: indicates that the pod's job is marked as Failed and all
  //   running pods are terminated.
  // - Ignore: indicates that the counter towards the .backoffLimit is not
  //   incremented and a replacement pod is created.
  // - Count: indicates that the pod is handled in the default way - the

  // "csi.storage.k8s.io/ephemeral" is a new feature in Kubernetes 1.16. It is only
  // required for drivers which support both the "Persistent" and "Ephemeral" VolumeLifecycleMode.
  // Other drivers can leave pod info disabled and/or ignore this field.
  // As Kubernetes 1.15 doesn't support this field, drivers can only support one mode when
  // deployed on such a cluster and the deployment determines which mode that is, for example

  //
  // When failurePolicy is set to Fail, ValidatingAdmissionPolicyBinding validationActions
  // define how failures are enforced.
  //
  // Allowed values are Ignore or Fail. Defaults to Fail.
  // +optional
  optional string failurePolicy = 4;

  // auditAnnotations contains CEL expressions which are used to produce audit
  // annotations for the audit event of the API request.

  repeated k8s.io.api.admissionregistration.v1.RuleWithOperations rules = 3;

  // FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
  // allowed values are Ignore or Fail. Defaults to Ignore.
  // +optional
  optional string failurePolicy = 4;

  // matchPolicy defines how the "rules" list is used to match incoming requests.
  // Allowed values are "Exact" or "Equivalent".
  //

  // must be given precedence over this field. The controller may emit a
  // warning if the field and annotation have different values.
  // Implementations of this API should ignore Ingresses without a class
  // specified. An IngressClass resource may be marked as default, which can
  // be used to set a default value for this field. For more information,
  // refer to the IngressClass documentation.

  // "csi.storage.k8s.io/ephemeral" is a new feature in Kubernetes 1.16. It is only
  // required for drivers which support both the "Persistent" and "Ephemeral" VolumeLifecycleMode.
  // Other drivers can leave pod info disabled and/or ignore this field.
  // As Kubernetes 1.15 doesn't support this field, drivers can only support one mode when
  // deployed on such a cluster and the deployment determines which mode that is, for example

  // - Honor: nodes without taints, along with tainted nodes for which the incoming pod
  // has a toleration, are included.
  // - Ignore: node taints are ignored. All nodes are included.
  //
  // If this value is nil, the behavior is equivalent to the Ignore policy.
  // This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
  // +optional