// If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ].
  // Likewise, if you want to write a policy that specifies that no egress is allowed,
  // you must specify a policyTypes value that include "Egress" (since such a policy would not include
  // an egress section and would otherwise default to just [ "Ingress" ]).

  repeated string items = 1;
}

// LocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace.
// Having a namespace scoped resource makes it much easier to grant namespace scoped policy that includes permissions
// checking.
message LocalSubjectAccessReview {
  // Standard list metadata.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

  // MatchResources declares what resources match this binding and will be validated by it.
  // Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this.
  // If this is unset, all resources matched by the policy are validated by this binding

  // as pods that have status.conditions item with type="Ready",status="True".
  //
  // Valid policies are IfHealthyBudget and AlwaysAllow.
  // If no policy is specified, the default behavior will be used,
  // which corresponds to the IfHealthyBudget policy.
  //
  // IfHealthyBudget policy means that running pods (status.phase="Running"),
  // but not yet healthy can be evicted only if the guarded application is not

  optional string sideEffects = 6;

  // TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,
  // the webhook call will be ignored or the API call will fail based on the
  // failure policy.
  // The timeout value must be between 1 and 30 seconds.
  // Default to 10 seconds.
  // +optional
  optional int32 timeoutSeconds = 7;

  optional MetricValueStatus current = 2;
}

// HPAScalingPolicy is a single policy which must hold true for a specified past interval.
message HPAScalingPolicy {
  // type is used to specify the scaling policy.
  optional string type = 1;

  // value contains the amount of change which is permitted by the policy.
  // It must be greater than zero
  optional int32 value = 2;

  optional string whenDeleted = 1;

  // whenScaled specifies what happens to PVCs created from StatefulSet
  // VolumeClaimTemplates when the StatefulSet is scaled down. The default
  // policy of `Retain` causes PVCs to not be affected by a scaledown. The
  // `Delete` policy causes the associated PVCs for any excess pods above
  // the replica count to be deleted.
  optional string whenScaled = 2;
}

  // update), this timer will effectively be stopped and reset when the Job is
  // resumed again.
  // +optional
  optional int64 activeDeadlineSeconds = 3;

  // Specifies the policy of handling failed pods. In particular, it allows to
  // specify the set of actions and conditions which need to be
  // satisfied to take the associated action.

  // +optional
  repeated ImageReviewContainerSpec containers = 1;

  // Annotations is a list of key-value pairs extracted from the Pod's annotations.
  // It only includes keys which match the pattern `*.image-policy.k8s.io/*`.
  // It is up to each webhook backend to determine how to interpret these annotations, if at all.
  // +optional
  map<string, string> annotations = 2;

  // Namespace is the namespace the pod is being created in.

  //
  // This field is immutable.
  //
  // Defaults to ReadWriteOnceWithFSType, which will examine each volume
  // to determine if Kubernetes should modify ownership and permissions of the volume.
  // With the default policy the defined fsGroup will only be applied
  // if a fstype is defined and the volume's access mode contains ReadWriteOnce.
  //
  // +optional
  optional string fsGroupPolicy = 5;