// 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
  // 9999-12-31T23:59:59Z inclusive.
  optional int64 seconds = 1;

  // Non-negative fractions of a second at nanosecond resolution. Negative
  // second values with fractions must still have non-negative nanos values
  // that count forward in time. Must be from 0 to 999,999,999
  // inclusive. This field may be limited in precision depending on context.
  optional int32 nanos = 2;

  // +optional
  optional k8s.io.apimachinery.pkg.util.intstr.IntOrString port = 2;

  // If set, indicates that the range of ports from port to endPort, inclusive,
  // should be allowed by the policy. This field cannot be defined if the port field
  // is not defined or if the port field is defined as a named (string) port.
  // The endPort must be equal or greater than port.

message HostPortRange {
  // min is the start of the range, inclusive.
  optional int32 min = 1;

  // max is the end of the range, inclusive.
  optional int32 max = 2;
}

// IDRange provides a min/max of an allowed range of IDs.
message IDRange {
  // min is the start of the range, inclusive.
  optional int64 min = 1;

  // max is the end of the range, inclusive.
  optional int64 max = 2;
}

  // +optional
  optional string path = 3;

  // If specified, the port on the service that hosting webhook.
  // Default to 443 for backward compatibility.
  // `port` should be a valid port number (1-65535, inclusive).
  // +optional
  optional int32 port = 4;
}

// ValidatingWebhook describes an admission webhook and the resources and operations it applies to.
message ValidatingWebhook {

  //
  // A "Failed" condition is added via the /status subresource,
  // indicating the signer failed to issue the certificate.
  //
  // Approved and Denied conditions are mutually exclusive.
  // Approved, Denied, and Failed conditions cannot be removed once added.
  //
  // Only one condition of a given type is allowed.
  optional string type = 1;

  // status of the condition, one of True, False, Unknown.

  optional LimitResponse limitResponse = 2;

  // `lendablePercent` prescribes the fraction of the level's NominalCL that
  // can be borrowed by other priority levels. The value of this
  // field must be between 0 and 100, inclusive, and it defaults to 0.
  // The number of seats that other levels can borrow from this level, known
  // as this level's LendableConcurrencyLimit (LendableCL), is defined as follows.
  //

  optional LimitResponse limitResponse = 2;

  // `lendablePercent` prescribes the fraction of the level's NominalCL that
  // can be borrowed by other priority levels. The value of this
  // field must be between 0 and 100, inclusive, and it defaults to 0.
  // The number of seats that other levels can borrow from this level, known
  // as this level's LendableConcurrencyLimit (LendableCL), is defined as follows.
  //

  // This is a mutually exclusive setting with "Resource".
  // +optional
  optional IngressServiceBackend service = 4;

  // resource is an ObjectRef to another Kubernetes resource in the namespace
  // of the Ingress object. If resource is specified, a service.Name and
  // service.Port must not be specified.
  // This is a mutually exclusive setting with "Service".
  // +optional

  // +optional
  optional string path = 3;

  // If specified, the port on the service that hosting webhook.
  // Default to 443 for backward compatibility.
  // `port` should be a valid port number (1-65535, inclusive).
  // +optional
  optional int32 port = 4;
}

// ValidatingWebhook describes an admission webhook and the resources and operations it applies to.
message ValidatingWebhook {

  optional LimitResponse limitResponse = 2;

  // `lendablePercent` prescribes the fraction of the level's NominalCL that
  // can be borrowed by other priority levels. The value of this
  // field must be between 0 and 100, inclusive, and it defaults to 0.
  // The number of seats that other levels can borrow from this level, known
  // as this level's LendableConcurrencyLimit (LendableCL), is defined as follows.
  //