// It should point to a resource of the type specified in ParamKind of the bound ValidatingAdmissionPolicy.
  // If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the ValidatingAdmissionPolicy applied.
  // If the policy does not specify a ParamKind then this field is ignored, and the rules are evaluated without a param.
  // +optional

        "time": "2004-01-01T01:01:01Z",
        "fieldsType": "fieldsTypeValue",
        "fieldsV1": {},
        "subresource": "subresourceValue"
      }
    ]
  },
  "spec": {
    "paramKind": {
      "apiVersion": "apiVersionValue",
      "kind": "kindValue"
    },
    "matchConstraints": {
      "namespaceSelector": {
        "matchLabels": {
          "matchLabelsKey": "matchLabelsValue"

	// +optional
	ParamKind *ParamKind `json:"paramKind,omitempty" protobuf:"bytes,1,rep,name=paramKind"`

	// MatchConstraints specifies what resources this policy is designed to validate.
	// The AdmissionPolicy cares about a request if it matches _all_ Constraints.
	// However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API

        "time": "2004-01-01T01:01:01Z",
        "fieldsType": "fieldsTypeValue",
        "fieldsV1": {},
        "subresource": "subresourceValue"
      }
    ]
  },
  "spec": {
    "paramKind": {
      "apiVersion": "apiVersionValue",
      "kind": "kindValue"
    },
    "matchConstraints": {
      "namespaceSelector": {
        "matchLabels": {
          "matchLabelsKey": "matchLabelsValue"

      apiVersions:
      - apiVersionsValue
      operations:
      - operationsValue
      resourceNames:
      - resourceNamesValue
      resources:
      - resourcesValue
      scope: scopeValue
  paramKind:
    apiVersion: apiVersionValue
    kind: kindValue
  validations:
  - expression: expressionValue
    message: messageValue
    messageExpression: messageExpressionValue
    reason: reasonValue
  variables:

        "time": "2004-01-01T01:01:01Z",
        "fieldsType": "fieldsTypeValue",
        "fieldsV1": {},
        "subresource": "subresourceValue"
      }
    ]
  },
  "spec": {
    "paramKind": {
      "apiVersion": "apiVersionValue",
      "kind": "kindValue"
    },
    "matchConstraints": {
      "namespaceSelector": {
        "matchLabels": {
          "matchLabelsKey": "matchLabelsValue"

      apiVersions:
      - apiVersionsValue
      operations:
      - operationsValue
      resourceNames:
      - resourceNamesValue
      resources:
      - resourcesValue
      scope: scopeValue
  paramKind:
    apiVersion: apiVersionValue
    kind: kindValue
  validations:
  - expression: expressionValue
    message: messageValue
    messageExpression: messageExpressionValue
    reason: reasonValue
  variables:

	"paramKind":        "ParamKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the...

				}},
				ParamKind: &admissionregistration.ParamKind{
					APIVersion: "test.example.com/v1",
				},
			},
		},
		expectedError: `spec.paramKind.kind: Required value`,
	}, {
		name: "API version format in ParamKind",
		config: &admissionregistration.ValidatingAdmissionPolicy{
			ObjectMeta: metav1.ObjectMeta{
				Name: "config",
			},

type ValidatingAdmissionPolicySpec struct {
	// ParamKind specifies the kind of resources used to parameterize this policy.
	// If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions.
	// If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied.