//
  // failurePolicy does not define how validations that evaluate to false are handled.
  //
  // When failurePolicy is set to Fail, ValidatingAdmissionPolicyBinding validationActions
  // define how failures are enforced.
  //
  // Allowed values are Ignore or Fail. Defaults to Fail.
  // +optional
  optional string failurePolicy = 4;

  // auditAnnotations contains CEL expressions which are used to produce audit

// are responsible for serializing and deserializing the objects that contain
// their internal state.
// Once a ControllerRevision has been successfully created, it can not be updated.
// The API Server will fail validation of all requests that attempt to mutate
// the Data field. ControllerRevisions may, however, be deleted. Note that, due to its use by both

  // the list which it supports. If none of the versions specified in this list
  // supported by API server, validation will fail for this object.
  // If a persisted webhook configuration specifies allowed versions and does not
  // include any versions known to the API Server, calls to the webhook will fail
  // and be subject to the failure policy.
  // Default to `['v1beta1']`.
  // +optional

  // specified, in-range, and not in use it will be used, otherwise the
  // operation will fail.  If not specified, a port will be allocated if this
  // Service requires one.  If this field is specified when creating a
  // Service which does not need it, creation will fail. This field will be
  // wiped when updating a Service to no longer need it (e.g. changing type
  // from NodePort to ClusterIP).

  optional string reclaimPolicy = 4;

  // mountOptions controls the mountOptions for dynamically provisioned PersistentVolumes of this storage class.
  // e.g. ["ro", "soft"]. Not validated -
  // mount of the PVs will simply fail if one is invalid.
  // +optional
  repeated string mountOptions = 5;

  // allowVolumeExpansion shows whether the storage class allow volume expand.
  // +optional
  optional bool allowVolumeExpansion = 6;

  repeated RuleWithOperations rules = 3;

  // FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
  // allowed values are Ignore or Fail. Defaults to Fail.
  // +optional
  optional string failurePolicy = 4;

  // matchPolicy defines how the "rules" list is used to match incoming requests.
  // Allowed values are "Exact" or "Equivalent".
  //

  // for each duplicate field that is encountered. The request will
  // still succeed if there are no other errors, and will only persist
  // the last of any duplicate fields. This is the default in v1.23+
  // - Strict: This will fail the request with a BadRequest error if
  // any unknown fields would be dropped from the object, or if any
  // duplicate fields are present. The error returned from the server

// are responsible for serializing and deserializing the objects that contain
// their internal state.
// Once a ControllerRevision has been successfully created, it can not be updated.
// The API Server will fail validation of all requests that attempt to mutate
// the Data field. ControllerRevisions may, however, be deleted. Note that, due to its use by both

// are responsible for serializing and deserializing the objects that contain
// their internal state.
// Once a ControllerRevision has been successfully created, it can not be updated.
// The API Server will fail validation of all requests that attempt to mutate
// the Data field. ControllerRevisions may, however, be deleted. Note that, due to its use by both

  // pod is immediatedly created on that node without considering surge limits.
  // Allowing surge implies the possibility that the resources consumed by the
  // daemonset on any given node can double if the readiness check fails, and
  // so resource intensive daemonsets should take into account that they may
  // cause evictions during disruption.
  // This is an alpha field and requires enabling DaemonSetUpdateSurge feature gate.
  // +optional