// but not yet healthy can be evicted only if the guarded application is not
  // disrupted (status.currentHealthy is at least equal to status.desiredHealthy).
  // Healthy pods will be subject to the PDB for eviction.
  //
  // AlwaysAllow policy means that all running pods (status.phase="Running"),
  // but not yet healthy are considered disrupted and can be evicted regardless

  //
  // - Exact: match a request only if it exactly matches a specified rule.
  // For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
  // but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
  // a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.
  //

  // only if either (a) this list contains that target namespace or
  // (b) this list contains "*".  Note that "*" matches any
  // specified namespace but does not match a request that _does
  // not specify_ a namespace (see the `clusterScope` field for
  // that).
  // This list may be empty, but only if `clusterScope` is true.
  // +optional
  // +listType=set
  repeated string namespaces = 5;
}

  // only if either (a) this list contains that target namespace or
  // (b) this list contains "*".  Note that "*" matches any
  // specified namespace but does not match a request that _does
  // not specify_ a namespace (see the `clusterScope` field for
  // that).
  // This list may be empty, but only if `clusterScope` is true.
  // +optional
  // +listType=set
  repeated string namespaces = 5;
}

  // +optional
  optional k8s.io.api.core.v1.ObjectReference related = 9;

  // note is a human-readable description of the status of this operation.
  // Maximal length of the note is 1kB, but libraries should be prepared to
  // handle values up to 64kB.
  // +optional
  optional string note = 10;

  // type is the type of this event (Normal, Warning), new types could be added in the future.

  // pods that are still required for the deployment to have 100% available capacity. They may
  // either be pods that are running but not yet available or pods that still have not been created.
  // +optional
  optional int32 unavailableReplicas = 5;

  // Conditions represent the latest available observations of a deployment's current state.

  optional int32 replicas = 1;

  // selector is the label query over pods that should match the replicas count. This is same
  // as the label selector but in the string format to avoid introspection
  // by clients. The string will be in the same format as the query-param syntax.
  // More info about label selectors: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/

  // APIs may return other objects types at their discretion, such as error conditions, requests for alternate representations, or other operation specific behavior.
  // This value will be null if an APIService reports subresources but supports no operations on the parent resource
  optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind responseKind = 2;

  // scope indicates the scope of a resource, either Cluster or Namespaced

  // finalizer will be added to/removed from the object's finalizers list.
  // Either this field or PropagationPolicy may be set, but not both.
  // +optional
  optional bool orphanDependents = 3;

  // Whether and how garbage collection will be performed.
  // Either this field or OrphanDependents may be set, but not both.
  // The default policy is decided by the existing finalizer set in the

  // Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
  // Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"),  but not both.
  // +optional
  repeated string nonResourceURLs = 6;
}