// for more examples of label selectors.
  //
  // Default to the empty LabelSelector, which matches everything.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector namespaceSelector = 5;

  // ObjectSelector decides whether to run the webhook based on if the
  // object has matching labels. objectSelector is evaluated against both

  // When false or unset, the system pick labels unique to this job
  // and appends those labels to the pod template.  When true,
  // the user is responsible for picking unique labels and specifying
  // the selector.  Failure to pick a unique label may cause this
  // and other jobs to not function correctly.  However, You may see
  // `manualSelector=true` in jobs that were created with the old `extensions/v1beta1`

  //   node label.
  // * topology.kubernetes.io/zone: the value indicates the zone where the
  //   endpoint is located. This should match the corresponding node label.
  // * topology.kubernetes.io/region: the value indicates the region where the
  //   endpoint is located. This should match the corresponding node label.
  // This field is deprecated and will be removed in future api versions.
  // +optional

  //
  // Validation requirements:
  //  1. certificate must contain one or more PEM blocks.
  //  2. All PEM blocks must have the "CERTIFICATE" label, contain no headers, and the encoded data
  //   must be a BER-encoded ASN.1 Certificate structure as described in section 4 of RFC5280.

  // a network host (e.g. "foo.bar.com") or "wildcard", which is a domain name
  // prefixed with a single wildcard label (e.g. "*.foo.com").
  // The wildcard character '*' must appear by itself as the first DNS label and
  // matches only a single label. You cannot have a wildcard label by itself (e.g. Host == "*").
  // Requests will be matched against the Host field in the following way:

  // When a driver is initialized on a node, it provides the same topology keys
  // along with values. Kubelet will expose these topology keys as labels
  // on its own node object.
  // When Kubernetes does topology aware provisioning, it can use this list to
  // determine which labels it should retrieve from the node object and pass
  // back to the driver.
  // It is possible for different nodes to use different topology keys.

  // TODO: Consider a rename of this field.
  // +optional
  optional int32 replicas = 1;

  // selector is a label query over pods that should match the replica count.
  // If empty, defaulted to labels on the pod template.
  // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 2;

  // for more examples of label selectors.
  //
  // Default to the empty LabelSelector, which matches everything.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector namespaceSelector = 1;

  // ObjectSelector decides whether to run the validation based on if the
  // object has matching labels. objectSelector is evaluated against both

  optional bool hostPID = 8;

  // hostIPC determines if the policy allows the use of HostIPC in the pod spec.
  // +optional
  optional bool hostIPC = 9;

  // seLinux is the strategy that will dictate the allowable labels that may be set.
  optional SELinuxStrategyOptions seLinux = 10;

  // runAsUser is the strategy that will dictate the allowable RunAsUser values that may be set.
  optional RunAsUserStrategyOptions runAsUser = 11;

  optional int32 replicas = 1;

  // selector is the label query over pods that should match the replicas count. This is same
  // as the label selector but in the string format to avoid introspection
  // by clients. The string will be in the same format as the query-param syntax.
  // More info about label selectors: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
  // +optional
  optional string selector = 2;