}

			vwhObject, _, err := deserializer.Decode([]byte(webhookYAML), nil, &admitv1.ValidatingWebhookConfiguration{})
			if err != nil {
				t.Fatalf("could not parse webhook from generated YAML: %s", vwhObject)
			}
			wh := vwhObject.(*admitv1.ValidatingWebhookConfiguration)

			if tc.userManaged {
				// User created webhooks should not have operator labels, otherwise will be pruned.

  // +featureGate=AdmissionWebhookMatchConditions
  // +optional
  repeated MatchCondition matchConditions = 11;
}

// ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it.
message ValidatingWebhookConfiguration {
  // Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.

	AddToScheme = localSchemeBuilder.AddToScheme
)

// Adds the list of known types to scheme.
func addKnownTypes(scheme *runtime.Scheme) error {
	scheme.AddKnownTypes(SchemeGroupVersion,
		&ValidatingWebhookConfiguration{},
		&ValidatingWebhookConfigurationList{},
		&MutatingWebhookConfiguration{},
		&MutatingWebhookConfigurationList{},
		&ValidatingAdmissionPolicy{},
		&ValidatingAdmissionPolicyList{},

	AddToScheme = localSchemeBuilder.AddToScheme
)

// Adds the list of known types to scheme.
func addKnownTypes(scheme *runtime.Scheme) error {
	scheme.AddKnownTypes(SchemeGroupVersion,
		&ValidatingWebhookConfiguration{},
		&ValidatingWebhookConfigurationList{},
		&MutatingWebhookConfiguration{},
		&MutatingWebhookConfigurationList{},
		&ValidatingAdmissionPolicy{},
		&ValidatingAdmissionPolicyList{},

			return 2

			// validatingwebhookconfiguration is configured to FAIL-OPEN in the default install. For the
			// re-install case we want to apply the validatingwebhookconfiguration first to reset any
			// orphaned validatingwebhookconfiguration that is FAIL-CLOSE.
		case gk == "admissionregistration.k8s.io/ValidatingWebhookConfiguration":
			return 3

	_ = resultBuilder.Add(collections.Deployment)
	// We don't need to analyze injection config in the multi-cluster scenario.
	_ = resultBuilder.Add(collections.ConfigMap)
	_ = resultBuilder.Add(collections.ValidatingWebhookConfiguration)
	_ = resultBuilder.Add(collections.MutatingWebhookConfiguration)
	return resultBuilder.Build()
}

// the following code minimally duplicates logic from galley/pkg/config/source/kube/rt/known.go

	UDPRoute                       = schema.GroupVersionResource{Group: "gateway.networking.k8s.io", Version: "v1alpha2", Resource: "udproutes"}
	ValidatingWebhookConfiguration = schema.GroupVersionResource{Group: "admissionregistration.k8s.io", Version: "v1", Resource: "validatingwebhookconfigurations"}

	case gvr.Telemetry:
		return &apiistioioapitelemetryv1alpha1.Telemetry{}
	case gvr.UDPRoute:
		return &sigsk8siogatewayapiapisv1alpha2.UDPRoute{}
	case gvr.ValidatingWebhookConfiguration:
		return &k8sioapiadmissionregistrationv1.ValidatingWebhookConfiguration{}
	case gvr.VirtualService:
		return &apiistioioapinetworkingv1alpha3.VirtualService{}
	case gvr.WasmPlugin:
		return &apiistioioapiextensionsv1alpha1.WasmPlugin{}

// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
func (in *ValidatingWebhookConfiguration) APILifecycleIntroduced() (major, minor int) {
	return 1, 16
}

          "sideEffects",
          "admissionReviewVersions"
        ],
        "type": "object"
      },
      "io.k8s.api.admissionregistration.v1.ValidatingWebhookConfiguration": {
        "description": "ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it.",
        "properties": {
          "apiVersion": {