message ValidatingAdmissionPolicyBindingSpec {
  // PolicyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
  // If the referenced resource does not exist, this binding is considered invalid and will be ignored
  // Required.
  optional string policyName = 1;

  // ParamRef specifies the parameter resource used to configure the admission control policy.

  // only if either (a) this list contains that target namespace or
  // (b) this list contains "*".  Note that "*" matches any
  // specified namespace but does not match a request that _does
  // not specify_ a namespace (see the `clusterScope` field for
  // that).
  // This list may be empty, but only if `clusterScope` is true.
  // +optional
  // +listType=set

  // only if either (a) this list contains that target namespace or
  // (b) this list contains "*".  Note that "*" matches any
  // specified namespace but does not match a request that _does
  // not specify_ a namespace (see the `clusterScope` field for
  // that).
  // This list may be empty, but only if `clusterScope` is true.
  // +optional
  // +listType=set

// for pods to use. It requires the path prefix to be defined.
message AllowedHostPath {
  // pathPrefix is the path prefix that the host volume must match.
  // It does not support `*`.
  // Trailing slashes are trimmed when validating the path prefix with a host path.
  //
  // Examples:
  // `/foo` would allow `/foo`, `/foo/` and `/foo/bar`
  // `/foo` would not allow `/food` or `/etc/foo`

  // replias is the actual number of observed instances of the scaled object.
  optional int32 replicas = 1;

  // selector is a label query over pods that should match the replicas count. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
  // +optional
  map<string, string> selector = 2;

  // targetSelector is the label selector for pods that should match the replicas count. This is a serializated

  optional string kind = 1;

  // name is the name of the referent; More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
  optional string name = 2;

  // apiVersion is the API version of the referent
  // +optional
  optional string apiVersion = 3;
}

  optional string kind = 1;

  // name is the name of the referent; More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
  optional string name = 2;

  // apiVersion is the API version of the referent
  // +optional
  optional string apiVersion = 3;
}

  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is a list of ClusterRoles
  repeated ClusterRole items = 2;
}

// PolicyRule holds information that describes a policy rule, but does not contain information
// about who the rule applies to or which namespace the rule applies to.
message PolicyRule {
  // Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.

  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is a list of ClusterRoles
  repeated ClusterRole items = 2;
}

// PolicyRule holds information that describes a policy rule, but does not contain information
// about who the rule applies to or which namespace the rule applies to.
message PolicyRule {
  // Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.

  // See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for
  // details.
  //
  // Defaults to unset
  // +optional
  optional string resourceVersion = 1;
}

// GroupKind specifies a Group and a Kind, but does not force a version.  This is useful for identifying