// same controller. For example, you may have different parameters for the
  // same implementing controller. This should be specified as a
  // domain-prefixed path no more than 250 characters in length, e.g.
  // "acme.io/ingress-controller". This field is immutable.
  optional string controller = 1;

  // parameters is a link to a custom resource containing additional

  // "Reject" means that requests that can not be executed upon arrival
  // are rejected.
  // Required.
  // +unionDiscriminator
  optional string type = 1;

  // `queuing` holds the configuration parameters for queuing.
  // This field may be non-empty only if `type` is `"Queue"`.
  // +optional
  optional QueuingConfiguration queuing = 2;
}

  // "Reject" means that requests that can not be executed upon arrival
  // are rejected.
  // Required.
  // +unionDiscriminator
  optional string type = 1;

  // `queuing` holds the configuration parameters for queuing.
  // This field may be non-empty only if `type` is `"Queue"`.
  // +optional
  optional QueuingConfiguration queuing = 2;
}

  // webhook, for example, a cluster identifier.
  //
  // Attempting to use a user or basic auth e.g. "user:password@" is not
  // allowed. Fragments ("#...") and query parameters ("?...") are not
  // allowed, either.
  //
  // +optional
  optional string url = 3;

  // `service` is a reference to the service for this webhook. Either
  // `service` or `url` must be specified.

  // "Reject" means that requests that can not be executed upon arrival
  // are rejected.
  // Required.
  // +unionDiscriminator
  optional string type = 1;

  // `queuing` holds the configuration parameters for queuing.
  // This field may be non-empty only if `type` is `"Queue"`.
  // +optional
  optional QueuingConfiguration queuing = 2;
}

  // "Reject" means that requests that can not be executed upon arrival
  // are rejected.
  // Required.
  // +unionDiscriminator
  optional string type = 1;

  // `queuing` holds the configuration parameters for queuing.
  // This field may be non-empty only if `type` is `"Queue"`.
  // +optional
  optional QueuingConfiguration queuing = 2;
}

// controller will use to perform updates. It includes any additional parameters
// necessary to perform the update for the indicated strategy.
message StatefulSetUpdateStrategy {
  // Type indicates the type of the StatefulSetUpdateStrategy.
  optional string type = 1;

  // RollingUpdate is used to communicate parameters when Type is RollingUpdateStatefulSetStrategyType.

message ValidatingAdmissionPolicySpec {
  // ParamKind specifies the kind of resources used to parameterize this policy.
  // If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions.
  // If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied.

  optional k8s.io.apimachinery.pkg.api.resource.Quantity targetValue = 3;

  // selector is the string-encoded form of a standard kubernetes label selector for the given metric.
  // When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping
  // When unset, just the metricName will be used to gather metrics.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 4;

  // +optional
  repeated AllowedHostPath allowedHostPaths = 17;

  // allowedFlexVolumes is an allowlist of Flexvolumes.  Empty or nil indicates that all
  // Flexvolumes may be used.  This parameter is effective only when the usage of the Flexvolumes
  // is allowed in the "volumes" field.
  // +optional
  repeated AllowedFlexVolume allowedFlexVolumes = 18;