optional string name = 1;

  // ClientConfig defines how to communicate with the hook.
  // Required
  optional WebhookClientConfig clientConfig = 2;

  // Rules describes what operations on what resources/subresources the webhook cares about.
  // The webhook cares about an operation if it matches _any_ Rule.
  // However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks

 - Fixes a bug defining a default value for a replicas field in a custom resource definition that has the scale subresource enabled ([#90019](https://github.com/kubernetes/kubernetes/pull/90019), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle and Instrumentation]

* Adds a metric apiserver_request_error_total to kube-apiserver. This metric tallies the number of request_errors encountered by verb, group, version, resource, subresource, scope, component, and code. ([#84780](https://github.com/kubernetes/kubernetes/pull/84780), [@RainbowMango](https://github.com/RainbowMango))

- Fixes a bug where Services using finalizers may hold onto ClusterIP and/or NodePort allocated resources for longer than expected if the finalizer is removed using the status subresource ([#120656](https://github.com/kubernetes/kubernetes/pull/120656), [@aojea](https://github.com/aojea)) [SIG Network and Testing]

                type: array
            type: object
            x-kubernetes-preserve-unknown-fields: true
        required:
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    "helm.sh/resource-policy": keep
  labels:
    app: istio-pilot

  // ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches.
  // The policy cares about an operation if it matches _any_ Rule.
  // +listType=atomic
  // +optional
  repeated NamedRuleWithOperations resourceRules = 3;

  // ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about.

- Fixes a bug where Services using finalizers may hold onto ClusterIP and/or NodePort allocated resources for longer than expected if the finalizer is removed using the status subresource ([#120654](https://github.com/kubernetes/kubernetes/pull/120654), [@aojea](https://github.com/aojea)) [SIG Testing]
- Revised the logic for DaemonSet rolling update to exclude nodes if scheduling constraints are not met.

    * The body size limit does not apply to subresources like pods/proxy that proxy request content to another server.

				"application/x-debian-package",
				"application/x-dex",
				"application/x-director",
				"application/x-doom",
				"application/x-dtbncx+xml",
				"application/x-dtbook+xml",
				"application/x-dtbresource+xml",
				"application/x-dvi",
				"application/x-elc",
				"application/x-elf",
				"message/x-emlx",
				"application/x-killustrator",
				"application/x-object",
				"application/x-executable",

    <glob pattern="*.ncx"/>
  </mime-type>
  <mime-type type="application/x-dtbook+xml">
    <glob pattern="*.dtb"/>
  </mime-type>
  <mime-type type="application/x-dtbresource+xml">
    <glob pattern="*.res"/>
  </mime-type>

  <mime-type type="application/x-dvi">
    <_comment>TeX Device Independent Document</_comment>
    <magic priority="50">