// field that the decoder encounters. This is the default behavior
  // prior to v1.23.
  // - Warn: This will send a warning via the standard warning response
  // header for each unknown field that is dropped from the object, and
  // for each duplicate field that is encountered. The request will
  // still succeed if there are no other errors, and will only persist
  // the last of any duplicate fields. This is the default in v1.23+

  // template is the object that describes the pod that will be created if
  // insufficient replicas are detected. Each pod stamped out by the StatefulSet
  // will fulfill this Template, but have a unique identity from the rest
  // of the StatefulSet. Each pod will be named with the format
  // <statefulsetname>-<podindex>. For example, a pod in a StatefulSet named

// matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to.
// This type is beta-level in 1.8
message NetworkPolicyEgressRule {
  // List of destination ports for outgoing traffic.
  // Each item in this list is combined using a logical OR. If this field is
  // empty or missing, this rule matches all ports (traffic not restricted by port).
  // If this field is present and contains at least one item, then this rule allows

  // pods refers to a metric describing each pod in the current scale target
  // (for example, transactions-processed-per-second).  The values will be
  // averaged together before being compared to the target value.
  // +optional
  optional PodsMetricSource pods = 3;

  // resource refers to a resource metric (such as those specified in
  // requests and limits) known to Kubernetes describing each pod in the

  // pods refers to a metric describing each pod in the current scale target
  // (for example, transactions-processed-per-second).  The values will be
  // averaged together before being compared to the target value.
  // +optional
  optional PodsMetricSource pods = 3;

  // resource refers to a resource metric (such as those specified in
  // requests and limits) known to Kubernetes describing each pod in the

message ImageReviewSpec {
  // Containers is a list of a subset of the information in each container of the Pod being created.
  // +optional
  repeated ImageReviewContainerSpec containers = 1;

  // Annotations is a list of key-value pairs extracted from the Pod's annotations.
  // It only includes keys which match the pattern `*.image-policy.k8s.io/*`.
  // It is up to each webhook backend to determine how to interpret these annotations, if at all.

  // will be truncated to 10kb.
  //
  // If multiple ValidatingAdmissionPolicyBinding resources match an
  // API request, then the valueExpression will be evaluated for
  // each binding. All unique values produced by the valueExpressions
  // will be joined together in a comma-separated list.
  //
  // Required.
  optional string valueExpression = 2;
}

  // template is the object that describes the pod that will be created if
  // insufficient replicas are detected. Each pod stamped out by the StatefulSet
  // will fulfill this Template, but have a unique identity from the rest
  // of the StatefulSet. Each pod will be named with the format
  // <statefulsetname>-<podindex>. For example, a pod in a StatefulSet named

  // `matchingPrecedence` is used to choose among the FlowSchemas that match a given request. The chosen
  // FlowSchema is among those with the numerically lowest (which we take to be logically highest)
  // MatchingPrecedence.  Each MatchingPrecedence value must be ranged in [1,10000].
  // Note that if the precedence is not specified, it will be set to 1000 as default.
  // +optional
  optional int32 matchingPrecedence = 2;

  // +optional
  repeated AllowedCSIDriver allowedCSIDrivers = 23;

  // allowedUnsafeSysctls is a list of explicitly allowed unsafe sysctls, defaults to none.
  // Each entry is either a plain sysctl name or ends in "*" in which case it is considered
  // as a prefix of allowed sysctls. Single * means all unsafe sysctls are allowed.