// For example:
  //   - "/healthz" is legal
  //   - "/hea*" is illegal
  //   - "/hea" is legal but matches nothing
  //   - "/hea/*" also matches nothing
  //   - "/healthz/*" matches all per-component health checks.
  // "*" matches all non-resource urls. if it is present, it must be the only entry.
  // +listType=set
  // Required.
  repeated string nonResourceURLs = 6;
}

  // For example:
  //   - "/healthz" is legal
  //   - "/hea*" is illegal
  //   - "/hea" is legal but matches nothing
  //   - "/hea/*" also matches nothing
  //   - "/healthz/*" matches all per-component health checks.
  // "*" matches all non-resource urls. if it is present, it must be the only entry.
  // +listType=set
  // Required.
  repeated string nonResourceURLs = 6;
}

  // `service` or `url` must be specified.
  //
  // If the webhook is running within the cluster, then you should use `service`.
  //
  // +optional
  optional ServiceReference service = 1;

  // `caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
  // If unspecified, system trust roots on the apiserver are used.
  // +optional
  optional bytes caBundle = 2;