// Some pod and container fields are restricted if this is set.
  //
  // If the OS field is set to linux, the following fields must be unset:
  // -securityContext.windowsOptions
  //
  // If the OS field is set to windows, following fields must be unset:
  // - spec.hostPID
  // - spec.hostIPC
  // - spec.hostUsers
  // - spec.securityContext.seLinuxOptions
  // - spec.securityContext.seccompProfile

	if after != nil && after.Spec.ClusterIP != api.ClusterIPNone {
		if after.Spec.ClusterIP != "" {
			t.Errorf("%s: expected clusterIP to be unset: %q", callName(before, after), after.Spec.ClusterIP)
		}
		if len(after.Spec.ClusterIPs) != 0 {
			t.Errorf("%s: expected clusterIPs to be unset: %q", callName(before, after), after.Spec.ClusterIPs)
		}
	}

	if before != nil && before.Spec.ClusterIP != api.ClusterIPNone {

                  time load balancer when BPFLogLevel is debug. Currently has to be
                  specified as ''all'' when BPFLogFilters is set to see CTLB logs.
                  [Default: unset - means logs are emitted when BPFLogLevel id debug
                  and BPFLogFilters not set.]'
                type: string
              bpfConnectTimeLoadBalancing:

					Type:      "object",
					XListType: strPtr("set"),
				},
			},
			expectedErrors: []validationMatch{
				invalid("spec.validation.openAPIV3Schema.type"),
			},
		},
		{
			name: "unset type with list type extension set",
			input: apiextensions.CustomResourceValidation{
				OpenAPIV3Schema: &apiextensions.JSONSchemaProps{
					XListType: strPtr("set"),
				},
			},

					}
				}

				if source.ClusterTrustBundle.LabelSelector != nil {
					allErrs = append(allErrs, field.Invalid(projPath.Child("labelSelector"), source.ClusterTrustBundle.LabelSelector, "labelSelector must be unset if name is specified"))
				}
			case usingSignerName:
				if *source.ClusterTrustBundle.SignerName == "" {
					allErrs = append(allErrs, field.Required(projPath.Child("signerName"), "must be a valid signer name"))

* The `emptyDir.sizeLimit` field is now correctly omitted from API requests and responses when unset. ([#50163](https://github.com/kubernetes/kubernetes/pull/50163), [@jingxu97](https://github.com/jingxu97))

	// The container image tag to pull. Image will be `Hub/Image:Tag-Variant`.
	Tag *structpb.Value `protobuf:"bytes,3,opt,name=tag,proto3" json:"tag,omitempty"`
	// The container image variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
	Variant string `protobuf:"bytes,29,opt,name=variant,proto3" json:"variant,omitempty"`
	// Image name to pull from. Image will be `Hub/Image:Tag-Variant`.

- Added audienceMatchPolicy field to AuthenticationConfiguration and support for configuring multiple audiences.
  The "audienceMatchPolicy" can be empty (or unset) when a single audience is specified in the "audiences" field.

n.valid=n.x!==void 0&&n.y!==void 0,n})}function Tu(i){return i.map(e=>e.valid?[e.keyword,e.x,e.y,e.blur,e.spread,e.color].filter(Boolean).join(" "):e.raw).join(", ")}var Tb,Pb,Eu,ns=C(()=>{l();St();Tb=new Set(["inset","inherit","initial","revert","unset"]),Pb=/\ +(?![^(]*\))/g,Eu=/^-?(\d+|\.\d+)(.*?)$/g});function ss(i){return Db.some(e=>new RegExp(`^${e}\\(.*\\)`).test(i))}function L(i,e=null,t=!0){let r=e&&Ib.has(e.property);return i.startsWith("--")&&!r?`var(${i})`:i.includes("url(")?i.split(/...

                  namespace:
                    description: Namespace is the namespace of the referent. This
                      field is required when referring to a Namespace-scoped resource
                      and MUST be unset when referring to a Cluster-scoped resource.
                    maxLength: 63
                    minLength: 1
                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                    type: string