// on its own node object.
  // When Kubernetes does topology aware provisioning, it can use this list to
  // determine which labels it should retrieve from the node object and pass
  // back to the driver.
  // It is possible for different nodes to use different topology keys.
  // This can be empty if driver does not support topology.
  // +optional
  repeated string topologyKeys = 3;

  // `$(job-name)-$(index)-$(random-string)`,
  // the Pod hostname takes the form `$(job-name)-$(index)`.
  //
  // More completion modes can be added in the future.
  // If the Job controller observes a mode that it doesn't recognize, which
  // is possible during upgrades due to version skew, the controller
  // skips updates for the Job.
  // +optional
  optional string completionMode = 9;

  // only if either (a) this list contains that target namespace or
  // (b) this list contains "*".  Note that "*" matches any
  // specified namespace but does not match a request that _does
  // not specify_ a namespace (see the `clusterScope` field for
  // that).
  // This list may be empty, but only if `clusterScope` is true.
  // +optional
  // +listType=set

  // only if either (a) this list contains that target namespace or
  // (b) this list contains "*".  Note that "*" matches any
  // specified namespace but does not match a request that _does
  // not specify_ a namespace (see the `clusterScope` field for
  // that).
  // This list may be empty, but only if `clusterScope` is true.
  // +optional
  // +listType=set

  //   request path. Note that if the last element of the path is a substring
  //   of the last element in request path, it is not a match (e.g. /foo/bar
  //   matches /foo/bar/baz, but does not match /foo/barbaz).
  // * ImplementationSpecific: Interpretation of the Path matching is up to
  //   the IngressClass. Implementations can treat this as a separate PathType

  // the list which it supports. If none of the versions specified in this list
  // supported by API server, validation will fail for this object.
  // If a persisted webhook configuration specifies allowed versions and does not
  // include any versions known to the API Server, calls to the webhook will fail
  // and be subject to the failure policy.
  repeated string admissionReviewVersions = 8;

message ValidatingAdmissionPolicyBindingSpec {
  // PolicyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
  // If the referenced resource does not exist, this binding is considered invalid and will be ignored
  // Required.
  optional string policyName = 1;

  // ParamRef specifies the parameter resource used to configure the admission control policy.

  // only if either (a) this list contains that target namespace or
  // (b) this list contains "*".  Note that "*" matches any
  // specified namespace but does not match a request that _does
  // not specify_ a namespace (see the `clusterScope` field for
  // that).
  // This list may be empty, but only if `clusterScope` is true.
  // +optional
  // +listType=set

  // only if either (a) this list contains that target namespace or
  // (b) this list contains "*".  Note that "*" matches any
  // specified namespace but does not match a request that _does
  // not specify_ a namespace (see the `clusterScope` field for
  // that).
  // This list may be empty, but only if `clusterScope` is true.
  // +optional
  // +listType=set

// for pods to use. It requires the path prefix to be defined.
message AllowedHostPath {
  // pathPrefix is the path prefix that the host volume must match.
  // It does not support `*`.
  // Trailing slashes are trimmed when validating the path prefix with a host path.
  //
  // Examples:
  // `/foo` would allow `/foo`, `/foo/` and `/foo/bar`
  // `/foo` would not allow `/food` or `/etc/foo`