// the related backend services. Incoming requests are first evaluated for a host
// match, then routed to the backend associated with the matching IngressRuleValue.
message IngressRule {
  // host is the fully qualified domain name of a network host, as defined by RFC 3986.
  // Note the following deviations from the "host" part of the
  // URI as defined in RFC 3986:
  // 1. IPs are not allowed. Currently an IngressRuleValue can only apply to

// the related backend services. Incoming requests are first evaluated for a host
// match, then routed to the backend associated with the matching IngressRuleValue.
message IngressRule {
  // host is the fully qualified domain name of a network host, as defined by RFC 3986.
  // Note the following deviations from the "host" part of the
  // URI as defined in RFC 3986:
  // 1. IPs are not allowed. Currently an IngressRuleValue can only apply to

  // When serialized as JSON or YAML, the data is additionally base64-encoded.
  // +listType=atomic
  optional bytes request = 1;

  // signerName indicates the requested signer, and is a qualified name.
  //
  // List/watch requests for CertificateSigningRequests can filter on this field using a "spec.signerName=NAME" fieldSelector.
  //
  // Well-known Kubernetes signers are:

                              minimum: 0
                              type: integer
                            service:
                              description: The fully qualified service name for this
                                cluster.
                              type: string
                            subset:

                              minimum: 0
                              type: integer
                            service:
                              description: The fully qualified service name for this
                                cluster.
                              type: string
                            subset:

  // is other than default (typically TCP ports 860 and 3260).
  optional string targetPortal = 1;

  // iqn is Target iSCSI Qualified Name.
  optional string iqn = 2;

  // lun is iSCSI Target Lun number.
  optional int32 lun = 3;

  // iscsiInterface is the interface Name that uses an iSCSI transport.

Match on envoy cluster attributes. properties: name: description: The exact name of the cluster to match. type: string portNumber: description: The service port for which this cluster was generated. type: integer service: description: The fully qualified service name for this cluster. type: string subset: description: The subset associated with the service. type: string type: object context: description: The specific config generation context to match on. enum: - ANY - SIDECAR_INBOUND - SIDECAR_OUTBOUND...

// the related backend services. Incoming requests are first evaluated for a host
// match, then routed to the backend associated with the matching IngressRuleValue.
message IngressRule {
  // Host is the fully qualified domain name of a network host, as defined by RFC 3986.
  // Note the following deviations from the "host" part of the
  // URI as defined in RFC 3986:
  // 1. IPs are not allowed. Currently an IngressRuleValue can only apply to

	GetSelector() *typev1beta1.WorkloadSelector
}

// findMatchedConfigs should filter out unrelated configs that are not matched given podsLabels.
// When the config has no selector labels, this method will treat it as qualified namespace level
// config. So configs passed into this method should only contains workload's namespaces configs
// and rootNamespaces configs, caller should be responsible for controlling configs passed
// in.

message AuditAnnotation {
  // key specifies the audit annotation key. The audit annotation keys of
  // a ValidatingAdmissionPolicy must be unique. The key must be a qualified
  // name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length.
  //
  // The key is combined with the resource name of the
  // ValidatingAdmissionPolicy to construct an audit annotation key: