// ObjectSelector decides whether to run the validation based on if the
  // object has matching labels. objectSelector is evaluated against both
  // the oldObject and newObject that would be sent to the cel validation, and
  // is considered to match if either object matches the selector. A null
  // object (oldObject in the case of create, or newObject in the case of

  // Status is filled in by the server with the user attributes.
  optional SelfSubjectReviewStatus status = 2;
}

// SelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.
message SelfSubjectReviewStatus {
  // User attributes of the user making this request.
  // +optional
  optional k8s.io.api.authentication.v1.UserInfo userInfo = 1;

  // `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
  // an API request to apps/v1beta1 deployments would be converted and sent to the webhook
  // with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),

  // In that case, the watch stream will begin with synthetic events to
  // produce the current state of objects in the collection. Once all such
  // events have been sent, a synthetic "Bookmark" event  will be sent.
  // The bookmark will report the ResourceVersion (RV) corresponding to the
  // set of objects, and be marked with `"k8s.io/initial-events-end": "true"` annotation.

  // ingress supports SNI.
  // +optional
  repeated IngressTLS tls = 2;

  // A list of host rules used to configure the Ingress. If unspecified, or
  // no rule matches, all traffic is sent to the default backend.
  // +optional
  repeated IngressRule rules = 3;
}

// IngressStatus describe the current state of the Ingress.
message IngressStatus {

  // If this value is nil, the default grace period will be used instead.
  // The grace period is the duration in seconds after the processes running in the carp are sent
  // a termination signal and the time when the processes are forcibly halted with a kill signal.
  // Set this value longer than the expected cleanup time for your process.
  // Defaults to 30 seconds.
  // +optional

  // the client source IP. (Traffic mistakenly sent to a node with no endpoints will
  // be dropped.) The default value, "Cluster", uses the standard behavior of
  // routing to all endpoints evenly (possibly modified by topology and other
  // features). Note that traffic sent to an External IP or LoadBalancer IP from

  // `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
  // an API request to apps/v1beta1 deployments would be converted and sent to the webhook
  // with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),

  // Status is filled in by the server with the user attributes.
  optional SelfSubjectReviewStatus status = 2;
}

// SelfSubjectReviewStatus is filled by the kube-apiserver and sent back to a user.
message SelfSubjectReviewStatus {
  // User attributes of the user making this request.
  // +optional
  optional k8s.io.api.authentication.v1.UserInfo userInfo = 1;
}

// Package-wide variables from generator "generated".
option go_package = "k8s.io/api/admissionregistration/v1beta1";

// MatchCondition represents a condition which must be fulfilled for a request to be sent to a webhook.
message MatchCondition {
  // Name is an identifier for this match condition, used for strategic merging of MatchConditions,