// +optional
  optional string reason = 2;

  // AuditAnnotations will be added to the attributes object of the
  // admission controller request using 'AddAnnotation'.  The keys should
  // be prefix-less (i.e., the admission controller will add an
  // appropriate prefix).
  // +optional
  map<string, string> auditAnnotations = 3;

	"github.com/google/cel-go/common/types"
	"github.com/google/cel-go/common/types/ref"
	"github.com/google/cel-go/common/types/traits"

	v1 "k8s.io/api/admission/v1"
	corev1 "k8s.io/api/core/v1"
	"k8s.io/apimachinery/pkg/util/version"
	"k8s.io/apiserver/pkg/admission"
	apiservercel "k8s.io/apiserver/pkg/cel"
	"k8s.io/apiserver/pkg/cel/environment"
	"k8s.io/apiserver/pkg/cel/lazy"
)

    --bind-address="127.0.0.1" \
    --authorization-mode="${AUTHORIZATION_MODE}" \
    --secure-port="${SECURE_API_PORT}" \
    --feature-gates="${ENABLE_FEATURE_GATES}" \
    --enable-admission-plugins="${ENABLE_ADMISSION_PLUGINS}" \
    --disable-admission-plugins="${DISABLE_ADMISSION_PLUGINS}" \
    --etcd-servers="http://${ETCD_HOST}:${ETCD_PORT}" \
    --runtime-config=api/v1 \
    --service-account-key-file="${SERVICE_ACCOUNT_KEY}" \

# The original version of this file is located at /manifests/helm-profiles directory.
# If you want to make a change in this file, edit the original one and run "make gen".

# The stable profile deploys admission control to ensure that only stable resources and fields are used
# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
experimental:

# The original version of this file is located at /manifests/helm-profiles directory.
# If you want to make a change in this file, edit the original one and run "make gen".

# The stable profile deploys admission control to ensure that only stable resources and fields are used
# THIS IS CURRENTLY EXPERIMENTAL AND SUBJECT TO CHANGE
experimental:

See the License for the specific language governing permissions and
limitations under the License.
*/

package api

import (
	"math/rand"
	"testing"

	admissionv1 "k8s.io/api/admission/v1"
	admissionv1beta1 "k8s.io/api/admission/v1beta1"
	admissionregv1 "k8s.io/api/admissionregistration/v1"
	admissionregv1alpha1 "k8s.io/api/admissionregistration/v1alpha1"
	admissionregv1beta1 "k8s.io/api/admissionregistration/v1beta1"

# groups_without_codegen is the list of group we EXPECT to not have the client generated for
# them.  This happens for types that aren't served from the API server
groups_without_codegen=(
	"abac"
	"imagepolicy"
	"admission"
)
client_gen_file="${KUBE_ROOT}/staging/src/k8s.io/code-generator/cmd/client-gen/main.go"

for group_dirname in "${group_dirnames[@]}"; do
	if ! grep -q "${group_dirname}/" "${client_gen_file}" ; then
		found=0

  // with a pod's existing nodeSelector. Any conflicts will cause the pod to
  // be rejected in admission.
  // +optional
  // +mapType=atomic
  map<string, string> nodeSelector = 1;

  // tolerations are appended (excluding duplicates) to pods running with this
  // RuntimeClass during admission, effectively unioning the set of nodes
  // tolerated by the pod and the RuntimeClass.
  // +optional

  // with a pod's existing nodeSelector. Any conflicts will cause the pod to
  // be rejected in admission.
  // +optional
  // +mapType=atomic
  map<string, string> nodeSelector = 1;

  // tolerations are appended (excluding duplicates) to pods running with this
  // RuntimeClass during admission, effectively unioning the set of nodes
  // tolerated by the pod and the RuntimeClass.
  // +optional

	"k8s.io/apimachinery/pkg/runtime/schema"
	utilerrors "k8s.io/apimachinery/pkg/util/errors"
	"k8s.io/apimachinery/pkg/util/managedfields"
	"k8s.io/apimachinery/pkg/util/sets"
	"k8s.io/apiserver/pkg/admission"
	"k8s.io/apiserver/pkg/authorization/authorizer"
	"k8s.io/apiserver/pkg/endpoints/discovery"
	"k8s.io/apiserver/pkg/registry/rest"
	"k8s.io/apiserver/pkg/storageversion"
)