"conditions": "conditions contains information about the current status of the endpoint.",
	"hostname":   "hostname of this endpoint. This field may be used by consumers of endpoints to distinguish endpoints from each other (e.g. in DNS names). Multiple endpoints which use the same hostname should be considered fungible (e.g. multiple A values in DNS). Must be lowercase and pass DNS Label (RFC 1123) validation.",

        MultiProjectCachedScripts(
            cachedSettingsFile(
                withSettings(
                    """
                    $settings
                    rootProject.name = "${projectRoot.name}" // distinguish settings files
                    include("right", "left")
                    """
                ),
                settings.contains("buildscript {"),
                true
            ),

// Setup iptables rules for HOST netnamespace. Ideally this should be an idempotent function.
// NOTE that this expects to be run from within the HOST network namespace!
//
// We need to do this specifically to be able to distinguish between traffic coming from different node-level processes
// via the nodeIP
// - kubelet (node-local healthchecks, which we do not capture)

  // conditions contains information about the current status of the endpoint.
  optional EndpointConditions conditions = 2;

  // hostname of this endpoint. This field may be used by consumers of
  // endpoints to distinguish endpoints from each other (e.g. in DNS names).
  // Multiple endpoints which use the same hostname should be considered
  // fungible (e.g. multiple A values in DNS). Must be lowercase and pass DNS
  // Label (RFC 1123) validation.

	Response *AdmissionResponse
}

// AdmissionRequest describes the admission.Attributes for the admission request.
type AdmissionRequest struct {
	// UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
	// otherwise identical (parallel requests, requests when earlier requests did not modify etc)

func mapAddressByPort(addr *v1.EndpointAddress, port v1.EndpointPort, ready bool, allAddrs map[addressKey]*v1.EndpointAddress, portToAddrReadyMap map[v1.EndpointPort]addressSet) *v1.EndpointAddress {
	// use addressKey to distinguish between two endpoints that are identical addresses
	// but may have come from different hosts, for attribution. For instance, Mesos
	// assigns pods the node IP, but the pods are distinct.
	key := addressKey{ip: addr.IP}

  // conditions contains information about the current status of the endpoint.
  optional EndpointConditions conditions = 2;

  // hostname of this endpoint. This field may be used by consumers of
  // endpoints to distinguish endpoints from each other (e.g. in DNS names).
  // Multiple endpoints which use the same hostname should be considered
  // fungible (e.g. multiple A values in DNS). Must be lowercase and pass DNS
  // Label (RFC 1123) validation.

}

// DeploymentSpec is the specification of the desired behavior of the Deployment.
type DeploymentSpec struct {
	// Number of desired pods. This is a pointer to distinguish between explicit
	// zero and not specified. Defaults to 1.
	// +optional
	Replicas *int32 `json:"replicas,omitempty" protobuf:"varint,1,opt,name=replicas"`

	case MOV:
		// The 16-bit and 32-bit forms of MOV Sreg, dst and MOV src, Sreg
		// cannot be distinguished when src or dst refers to memory, because
		// Sreg is always a 16-bit value, even when we're doing a 32-bit
		// instruction. Because the instruction tables distinguished these two,
		// any operand size prefix has been marked as used (to decide which

	rbacv1helpers.NewRule(bootstrappolicy.Read...).Groups("").Resources("services/proxy").RuleOrDie(),
}

// ungettableResources is the list of rules that don't allow to view (GET) them
// this is purposefully separate list to distinguish from escalating privs
var ungettableResources = []rbacv1.PolicyRule{
	rbacv1helpers.NewRule(bootstrappolicy.Read...).Groups("apps", "extensions").Resources("deployments/rollback").RuleOrDie(),
}