resourceVersion: resourceVersionValue
  selfLink: selfLinkValue
  uid: uidValue
spec:
  auditAnnotations:
  - key: keyValue
    valueExpression: valueExpressionValue
  failurePolicy: failurePolicyValue
  matchConditions:
  - expression: expressionValue
    name: nameValue
  matchConstraints:
    excludeResourceRules:
    - apiGroups:
      - apiGroupsValue
      apiVersions:
      - apiVersionsValue
      operations:

	"matchConditions":         "MatchConditions is a list of conditions that must be met for a request to be sent to this webhook. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.\n\nThe exact matching logic is (in order):\n...

	return []error{}
}

var _ matchconditions.Matcher = &fakeCELMatcher{}

type fakeCELMatcher struct {
	error   error
	matches bool
}

func (f *fakeCELMatcher) Match(ctx context.Context, versionedAttr *admission.VersionedAttributes, versionedParams runtime.Object, authz authorizer.Authorizer) matchconditions.MatchResult {

			continue
		}
		// If at least one matchCondition successfully evaluates to FALSE,
		// return early
		if !match {
			metrics.RecordAuthorizationMatchConditionExclusion(ctx, c.AuthorizerType, c.AuthorizerName)
			return false, nil
		}
	}
	// if there is any error, return
	if len(evalErrors) > 0 {
		return false, utilerrors.NewAggregate(evalErrors)
	}
	// return ALL matchConditions evaluate to TRUE successfully without error

      }
    ],
    "failurePolicy": "failurePolicyValue",
    "auditAnnotations": [
      {
        "key": "keyValue",
        "valueExpression": "valueExpressionValue"
      }
    ],
    "matchConditions": [
      {
        "name": "nameValue",
        "expression": "expressionValue"
      }
    ],
    "variables": [
      {
        "name": "nameValue",
        "expression": "expressionValue"

  resourceVersion: resourceVersionValue
  selfLink: selfLinkValue
  uid: uidValue
spec:
  auditAnnotations:
  - key: keyValue
    valueExpression: valueExpressionValue
  failurePolicy: failurePolicyValue
  matchConditions:
  - expression: expressionValue
    name: nameValue
  matchConstraints:
    excludeResourceRules:
    - apiGroups:
      - apiGroupsValue
      apiVersions:
      - apiVersionsValue
      operations:

  resourceVersion: resourceVersionValue
  selfLink: selfLinkValue
  uid: uidValue
spec:
  auditAnnotations:
  - key: keyValue
    valueExpression: valueExpressionValue
  failurePolicy: failurePolicyValue
  matchConditions:
  - expression: expressionValue
    name: nameValue
  matchConstraints:
    excludeResourceRules:
    - apiGroups:
      - apiGroupsValue
      apiVersions:
      - apiVersionsValue
      operations:

	//   1. If ANY matchCondition evaluates to FALSE, the webhook is skipped.
	//   2. If ALL matchConditions evaluate to TRUE, the webhook is called.
	//   3. If any matchCondition evaluates to an error (but none are FALSE):
	//      - If failurePolicy=Fail, reject the request
	//      - If failurePolicy=Ignore, the error is ignored and the webhook is skipped
	//
	// +optional
	MatchConditions []MatchCondition
}

	}); err != nil {
		return err
	}
	if err := s.AddGeneratedConversionFunc((*v1.MatchCondition)(nil), (*admissionregistration.MatchCondition)(nil), func(a, b interface{}, scope conversion.Scope) error {
		return Convert_v1_MatchCondition_To_admissionregistration_MatchCondition(a.(*v1.MatchCondition), b.(*admissionregistration.MatchCondition), scope)
	}); err != nil {
		return err
	}

  // +listMapKey=name
  // +optional
  repeated MatchCondition matchConditions = 6;

  // Variables contain definitions of variables that can be used in composition of other expressions.
  // Each variable is defined as a named CEL expression.
  // The variables defined here will be available under `variables` in other expressions of the policy
  // except MatchConditions because MatchConditions are evaluated before the rest of the policy.
  //