// AllowedHostPath defines the host volume conditions that will be enabled by a policy
// for pods to use. It requires the path prefix to be defined.
message AllowedHostPath {
  // pathPrefix is the path prefix that the host volume must match.
  // It does not support `*`.
  // Trailing slashes are trimmed when validating the path prefix with a host path.
  //
  // Examples:
  // `/foo` would allow `/foo`, `/foo/` and `/foo/bar`

  optional string path = 1;

  // PathType determines the interpretation of the Path matching. PathType can
  // be one of the following values:
  // * Exact: Matches the URL path exactly.
  // * Prefix: Matches based on a URL path prefix split by '/'. Matching is
  //   done on a path element by element basis. A path element refers is the
  //   list of labels in the path split by the '/' separator. A request is a

}

// APIResourceDiscovery provides information about an API resource for discovery.
message APIResourceDiscovery {
  // resource is the plural name of the resource.  This is used in the URL path and is the unique identifier
  // for this resource across all versions in the API group.

  //
  // Required.
  optional string valueExpression = 2;
}

// ExpressionWarning is a warning information that targets a specific expression.
message ExpressionWarning {
  // The path to the field that refers the expression.
  // For example, the reference to the expression of the first item of
  // validations is "spec.validations[0].expression"
  optional string fieldRef = 2;

}

// NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface
message NonResourceAttributes {
  // Path is the URL path of the request
  // +optional
  optional string path = 1;

  // Verb is the standard HTTP verb
  // +optional
  optional string verb = 2;
}

// NonResourceRule holds information that describes a rule for the non-resource

  // +optional
  optional string path = 1;

  // pathType determines the interpretation of the path matching. PathType can
  // be one of the following values:
  // * Exact: Matches the URL path exactly.
  // * Prefix: Matches based on a URL path prefix split by '/'. Matching is
  //   done on a path element by element basis. A path element refers is the
  //   list of labels in the path split by the '/' separator. A request is a

  // Specifies the target ResourceVersion
  // +optional
  optional string resourceVersion = 2;
}

// RootPaths lists the paths available at root.
// For example: "/healthz", "/apis".
message RootPaths {
  // paths are the paths available at root.
  repeated string paths = 1;
}

}

// NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface
message NonResourceAttributes {
  // Path is the URL path of the request
  // +optional
  optional string path = 1;

  // Verb is the standard HTTP verb
  // +optional
  optional string verb = 2;
}

// NonResourceRule holds information that describes a rule for the non-resource

  // Required
  optional string namespace = 1;

  // `name` is the name of the service.
  // Required
  optional string name = 2;

  // `path` is an optional URL path which will be sent in any request to
  // this service.
  // +optional
  optional string path = 3;

  // If specified, the port on the service that hosting webhook.
  // Default to 443 for backward compatibility.

  // +optional
  optional string path = 1;

  // pathType determines the interpretation of the path matching. PathType can
  // be one of the following values:
  // * Exact: Matches the URL path exactly.
  // * Prefix: Matches based on a URL path prefix split by '/'. Matching is
  //   done on a path element by element basis. A path element refers is the
  //   list of labels in the path split by the '/' separator. A request is a