// +optional
  optional string apiGroup = 1;

  // Kind is the type of resource being referenced. This is the same
  // value as in the parameter object's metadata.
  optional string kind = 2;

  // Name is the name of resource being referenced.
  optional string name = 3;

  // Namespace that contains the referenced resource. Must be empty

  // APIVersions is the API versions the resources belong to. '*' is all versions.
  // If '*' is present, the length of the slice must be one.
  // Required.
  // +listType=atomic
  repeated string apiVersions = 2;

  // Resources is a list of resources this rule applies to.
  //
  // For example:
  // 'pods' means pods.
  // 'pods/log' means the log subresource of pods.
  // '*' means all resources, but not subresources.

				return
			}
		case "Resources":
			var zb0002 uint32
			zb0002, err = dc.ReadArrayHeader()
			if err != nil {
				err = msgp.WrapError(err, "Resources")
				return
			}
			if cap(z.Resources) >= int(zb0002) {
				z.Resources = (z.Resources)[:zb0002]
			} else {
				z.Resources = make([]string, zb0002)
			}
			for za0001 := range z.Resources {
				z.Resources[za0001], err = dc.ReadString()

            return List.of(
                    alias("generate-sources", SOURCES),
                    alias("process-sources", AFTER + SOURCES),
                    alias("generate-resources", RESOURCES),
                    alias("process-resources", AFTER + RESOURCES),
                    alias("process-classes", AFTER + COMPILE),
                    alias("generate-test-sources", TEST_SOURCES),

  //   request resource.
  // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
  //
  // Required.
  optional string expression = 2;
}

// MutatingWebhook describes an admission webhook and the resources and operations it applies to.
message MutatingWebhook {
  // The name of the admission webhook.

	var locksHeld int64
	if locksHeld, reply = l.lockMap[args.Resources[0]]; !reply { // No lock is held on the given name
		return false, fmt.Errorf("Unlock attempted on an unlocked entity: %s", args.Resources[0])
	}
	if reply = locksHeld == WriteLock; !reply { // Unless it is a write lock
		return false, fmt.Errorf("Unlock attempted on a read locked entity: %s (%d read locks active)", args.Resources[0], locksHeld)
	}

  // the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.
  // +optional
  repeated string apiGroups = 2;

  // Resources is a list of resources this rule applies to.  '*' represents all resources in the specified apiGroups.

            {{- if .Values.tls.enabled }}
            - name: cert-secret-volume-mc
              mountPath: {{ .Values.configPathmc }}certs
            {{- end }}
          resources: {{- toYaml .Values.makePolicyJob.resources | nindent 12 }}
      {{- end }}
      containers:
        {{- if .Values.buckets }}
        - name: minio-make-bucket
          image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"

# o dbfluteDiconPackageName: (NotRequired - Default '../resources')
# o dbfluteDiconFileName: (NotRequired - Default 'dbflute.dicon')
# o j2eeDiconResourceName: (NotRequired - Default 'j2ee.dicon')
#
# {Java} Lasta Di Only:
# o dbfluteDiXmlNamespace: (NotRequired - Default 'dbflute')
# o dbfluteDiXmlPackageName: (NotRequired - Default '../resources')
# o dbfluteDiXmlFileName: (NotRequired - Default 'dbflute.xml')

  // Group is the API Group of the Resource.  "*" means all.
  // +optional
  optional string group = 3;

  // Version is the API Version of the Resource.  "*" means all.
  // +optional
  optional string version = 4;

  // Resource is one of the existing resource types.  "*" means all.
  // +optional
  optional string resource = 5;

  // Subresource is one of the existing resource types.  "" means none.
  // +optional