// Otherwise it selects the Pods matching PodSelector in the policy's own Namespace.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector podSelector = 1;

  // Selects Namespaces using cluster-scoped labels. This field follows standard label
  // selector semantics; if present but empty, it selects all namespaces.
  //
  // If PodSelector is also set, then the NetworkPolicyPeer as a whole selects

  // on whether the namespace for that object matches the selector. If the
  // object itself is a namespace, the matching is performed on
  // object.metadata.labels. If the object is another cluster scoped resource,
  // it never skips the policy.
  //
  // For example, to run the webhook on any objects whose namespace is not
  // associated with "runlevel" of "0" or "1";  you will set the selector as
  // follows: