// the oldObject and newObject that would be sent to the cel validation, and
  // is considered to match if either object matches the selector. A null
  // object (oldObject in the case of create, or newObject in the case of
  // delete) or an object that cannot have labels (like a
  // DeploymentRollback or a PodProxyOptions object) is not considered to
  // match.
  // Use the object selector only if the webhook is opt-in, because end

  // `distinguisherMethod` defines how to compute the flow distinguisher for requests that match this schema.
  // `nil` specifies that the distinguisher is disabled and thus will always be the empty string.
  // +optional
  optional FlowDistinguisherMethod distinguisherMethod = 3;

  // `rules` describes which requests will match this flow schema. This FlowSchema matches a request if and only if

  // `distinguisherMethod` defines how to compute the flow distinguisher for requests that match this schema.
  // `nil` specifies that the distinguisher is disabled and thus will always be the empty string.
  // +optional
  optional FlowDistinguisherMethod distinguisherMethod = 3;

  // `rules` describes which requests will match this flow schema. This FlowSchema matches a request if and only if

  optional int32 replicas = 1;

  // selector is a label query over pods that should match the replicas count. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
  // +optional
  map<string, string> selector = 2;

  // targetSelector is the label selector for pods that should match the replicas count. This is a serializated

  // +optional
  repeated ImageReviewContainerSpec containers = 1;

  // Annotations is a list of key-value pairs extracted from the Pod's annotations.
  // It only includes keys which match the pattern `*.image-policy.k8s.io/*`.
  // It is up to each webhook backend to determine how to interpret these annotations, if at all.
  // +optional
  map<string, string> annotations = 2;

// AllowedHostPath defines the host volume conditions that will be enabled by a policy
// for pods to use. It requires the path prefix to be defined.
message AllowedHostPath {
  // pathPrefix is the path prefix that the host volume must match.
  // It does not support `*`.
  // Trailing slashes are trimmed when validating the path prefix with a host path.
  //
  // Examples:
  // `/foo` would allow `/foo`, `/foo/` and `/foo/bar`

message ScaleStatus {
  // replicas is the actual number of observed instances of the scaled object.
  optional int32 replicas = 1;

  // selector is the label query over pods that should match the replicas count. This is same
  // as the label selector but in the string format to avoid introspection
  // by clients. The string will be in the same format as the query-param syntax.

  // operation, i.e. the external-attacher.
  optional bool attached = 1;

  // attachmentMetadata is populated with any
  // information returned by the attach operation, upon successful attach, that must be passed
  // into subsequent WaitForAttach or Mount calls.
  // This field must only be set by the entity completing the attach
  // operation, i.e. the external-attacher.

  // allowed values are Ignore or Fail. Defaults to Ignore.
  // +optional
  optional string failurePolicy = 4;

  // matchPolicy defines how the "rules" list is used to match incoming requests.
  // Allowed values are "Exact" or "Equivalent".
  //
  // - Exact: match a request only if it exactly matches a specified rule.
  // For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,

  //   list of labels in the path split by the '/' separator. A request is a
  //   match for path p if every p is an element-wise prefix of p of the
  //   request path. Note that if the last element of the path is a substring
  //   of the last element in request path, it is not a match (e.g. /foo/bar
  //   matches /foo/bar/baz, but does not match /foo/barbaz).
  // * ImplementationSpecific: Interpretation of the Path matching is up to