{
  "apiVersion": "v1",
  "groupVersion": "node.k8s.io/v1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "RuntimeClass",
      "name": "runtimeclasses",
      "namespaced": false,
      "singularName": "runtimeclass",
      "storageVersionHash": "WQTu1GL3T2Q=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",
        "patch",
        "update",

{
  "apiVersion": "v1",
  "groupVersion": "certificates.k8s.io/v1alpha1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "ClusterTrustBundle",
      "name": "clustertrustbundles",
      "namespaced": false,
      "singularName": "clustertrustbundle",
      "storageVersionHash": "XGGGW2kGm+w=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",

{
  "apiVersion": "v1",
  "groupVersion": "events.k8s.io/v1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "Event",
      "name": "events",
      "namespaced": true,
      "shortNames": [
        "ev"
      ],
      "singularName": "event",
      "storageVersionHash": "r2yiGXH7wu8=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",

{
  "apiVersion": "v1",
  "groupVersion": "storage.k8s.io/v1alpha1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "VolumeAttributesClass",
      "name": "volumeattributesclasses",
      "namespaced": false,
      "shortNames": [
        "vac"
      ],
      "singularName": "volumeattributesclass",
      "storageVersionHash": "HPC8kMG1ukQ=",
      "verbs": [
        "create",
        "delete",

type BindingAccessor interface {
	GetName() string
	GetNamespace() string

	// GetPolicyName returns the name of the (Validating/Mutating)AdmissionPolicy,
	// which is cluster-scoped, so namespace is usually left blank.
	// But we leave the door open to add a namespaced vesion in the future
	GetPolicyName() types.NamespacedName
	GetParamRef() *v1.ParamRef

	GetMatchResources() *v1.MatchResources

apiVersion: example.com/v1
kind: Widget
metadata:
  name: foo
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: widgets.example.com
spec:
  group: example.com
  scope: Namespaced
  names:
    plural: widgets
    kind: Widget
  versions:
    - name: v1
      served: true
      storage: true
      schema:
        openAPIV3Schema:
          x-kubernetes-preserve-unknown-fields: true

/usr/lib/cups/backend/cups-pdf (enforce)
/usr/sbin/ntpd (enforce)
/usr/lib/connman/scripts/dhclient-script (enforce)
/usr/lib/NetworkManager/nm-dhcp-client.action (enforce)
/sbin/dhclient (enforce)
foo-container (complain)

            system uses when creating a volume snapshot. A specific VolumeSnapshotClass
            is used by specifying its name in a VolumeSnapshot object. VolumeSnapshotClasses
            are non-namespaced
          properties:
            apiVersion:
              description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest

  group: install.istio.io
  names:
    kind: IstioOperator
    listKind: IstioOperatorList
    plural: istiooperators
    singular: istiooperator
    shortNames:
    - iop
    - io
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Istio control plane revision
      jsonPath: .spec.revision
      name: Revision
      type: string
    - description: IOP current state

        description: GlobalNetworkSet contains a set of arbitrary IP sub-networks/CIDRs
          that share labels to allow rules to refer to them via selectors.  The labels
          of GlobalNetworkSet are not namespaced.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest