// There are a maximum of 64 match conditions allowed.
	//
	// The exact matching logic is (in order):
	//   1. If at least one matchCondition evaluates to FALSE, then the webhook is skipped.
	//   2. If ALL matchConditions evaluate to TRUE, then the webhook is called.
	//   3. If at least one matchCondition evaluates to an error (but none are FALSE):
	//      - If failurePolicy=Deny, then the webhook rejects the request

	"variables":  ...

          }
        },
        "required": [
          "fieldRef",
          "warning"
        ],
        "type": "object"
      },
      "io.k8s.api.admissionregistration.v1.MatchCondition": {
        "description": "MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook.",
        "properties": {
          "expression": {
            "default": "",

				},
				{
					Expression: "request.resourceAttributes.namespace == 'kittensandponies'",
				},
			},
		},
		{
			name:               "at least one matchCondition successfully evaluates to FALSE, error ignored",
			attr:               alice2Attr,
			expectedCompileErr: "",
			expectedEvalErr:    "",
			expectedDecision:   authorizer.DecisionNoOpinion,

          }
        },
        "required": [
          "fieldRef",
          "warning"
        ],
        "type": "object"
      },
      "io.k8s.api.admissionregistration.v1beta1.MatchCondition": {
        "description": "MatchCondition represents a condition which must be fulfilled for a request to be sent to a webhook.",
        "properties": {
          "expression": {
            "default": "",

            "items":...

objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.\n\nThe exact matching logic is (in order):\n  1. If ANY matchCondition evaluates to FALSE, the webhook is skipped.\n  2. If ALL matchConditions evaluate to TRUE, the webhook is called.\n  3. If any matchCondition evaluates to an error (but none are FALSE):\n     - If failurePolicy=Fail, reject the request\n     - If failurePolicy=Ignore, the error is ignored and the webhook is skipped",...

			if len(tt.expectedErr) == 0 && len(tt.matchConditions) > 0 && len(errList) == 0 && celMatcher == nil {
				t.Errorf("celMatcher should not be nil when there are matchCondition and no error returned")
			}
			got := errList.ToAggregate()
			if d := cmp.Diff(tt.expectedErr, errString(got)); d != "" {
				t.Fatalf("ValidateAndCompileMatchConditions validation mismatch (-want +got):\n%s", d)

          "type": "string"
        }
      },
      "required": [
        "fieldRef",
        "warning"
      ],
      "type": "object"
    },
    "io.k8s.api.admissionregistration.v1.MatchCondition": {
      "description": "MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook.",
      "properties": {
        "expression": {

{
  "definitions": {
    "io.k8s.api.admissionregistration.v1.MatchCondition": {
      "description": "MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook.",
      "properties": {
        "expression": {