// "{ValidatingAdmissionPolicy name}/{key}".
  //
  // If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy
  // and the same audit annotation key, the annotation key will be identical.
  // In this case, the first annotation written with the key will be included
  // in the audit event and all subsequent annotations with the same key
  // will be discarded.
  //
  // Required.

message AdmissionRequest {
  // UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
  // otherwise identical (parallel requests, requests when earlier requests did not modify etc)
  // The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.

  // consistent list may not be possible if the server configuration has changed or more than a few
  // minutes have passed. The resourceVersion field returned when using this continue value will be
  // identical to the value in the first response, unless you have received this token from an error
  // message.
  optional string continue = 3;

  // behavior is being explicitly overridden, for example when the associated
  // Service has set the publishNotReadyAddresses flag.
  // +optional
  optional bool ready = 1;

  // serving is identical to ready except that it is set regardless of the
  // terminating state of endpoints. This condition should be set to true for
  // a ready endpoint that is terminating. If nil, consumers should defer to
  // the ready condition.

// projected volume as files using the keys in the Data field as the file names,
// unless the items element is populated with specific mappings of keys to paths.
// Note that this is identical to a configmap volume source without the default
// mode.
message ConfigMapProjection {
  optional LocalObjectReference localObjectReference = 1;

message AdmissionRequest {
  // UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
  // otherwise identical (parallel requests, requests when earlier requests did not modify etc)
  // The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.

  // unknown state as ready. For compatibility reasons, ready should never be
  // "true" for terminating endpoints.
  // +optional
  optional bool ready = 1;

  // serving is identical to ready except that it is set regardless of the
  // terminating state of endpoints. This condition should be set to true for
  // a ready endpoint that is terminating. If nil, consumers should defer to
  // the ready condition.