// traffic only if the traffic matches at least one port in the list.
  // +optional
  repeated NetworkPolicyPort ports = 1;

  // from is a list of sources which should be able to access the pods selected for this rule.
  // Items in this list are combined using a logical OR operation. If this field is
  // empty or missing, this rule matches all sources (traffic not restricted by

  // if the object being admitted is modified by other admission plugins after the initial webhook call.
  // Webhooks that specify this option *must* be idempotent, able to process objects they previously admitted.
  // Note:
  // * the number of additional invocations is not guaranteed to be exactly one.

  // DisruptionAllowed condition. The following are known values for the reason field
  // (additional reasons could be added in the future):
  // - SyncFailed: The controller encountered an error and wasn't able to compute
  //               the number of allowed disruptions. Therefore no disruptions are
  //               allowed and the status of the condition will be False.

  // for updates. During a rolling update, all pods from ordinal Replicas-1 to
  // Partition are updated. All pods from ordinal Partition-1 to 0 remain untouched.
  // This is helpful in being able to do a canary based deployment. The default value is 0.
  optional int32 partition = 1;

  // maxUnavailable is the maximum number of pods that can be unavailable during the update.

  // +k8s:conversion-gen=false
  // +optional
  optional bool hostIPC = 13;

  // Share a single process namespace between all of the containers in a pod.
  // When this is set containers will be able to view and signal processes from other containers
  // in the same pod, and the first process in each container will not be assigned PID 1.
  // HostPID and ShareProcessNamespace cannot both be set.