{
  "apiVersion": "v1",
  "groupVersion": "scheduling.k8s.io/v1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "PriorityClass",
      "name": "priorityclasses",
      "namespaced": false,
      "shortNames": [
        "pc"
      ],
      "singularName": "priorityclass",
      "storageVersionHash": "1QwjyaZjj3Y=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",

{
  "apiVersion": "v1",
  "groupVersion": "coordination.k8s.io/v1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "Lease",
      "name": "leases",
      "namespaced": true,
      "singularName": "lease",
      "storageVersionHash": "gqkMMb/YqFM=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",
        "patch",
        "update",

			return nil, fmt.Errorf("the sysctls %q are not known to be namespaced", sysctlOrPrefix)
		}
		if prefixed {
			w.prefixes[sysctlOrPrefix] = ns
		} else {
			w.sysctls[sysctlOrPrefix] = ns
		}
	}
	return w, nil
}

// validateSysctl checks that a sysctl is allowlisted because it is known
// to be namespaced by the Linux kernel. Note that being allowlisted is required, but not

{
  "apiVersion": "v1",
  "groupVersion": "authentication.k8s.io/v1alpha1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "SelfSubjectReview",
      "name": "selfsubjectreviews",
      "namespaced": false,
      "singularName": "selfsubjectreview",
      "verbs": [
        "create"
      ]
    }
  ]

{
  "apiVersion": "v1",
  "groupVersion": "discovery.k8s.io/v1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "EndpointSlice",
      "name": "endpointslices",
      "namespaced": true,
      "singularName": "endpointslice",
      "storageVersionHash": "qgS0xkrxYAI=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",
        "patch",

{
  "apiVersion": "v1",
  "groupVersion": "node.k8s.io/v1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "RuntimeClass",
      "name": "runtimeclasses",
      "namespaced": false,
      "singularName": "runtimeclass",
      "storageVersionHash": "WQTu1GL3T2Q=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",
        "patch",
        "update",

{
  "apiVersion": "v1",
  "groupVersion": "certificates.k8s.io/v1alpha1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "ClusterTrustBundle",
      "name": "clustertrustbundles",
      "namespaced": false,
      "singularName": "clustertrustbundle",
      "storageVersionHash": "XGGGW2kGm+w=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",

{
  "apiVersion": "v1",
  "groupVersion": "events.k8s.io/v1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "Event",
      "name": "events",
      "namespaced": true,
      "shortNames": [
        "ev"
      ],
      "singularName": "event",
      "storageVersionHash": "r2yiGXH7wu8=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",

{
  "apiVersion": "v1",
  "groupVersion": "storage.k8s.io/v1alpha1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "VolumeAttributesClass",
      "name": "volumeattributesclasses",
      "namespaced": false,
      "shortNames": [
        "vac"
      ],
      "singularName": "volumeattributesclass",
      "storageVersionHash": "HPC8kMG1ukQ=",
      "verbs": [
        "create",
        "delete",

	GetNamespace() string

	// GetPolicyName returns the name of the (Validating/Mutating)AdmissionPolicy,
	// which is cluster-scoped, so namespace is usually left blank.
	// But we leave the door open to add a namespaced vesion in the future
	GetPolicyName() types.NamespacedName
	GetParamRef() *v1.ParamRef

	GetMatchResources() *v1.MatchResources