// +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time time = 1;

  // message represents the error encountered during Attach or Detach operation.
  // This string may be logged, so it should not contain sensitive
  // information.
  // +optional
  optional string message = 2;
}

// VolumeNodeResources is a set of resource limits for scheduling of volumes.
message VolumeNodeResources {

	mockIntercept := testDoAddRun(t, buildMockConf(true, ""), testNSName, pod, ns)

	if len(mockIntercept.lastRedirect) != 0 {
		t.Fatalf("Didnt Expect nsenterFunc to be called because this pod does not contain a sidecar")
	}
}

func TestCmdAddExcludePod(t *testing.T) {
	pod, ns := buildFakePodAndNSForClient()

	mockIntercept := testDoAddRun(t, buildMockConf(true, ""), "testExcludeNS", pod, ns)

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time time = 1;

  // message represents the error encountered during Attach or Detach operation.
  // This string may be logged, so it should not contain sensitive
  // information.
  // +optional
  optional string message = 2;
}

// VolumeNodeResources is a set of resource limits for scheduling of volumes.
message VolumeNodeResources {

  // If the signer cannot issue the certificate, a condition of type "Failed" is added and this field remains empty.
  //
  // Validation requirements:
  //  1. certificate must contain one or more PEM blocks.
  //  2. All PEM blocks must have the "CERTIFICATE" label, contain no headers, and the encoded data
  //   must be a BER-encoded ASN.1 Certificate structure as described in section 4 of RFC5280.

  // If this field is not specified, it will default based on the existence of Ingress or Egress rules;
  // policies that contain an Egress section are assumed to affect Egress, and all policies
  // (whether or not they contain an Ingress section) are assumed to affect Ingress.
  // If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ].

option go_package = "k8s.io/api/apps/v1";

// ControllerRevision implements an immutable snapshot of state data. Clients
// are responsible for serializing and deserializing the objects that contain
// their internal state.
// Once a ControllerRevision has been successfully created, it can not be updated.
// The API Server will fail validation of all requests that attempt to mutate

  // line breaks. The message must not contain line breaks.
  // If unset, the message is "failed rule: {Rule}".
  // e.g. "must be a URL with the host matching spec.host"
  // If the Expression contains line breaks. Message is required.
  // The message must not contain line breaks.
  // If unset, the message is "failed Expression: {Expression}".
  // +optional

	var containerID string
	for _, cgroup := range cgroups {
		candidatePodUID, candidateContainerID, ok := getPodUIDAndContainerIDFromCGroupPath(cgroup.GroupPath)
		switch {
		case !ok:
			// Cgroup did not contain a container ID.
			continue
		case containerID == "":
			// This is the first container ID found so far.
			podUID = candidatePodUID
			containerID = candidateContainerID
		case containerID != candidateContainerID:

	overlay, err := util.OverlayYAML(gotValStr, subsetValStr)
	if err != nil {
		return false, err
	}
	if overlay != gotValStr {
		return false, fmt.Errorf("actual value:\n\n%s\ndoesn't contain expected subset:\n\n%s", gotValStr, subsetValStr)
	}
	return true, nil
}

// FailureMessage implements the Matcher interface.
func (m *HavePathValueContainMatcher) FailureMessage(actual any) string {

  // minimum desired number of healthy pods
  optional int32 desiredHealthy = 5;

  // total number of pods counted by this disruption budget
  optional int32 expectedPods = 6;

  // Conditions contain conditions for PDB. The disruption controller sets the
  // DisruptionAllowed condition. The following are known values for the reason field
  // (additional reasons could be added in the future):