// Note that this is differs from ValidatingAdmissionPolicy matchConstraints, where resourceRules are required.
	// +optional
	MatchResources *MatchResources `json:"matchResources,omitempty" protobuf:"bytes,3,rep,name=matchResources"`

	// validationActions declares how Validations of the referenced ValidatingAdmissionPolicy are enforced.

				Name:      "param-test",
				Namespace: "default",
			},
			ValidationActions: []admissionregistration.ValidationAction{admissionregistration.Deny},
			MatchResources:    &admissionregistration.MatchResources{},
		},
	}
}

func newInsecureStorage(t *testing.T) (*REST, *etcd3testing.EtcdTestServer) {
	return newStorage(t, nil, nil, nil)
}

func (m *MatchResources) Reset()      { *m = MatchResources{} }
func (*MatchResources) ProtoMessage() {}
func (*MatchResources) Descriptor() ([]byte, []int) {
	return fileDescriptor_7f7c65a4f012fb19, []int{3}
}
func (m *MatchResources) XXX_Unmarshal(b []byte) error {
	return m.Unmarshal(b)
}
func (m *MatchResources) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {

  //
  // Required.
  optional string expression = 2;
}

// MatchResources decides whether to run the admission control policy on an object based
// on whether it meets the match criteria.
// The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
// +structType=atomic
message MatchResources {
  // NamespaceSelector decides whether to run the admission control policy on an object based

			if obj.ValidationActions == nil {
				obj.ValidationActions = []admissionregistration.ValidationAction{admissionregistration.Deny}
			}
		},
		func(obj *admissionregistration.MatchResources, c fuzz.Continue) {
			c.FuzzNoCustom(obj) // fuzz self without calling this function again
			if obj.MatchPolicy == nil {
				m := admissionregistration.MatchPolicyType("Exact")
				obj.MatchPolicy = &m
			}
		},

func (m *MatchResources) Reset()      { *m = MatchResources{} }
func (*MatchResources) ProtoMessage() {}
func (*MatchResources) Descriptor() ([]byte, []int) {
	return fileDescriptor_3205c7dc5bf0c9bf, []int{3}
}
func (m *MatchResources) XXX_Unmarshal(b []byte) error {
	return m.Unmarshal(b)
}
func (m *MatchResources) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {

	"matchResources":    "MatchResources declares what resources match this binding and will be validated by it. Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this. If this is unset, all...

	// Note that this is differs from ValidatingAdmissionPolicy matchConstraints, where resourceRules are required.
	// +optional
	MatchResources *MatchResources `json:"matchResources,omitempty" protobuf:"bytes,3,rep,name=matchResources"`

	// validationActions declares how Validations of the referenced ValidatingAdmissionPolicy are enforced.

	// Note that this is differs from ValidatingAdmissionPolicy matchConstraints, where resourceRules are required.
	// +optional
	MatchResources *MatchResources `json:"matchResources,omitempty" protobuf:"bytes,3,rep,name=matchResources"`

	// validationActions declares how Validations of the referenced ValidatingAdmissionPolicy are enforced.

  //
  // Required.
  optional string expression = 2;
}

// MatchResources decides whether to run the admission control policy on an object based
// on whether it meets the match criteria.
// The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
// +structType=atomic
message MatchResources {
  // NamespaceSelector decides whether to run the admission control policy on an object based