// on whether the namespace for that object matches the selector. If the
  // object itself is a namespace, the matching is performed on
  // object.metadata.labels. If the object is another cluster scoped resource,
  // it never skips the webhook.
  //
  // For example, to run the webhook on any objects whose namespace is not
  // associated with "runlevel" of "0" or "1";  you will set the selector as
  // follows:
  // "namespaceSelector": {

// RuntimeClass.
message Scheduling {
  // nodeSelector lists labels that must be present on nodes that support this
  // RuntimeClass. Pods using this RuntimeClass can only be scheduled to a
  // node matched by this selector. The RuntimeClass nodeSelector is merged
  // with a pod's existing nodeSelector. Any conflicts will cause the pod to
  // be rejected in admission.
  // +optional
  // +mapType=atomic
  map<string, string> nodeSelector = 1;

// RuntimeClass.
message Scheduling {
  // nodeSelector lists labels that must be present on nodes that support this
  // RuntimeClass. Pods using this RuntimeClass can only be scheduled to a
  // node matched by this selector. The RuntimeClass nodeSelector is merged
  // with a pod's existing nodeSelector. Any conflicts will cause the pod to
  // be rejected in admission.
  // +optional
  // +mapType=atomic

  // +optional
  repeated string groups = 4;

  // Extra corresponds to the user.Info.GetExtra() method from the authenticator.  Since that is input to the authorizer
  // it needs a reflection here.
  // +optional
  map<string, ExtraValue> extra = 5;

  // UID information about the requesting user.
  // +optional
  optional string uid = 6;
}

// SubjectAccessReviewStatus

  // distinguish between parameters stored here and and those stored in
  // ResourceClaimSpec.
  // +optional
  optional ResourceClassParametersReference parametersRef = 3;

  // Only nodes matching the selector will be considered by the scheduler
  // when trying to find a Node that fits a Pod when that Pod uses
  // a ResourceClaim that has not been allocated yet.
  //

  // matchExpressions is a list of label selector requirements. The requirements are ANDed.
  // +optional
  repeated LabelSelectorRequirement matchExpressions = 2;
}

// A label selector requirement is a selector that contains values, a key, and an operator that
// relates the key and values.
message LabelSelectorRequirement {
  // key is the label key that the selector applies to.
  // +patchMergeKey=key

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 1;

  // An object that describes the pod that will be created.
  // The DaemonSet will create exactly one copy of this pod on every node
  // that matches the template's node selector (or on every node if no node
  // selector is specified).

  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 1;

  // An object that describes the pod that will be created.
  // The DaemonSet will create exactly one copy of this pod on every node
  // that matches the template's node selector (or on every node if no node
  // selector is specified).
  // The only allowed template.spec.restartPolicy value is "Always".

  // +optional
  optional k8s.io.api.core.v1.ObjectReference regarding = 8;

  // related is the optional secondary object for more complex actions. E.g. when regarding object triggers
  // a creation or deletion of related object.
  // +optional
  optional k8s.io.api.core.v1.ObjectReference related = 9;

  // note is a human-readable description of the status of this operation.

  // +optional
  repeated string group = 4;

  // Extra corresponds to the user.Info.GetExtra() method from the authenticator.  Since that is input to the authorizer
  // it needs a reflection here.
  // +optional
  map<string, ExtraValue> extra = 5;

  // UID information about the requesting user.
  // +optional
  optional string uid = 6;
}

// SubjectAccessReviewStatus