// with a pod's existing nodeSelector. Any conflicts will cause the pod to
  // be rejected in admission.
  // +optional
  // +mapType=atomic
  map<string, string> nodeSelector = 1;

  // tolerations are appended (excluding duplicates) to pods running with this
  // RuntimeClass during admission, effectively unioning the set of nodes
  // tolerated by the pod and the RuntimeClass.
  // +optional

  // with a pod's existing nodeSelector. Any conflicts will cause the pod to
  // be rejected in admission.
  // +optional
  // +mapType=atomic
  map<string, string> nodeSelector = 1;

  // tolerations are appended (excluding duplicates) to pods running with this
  // RuntimeClass during admission, effectively unioning the set of nodes
  // tolerated by the pod and the RuntimeClass.
  // +optional

  - k8s.io/klog
  - k8s.io/utils

- baseImportPath: "./staging/src/k8s.io/pod-security-admission"
  allowedImports:
  - k8s.io/api
  - k8s.io/apimachinery
  - k8s.io/apiserver/pkg/admission
  - k8s.io/apiserver/pkg/server
  - k8s.io/client-go
  - k8s.io/component-base
  - k8s.io/klog
  - k8s.io/pod-security-admission
  - k8s.io/utils

- baseImportPath: "./staging/src/k8s.io/kms"
  allowedImports:

limitations under the License.
*/

package validating

import (
	"k8s.io/api/admissionregistration/v1"
	"k8s.io/apimachinery/pkg/types"
	"k8s.io/apiserver/pkg/admission/plugin/policy/generic"
)

func NewValidatingAdmissionPolicyAccessor(obj *v1.ValidatingAdmissionPolicy) generic.PolicyAccessor {
	return &validatingAdmissionPolicyAccessor{
		ValidatingAdmissionPolicy: obj,
	}
}

  // with a pod's existing nodeSelector. Any conflicts will cause the pod to
  // be rejected in admission.
  // +optional
  // +mapType=atomic
  map<string, string> nodeSelector = 1;

  // tolerations are appended (excluding duplicates) to pods running with this
  // RuntimeClass during admission, effectively unioning the set of nodes
  // tolerated by the pod and the RuntimeClass.
  // +optional

  // with a pod's existing nodeSelector. Any conflicts will cause the pod to
  // be rejected in admission.
  // +optional
  // +mapType=atomic
  map<string, string> nodeSelector = 1;

  // tolerations are appended (excluding duplicates) to pods running with this
  // RuntimeClass during admission, effectively unioning the set of nodes
  // tolerated by the pod and the RuntimeClass.
  // +optional

	// with a pod's existing nodeSelector. Any conflicts will cause the pod to
	// be rejected in admission.
	// +optional
	// +mapType=atomic
	NodeSelector map[string]string `json:"nodeSelector,omitempty" protobuf:"bytes,1,opt,name=nodeSelector"`

	// tolerations are appended (excluding duplicates) to pods running with this
	// RuntimeClass during admission, effectively unioning the set of nodes
	// tolerated by the pod and the RuntimeClass.

	./staging/src/k8s.io/kube-scheduler
	./staging/src/k8s.io/kubectl
	./staging/src/k8s.io/kubelet
	./staging/src/k8s.io/metrics
	./staging/src/k8s.io/mount-utils
	./staging/src/k8s.io/pod-security-admission
	./staging/src/k8s.io/sample-apiserver
	./staging/src/k8s.io/sample-cli-plugin
	./staging/src/k8s.io/sample-controller

		"--authentication-kubeconfig", fakeKubeConfig.Name(),
		"--authorization-kubeconfig", fakeKubeConfig.Name(),
		"--kubeconfig", fakeKubeConfig.Name(),
		// disable admission and filters that require talking to kube-apiserver
		"--enable-priority-and-fairness=false",
		"--disable-admission-plugins", "NamespaceLifecycle,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ValidatingAdmissionPolicy"},
		flags...,
	), nil)
	if err != nil {

	"k8s.io/api/admissionregistration/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"
	"k8s.io/apimachinery/pkg/types"
	"k8s.io/apiserver/pkg/admission/plugin/policy/generic"
	"k8s.io/apiserver/pkg/admission/plugin/policy/matching"
	"k8s.io/apiserver/pkg/authorization/authorizer"
	"k8s.io/client-go/tools/cache"
)