// `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
  // an API request to apps/v1beta1 deployments would be converted and sent to the webhook
  // with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),

  // +optional
  optional k8s.io.api.authentication.v1.UserInfo userInfo = 1;
}

// TokenReview attempts to authenticate a token to a known user.
// Note: TokenReview requests may be cached by the webhook token authenticator
// plugin in the kube-apiserver.
message TokenReview {
  // Standard object's metadata.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

  //
  // Required.
  optional string expression = 2;
}

// MutatingWebhook describes an admission webhook and the resources and operations it applies to.
message MutatingWebhook {
  // The name of the admission webhook.
  // Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
  // "imagepolicy" is the name of the webhook, and kubernetes.io is the name
  // of the organization.
  // Required.
  optional string name = 1;

10.244.0.156:6443                                HEALTHY                  outbound|443||cert-manager-istio-csr.cert-manager.svc.cluster.local
10.244.0.139:10250                               HEALTHY                  outbound|443||cert-manager-webhook.cert-manager.svc.cluster.local
10.244.0.142:9402                                HEALTHY                  outbound|9402||cert-manager.cert-manager.svc.cluster.local

  //
  // Required.
  optional string expression = 2;
}

// MutatingWebhook describes an admission webhook and the resources and operations it applies to.
message MutatingWebhook {
  // The name of the admission webhook.
  // Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
  // "imagepolicy" is the name of the webhook, and kubernetes.io is the name
  // of the organization.
  // Required.
  optional string name = 1;

  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time expirationTimestamp = 2;
}

// TokenReview attempts to authenticate a token to a known user.
// Note: TokenReview requests may be cached by the webhook token authenticator
// plugin in the kube-apiserver.
message TokenReview {
  // Standard object's metadata.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

  // `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
  // an API request to apps/v1beta1 deployments would be converted and sent to the webhook
  // with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),

  // GMSACredentialSpecName is the name of the GMSA credential spec to use.
  // +optional
  optional string gmsaCredentialSpecName = 1;

  // GMSACredentialSpec is where the GMSA admission webhook
  // (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the
  // GMSA credential spec named by the GMSACredentialSpecName field.
  // +optional
  optional string gmsaCredentialSpec = 2;

    end
    mcsc("Multicluster Secret")
    scr("Credentials Controller")
    mcsc--"1 per cluster"-->scr
    mcsc--"1 per cluster"-->ksd
    crd--Depends-->ccs

    iwhc("Injection Webhook")
    vwhc("Validation Webhook")
    nsc("Namespace Controller")
    ksd--"External Istiod"-->nsc
    ksd--"External Istiod"-->iwhc

    df("Discovery Filter")

    axc("Auto Export Controller")

  // Annotations is a list of key-value pairs extracted from the Pod's annotations.
  // It only includes keys which match the pattern `*.image-policy.k8s.io/*`.
  // It is up to each webhook backend to determine how to interpret these annotations, if at all.
  // +optional
  map<string, string> annotations = 2;

  // Namespace is the namespace the pod is being created in.
  // +optional