// Endpoint represents a single logical "backend" implementing a service.
message Endpoint {
  // addresses of this endpoint. The contents of this field are interpreted
  // according to the corresponding EndpointSlice addressType field. Consumers
  // must handle different types of addresses in the context of their own
  // capabilities. This must contain at least one address but no more than

  //
  // Required.
  optional string name = 1;

  // Expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
  // CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:
  //
  // 'object' - The object from the incoming request. The value is null for DELETE requests.

  // The path to the field that refers the expression.
  // For example, the reference to the expression of the first item of
  // validations is "spec.validations[0].expression"
  optional string fieldRef = 2;

  // The content of type checking information in a human-readable form.
  // Each line of the warning contains the type that the expression is checked
  // against, followed by the type check error from the compiler.
  optional string warning = 3;

  // +listType=map
  // +listMapKey=type
  repeated k8s.io.apimachinery.pkg.apis.meta.v1.Condition conditions = 7;
}

// PodSecurityPolicy governs the ability to make requests that affect the Security Context
// that will be applied to a pod and container.
// Deprecated in 1.21.
message PodSecurityPolicy {
  // Standard object's metadata.

  // If the provisioner or an external controller can support the specified data source,
  // it will create a new volume based on the contents of the specified data source.
  // When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
  // and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.

  // driver can be mounted separately with different `-o context` options. This is
  // typical for storage backends that provide volumes as filesystems on block
  // devices or as independent shared volumes.
  // Kubernetes will call NodeStage / NodePublish with "-o context=xyz" mount
  // option when mounting a ReadWriteOncePod volume used in Pod that has
  // explicitly set SELinux context. In the future, it may be expanded to other

// Endpoint represents a single logical "backend" implementing a service.
message Endpoint {
  // addresses of this endpoint. The contents of this field are interpreted
  // according to the corresponding EndpointSlice addressType field. Consumers
  // must handle different types of addresses in the context of their own
  // capabilities. This must contain at least one address but no more than