// Required.
  optional MatchResources matchConstraints = 2;

  // Validations contain CEL expressions which is used to apply the validation.
  // Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is
  // required.
  // +listType=atomic
  // +optional
  repeated Validation validations = 3;

	// Validations contain CEL expressions which is used to apply the validation.
	// Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is
	// required.
	// +listType=atomic
	// +optional
	Validations []Validation `json:"validations,omitempty" protobuf:"bytes,3,rep,name=validations"`

        x-kubernetes-list-type: x-kubernetes-list-typeValue
        x-kubernetes-map-type: x-kubernetes-map-typeValue
        x-kubernetes-preserve-unknown-fields: true
        x-kubernetes-validations:
        - fieldPath: fieldPathValue
          message: messageValue
          messageExpression: messageExpressionValue
          optionalOldSelf: true
          reason: reasonValue
          rule: ruleValue

	var warnings []v1.ExpressionWarning // intentionally not setting capacity

	// check main validation expressions and their message expressions, located in spec.validations[*]
	fieldRef := field.NewPath("spec", "validations")
	for i, v := range policy.Spec.Validations {
		results := c.CheckExpression(ctx, v.Expression)
		if len(results) != 0 {
			warnings = append(warnings, v1.ExpressionWarning{

								apiVersion:
									type: string
									x-kubernetes-validations:
									- rule: self == "v1"
								kind:
									type: string
									x-kubernetes-validations:
									- rule: self == "Pod"
					subField:
						type: object
						properties:
							apiVersion:
								type: string
								x-kubernetes-validations:
								- rule: self == "v1"
							kind:
								type: string

  // Required.
  optional MatchResources matchConstraints = 2;

  // Validations contain CEL expressions which is used to apply the validation.
  // Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is
  // required.
  // +listType=atomic
  // +optional
  repeated Validation validations = 3;

const extListType = "x-kubernetes-list-type"
const extMapType = "x-kubernetes-map-type"
const extListMapKeys = "x-kubernetes-list-map-keys"

	// Required.
	MatchConstraints *MatchResources

	// validations contain CEL expressions which are used to validate admission requests.
	// validations and auditAnnotations may not both be empty; a minimum of one validations or auditAnnotations is
	// required.
	// +optional
	Validations []Validation

	// MatchConditions is a list of conditions that must be met for a request to be validated.

// if the two tolerations have same <key,effect,operator,value> combination, regard as they match.
// TODO: uniqueness check for tolerations in api validations.
func (t *Toleration) MatchToleration(tolerationToMatch *Toleration) bool {
	return t.Key == tolerationToMatch.Key &&
		t.Effect == tolerationToMatch.Effect &&
		t.Operator == tolerationToMatch.Operator &&

	// Validations contain CEL expressions which is used to apply the validation.
	// Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is
	// required.
	// +listType=atomic
	// +optional
	Validations []Validation `json:"validations,omitempty" protobuf:"bytes,3,rep,name=validations"`