# See: https://github.com/codespell-project/codespell#using-a-config-file

skip = .git*,*.lock,.codespellrc,target,.jj,simulation/modules/radicle-node/cue.mod/*

[files]

extend-exclude = [

    "simulation/modules/radicle-node/cue.mod"

]

// Code generated by cue get go. DO NOT EDIT.

//cue:generate cue get go k8s.io/api/admission/v1

package v1

#GroupName: "admission.k8s.io"

// Code generated by cue get go. DO NOT EDIT.

//cue:generate cue get go k8s.io/api/admission/v1

package v1

import (

	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

	"k8s.io/apimachinery/pkg/types"

	authenticationv1 "k8s.io/api/authentication/v1"

	"k8s.io/apimachinery/pkg/runtime"

)

// AdmissionReview describes an admission review request/response.

#AdmissionReview: {

	metav1.#TypeMeta

	// Request describes the attributes for the admission request.

	// +optional

	request?: null | #AdmissionRequest @go(Request,*AdmissionRequest) @protobuf(1,bytes,opt)

	// Response describes the attributes for the admission response.

	// +optional

	response?: null | #AdmissionResponse @go(Response,*AdmissionResponse) @protobuf(2,bytes,opt)

}

// AdmissionRequest describes the admission.Attributes for the admission request.

#AdmissionRequest: {

	// UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are

	// otherwise identical (parallel requests, requests when earlier requests did not modify etc)

	// The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.

	// It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.

	uid: types.#UID @go(UID) @protobuf(1,bytes,opt)

	// Kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)

	kind: metav1.#GroupVersionKind @go(Kind) @protobuf(2,bytes,opt)

	// Resource is the fully-qualified resource being requested (for example, v1.pods)

	resource: metav1.#GroupVersionResource @go(Resource) @protobuf(3,bytes,opt)

	// SubResource is the subresource being requested, if any (for example, "status" or "scale")

	// +optional

	subResource?: string @go(SubResource) @protobuf(4,bytes,opt)

	// RequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale).

	// If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.

	//

	// For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of

	// `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,

	// an API request to apps/v1beta1 deployments would be converted and sent to the webhook

	// with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),

	// and `requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"}` (indicating the kind of the original API request).

	//

	// See documentation for the "matchPolicy" field in the webhook configuration type for more details.

	// +optional

	requestKind?: null | metav1.#GroupVersionKind @go(RequestKind,*metav1.GroupVersionKind) @protobuf(13,bytes,opt)

	// RequestResource is the fully-qualified resource of the original API request (for example, v1.pods).

	// If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.

	//

	// For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of

	// `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,

	// an API request to apps/v1beta1 deployments would be converted and sent to the webhook

	// with `resource: {group:"apps", version:"v1", resource:"deployments"}` (matching the resource the webhook registered for),

	// and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request).

	//

	// See documentation for the "matchPolicy" field in the webhook configuration type.

	// +optional

	requestResource?: null | metav1.#GroupVersionResource @go(RequestResource,*metav1.GroupVersionResource) @protobuf(14,bytes,opt)

	// RequestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale")

	// If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed.

	// See documentation for the "matchPolicy" field in the webhook configuration type.

	// +optional

	requestSubResource?: string @go(RequestSubResource) @protobuf(15,bytes,opt)

	// Name is the name of the object as presented in the request.  On a CREATE operation, the client may omit name and

	// rely on the server to generate the name.  If that is the case, this field will contain an empty string.

	// +optional

	name?: string @go(Name) @protobuf(5,bytes,opt)

	// Namespace is the namespace associated with the request (if any).

	// +optional

	namespace?: string @go(Namespace) @protobuf(6,bytes,opt)

	// Operation is the operation being performed. This may be different than the operation

	// requested. e.g. a patch can result in either a CREATE or UPDATE Operation.

	operation: #Operation @go(Operation) @protobuf(7,bytes,opt)

	// UserInfo is information about the requesting user

	userInfo: authenticationv1.#UserInfo @go(UserInfo) @protobuf(8,bytes,opt)

	// Object is the object from the incoming request.

	// +optional

	object?: runtime.#RawExtension @go(Object) @protobuf(9,bytes,opt)

	// OldObject is the existing object. Only populated for DELETE and UPDATE requests.

	// +optional

	oldObject?: runtime.#RawExtension @go(OldObject) @protobuf(10,bytes,opt)

	// DryRun indicates that modifications will definitely not be persisted for this request.

	// Defaults to false.

	// +optional

	dryRun?: null | bool @go(DryRun,*bool) @protobuf(11,varint,opt)

	// Options is the operation option structure of the operation being performed.

	// e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be

	// different than the options the caller provided. e.g. for a patch request the performed

	// Operation might be a CREATE, in which case the Options will a

	// `meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.

	// +optional

	options?: runtime.#RawExtension @go(Options) @protobuf(12,bytes,opt)

}

// AdmissionResponse describes an admission response.

#AdmissionResponse: {

	// UID is an identifier for the individual request/response.

	// This must be copied over from the corresponding AdmissionRequest.

	uid: types.#UID @go(UID) @protobuf(1,bytes,opt)

	// Allowed indicates whether or not the admission request was permitted.

	allowed: bool @go(Allowed) @protobuf(2,varint,opt)

	// Result contains extra details into why an admission request was denied.

	// This field IS NOT consulted in any way if "Allowed" is "true".

	// +optional

	status?: null | metav1.#Status @go(Result,*metav1.Status) @protobuf(3,bytes,opt)

	// The patch body. Currently we only support "JSONPatch" which implements RFC 6902.

	// +optional

	patch?: bytes @go(Patch,[]byte) @protobuf(4,bytes,opt)

	// The type of Patch. Currently we only allow "JSONPatch".

	// +optional

	patchType?: null | #PatchType @go(PatchType,*PatchType) @protobuf(5,bytes,opt)

	// AuditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted).

	// MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with

	// admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by

	// the admission webhook to add additional context to the audit log for this request.

	// +optional

	auditAnnotations?: {[string]: string} @go(AuditAnnotations,map[string]string) @protobuf(6,bytes,opt)

	// warnings is a list of warning messages to return to the requesting API client.

	// Warning messages describe a problem the client making the API request should correct or be aware of.

	// Limit warnings to 120 characters if possible.

	// Warnings over 256 characters and large numbers of warnings may be truncated.

	// +optional

	warnings?: [...string] @go(Warnings,[]string) @protobuf(7,bytes,rep)

}

// PatchType is the type of patch being used to represent the mutated object

#PatchType: string // #enumPatchType

#enumPatchType:

	#PatchTypeJSONPatch

#PatchTypeJSONPatch: #PatchType & "JSONPatch"

// Operation is the type of resource operation being checked for admission control

#Operation: string // #enumOperation

#enumOperation:

	#Create |

	#Update |

	#Delete |

	#Connect

#Create:  #Operation & "CREATE"

#Update:  #Operation & "UPDATE"

#Delete:  #Operation & "DELETE"

#Connect: #Operation & "CONNECT"

// Code generated by cue get go. DO NOT EDIT.

//cue:generate cue get go k8s.io/api/admissionregistration/v1

// Package v1 is the v1 version of the API.

// AdmissionConfiguration and AdmissionPluginConfiguration are legacy static admission plugin configuration

// MutatingWebhookConfiguration and ValidatingWebhookConfiguration are for the

// new dynamic admission controller configuration.

package v1

// Code generated by cue get go. DO NOT EDIT.

//cue:generate cue get go k8s.io/api/admissionregistration/v1

package v1

#GroupName: "admissionregistration.k8s.io"

// Code generated by cue get go. DO NOT EDIT.

//cue:generate cue get go k8s.io/api/admissionregistration/v1

package v1

import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

// Rule is a tuple of APIGroups, APIVersion, and Resources.It is recommended

// to make sure that all the tuple expansions are valid.

#Rule: {

	// APIGroups is the API groups the resources belong to. '*' is all groups.

	// If '*' is present, the length of the slice must be one.

	// Required.

	// +listType=atomic

	apiGroups?: [...string] @go(APIGroups,[]string) @protobuf(1,bytes,rep)

	// APIVersions is the API versions the resources belong to. '*' is all versions.

	// If '*' is present, the length of the slice must be one.

	// Required.

	// +listType=atomic

	apiVersions?: [...string] @go(APIVersions,[]string) @protobuf(2,bytes,rep)

	// Resources is a list of resources this rule applies to.

	//

	// For example:

	// 'pods' means pods.

	// 'pods/log' means the log subresource of pods.

	// '*' means all resources, but not subresources.

	// 'pods/*' means all subresources of pods.

	// '*/scale' means all scale subresources.

	// '*/*' means all resources and their subresources.

	//

	// If wildcard is present, the validation rule will ensure resources do not

	// overlap with each other.

	//

	// Depending on the enclosing object, subresources might not be allowed.

	// Required.

	// +listType=atomic

	resources?: [...string] @go(Resources,[]string) @protobuf(3,bytes,rep)

	// scope specifies the scope of this rule.

	// Valid values are "Cluster", "Namespaced", and "*"

	// "Cluster" means that only cluster-scoped resources will match this rule.

	// Namespace API objects are cluster-scoped.

	// "Namespaced" means that only namespaced resources will match this rule.

	// "*" means that there are no scope restrictions.

	// Subresources match the scope of their parent resource.

	// Default is "*".

	//

	// +optional

	scope?: null | #ScopeType @go(Scope,*ScopeType) @protobuf(4,bytes,rep)

}

// ScopeType specifies a scope for a Rule.

// +enum

#ScopeType: string // #enumScopeType

#enumScopeType:

	#ClusterScope |

	#NamespacedScope |

	#AllScopes

// ClusterScope means that scope is limited to cluster-scoped objects.

// Namespace objects are cluster-scoped.

#ClusterScope: #ScopeType & "Cluster"

// NamespacedScope means that scope is limited to namespaced objects.

#NamespacedScope: #ScopeType & "Namespaced"

// AllScopes means that all scopes are included.

#AllScopes: #ScopeType & "*"

// FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled.

// +enum

#FailurePolicyType: string // #enumFailurePolicyType

#enumFailurePolicyType:

	#Ignore |

	#Fail

// Ignore means that an error calling the webhook is ignored.

#Ignore: #FailurePolicyType & "Ignore"

// Fail means that an error calling the webhook causes the admission to fail.

#Fail: #FailurePolicyType & "Fail"

// MatchPolicyType specifies the type of match policy.

// +enum

#MatchPolicyType: string // #enumMatchPolicyType

#enumMatchPolicyType:

	#Exact |

	#Equivalent

// Exact means requests should only be sent to the webhook if they exactly match a given rule.

#Exact: #MatchPolicyType & "Exact"

// Equivalent means requests should be sent to the webhook if they modify a resource listed in rules via another API group or version.

#Equivalent: #MatchPolicyType & "Equivalent"

// SideEffectClass specifies the types of side effects a webhook may have.

// +enum

#SideEffectClass: string // #enumSideEffectClass

#enumSideEffectClass:

	#SideEffectClassUnknown |

	#SideEffectClassNone |

	#SideEffectClassSome |

	#SideEffectClassNoneOnDryRun

// SideEffectClassUnknown means that no information is known about the side effects of calling the webhook.

// If a request with the dry-run attribute would trigger a call to this webhook, the request will instead fail.

#SideEffectClassUnknown: #SideEffectClass & "Unknown"

// SideEffectClassNone means that calling the webhook will have no side effects.

#SideEffectClassNone: #SideEffectClass & "None"

// SideEffectClassSome means that calling the webhook will possibly have side effects.

// If a request with the dry-run attribute would trigger a call to this webhook, the request will instead fail.

#SideEffectClassSome: #SideEffectClass & "Some"

// SideEffectClassNoneOnDryRun means that calling the webhook will possibly have side effects, but if the

// request being reviewed has the dry-run attribute, the side effects will be suppressed.

#SideEffectClassNoneOnDryRun: #SideEffectClass & "NoneOnDryRun"

// ValidatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and object without changing it.

#ValidatingWebhookConfiguration: {

	metav1.#TypeMeta

	// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.

	// +optional

	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)

	// Webhooks is a list of webhooks and the affected resources and operations.

	// +optional

	// +patchMergeKey=name

	// +patchStrategy=merge

	webhooks?: [...#ValidatingWebhook] @go(Webhooks,[]ValidatingWebhook) @protobuf(2,bytes,rep,name=Webhooks)

}

// ValidatingWebhookConfigurationList is a list of ValidatingWebhookConfiguration.

#ValidatingWebhookConfigurationList: {

	metav1.#TypeMeta

	// Standard list metadata.

	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

	// +optional

	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)

	// List of ValidatingWebhookConfiguration.

	items: [...#ValidatingWebhookConfiguration] @go(Items,[]ValidatingWebhookConfiguration) @protobuf(2,bytes,rep)

}

// MutatingWebhookConfiguration describes the configuration of and admission webhook that accept or reject and may change the object.

#MutatingWebhookConfiguration: {

	metav1.#TypeMeta

	// Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.

	// +optional

	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)

	// Webhooks is a list of webhooks and the affected resources and operations.

	// +optional

	// +patchMergeKey=name

	// +patchStrategy=merge

	webhooks?: [...#MutatingWebhook] @go(Webhooks,[]MutatingWebhook) @protobuf(2,bytes,rep,name=Webhooks)

}

// MutatingWebhookConfigurationList is a list of MutatingWebhookConfiguration.

#MutatingWebhookConfigurationList: {

	metav1.#TypeMeta

	// Standard list metadata.

	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

	// +optional

	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)

	// List of MutatingWebhookConfiguration.

	items: [...#MutatingWebhookConfiguration] @go(Items,[]MutatingWebhookConfiguration) @protobuf(2,bytes,rep)

}

// ValidatingWebhook describes an admission webhook and the resources and operations it applies to.

#ValidatingWebhook: {

	// The name of the admission webhook.

	// Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where

	// "imagepolicy" is the name of the webhook, and kubernetes.io is the name

	// of the organization.

	// Required.

	name: string @go(Name) @protobuf(1,bytes,opt)

	// ClientConfig defines how to communicate with the hook.

	// Required

	clientConfig: #WebhookClientConfig @go(ClientConfig) @protobuf(2,bytes,opt)

	// Rules describes what operations on what resources/subresources the webhook cares about.

	// The webhook cares about an operation if it matches _any_ Rule.

	// However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks

	// from putting the cluster in a state which cannot be recovered from without completely

	// disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called

	// on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.

	rules?: [...#RuleWithOperations] @go(Rules,[]RuleWithOperations) @protobuf(3,bytes,rep)

	// FailurePolicy defines how unrecognized errors from the admission endpoint are handled -

	// allowed values are Ignore or Fail. Defaults to Fail.

	// +optional

	failurePolicy?: null | #FailurePolicyType @go(FailurePolicy,*FailurePolicyType) @protobuf(4,bytes,opt,casttype=FailurePolicyType)

	// matchPolicy defines how the "rules" list is used to match incoming requests.

	// Allowed values are "Exact" or "Equivalent".

	//

	// - Exact: match a request only if it exactly matches a specified rule.

	// For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,

	// but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,

	// a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook.

	//

	// - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version.

	// For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,

	// and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,

	// a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook.

	//

	// Defaults to "Equivalent"

	// +optional

	matchPolicy?: null | #MatchPolicyType @go(MatchPolicy,*MatchPolicyType) @protobuf(9,bytes,opt,casttype=MatchPolicyType)

	// NamespaceSelector decides whether to run the webhook on an object based

	// on whether the namespace for that object matches the selector. If the

	// object itself is a namespace, the matching is performed on

	// object.metadata.labels. If the object is another cluster scoped resource,

	// it never skips the webhook.

	//

	// For example, to run the webhook on any objects whose namespace is not

	// associated with "runlevel" of "0" or "1";  you will set the selector as

	// follows:

	// "namespaceSelector": {

	//   "matchExpressions": [

	//     {

	//       "key": "runlevel",

	//       "operator": "NotIn",

	//       "values": [

	//         "0",

	//         "1"

	//       ]

	//     }

	//   ]

	// }

	//

	// If instead you want to only run the webhook on any objects whose

	// namespace is associated with the "environment" of "prod" or "staging";

	// you will set the selector as follows:

	// "namespaceSelector": {

	//   "matchExpressions": [

	//     {

	//       "key": "environment",

	//       "operator": "In",

	//       "values": [

	//         "prod",

	//         "staging"

	//       ]

	//     }

	//   ]

	// }

	//

	// See

	// https://kubernetes.io/docs/concepts/overview/working-with-objects/labels

	// for more examples of label selectors.

	//

	// Default to the empty LabelSelector, which matches everything.

	// +optional

	namespaceSelector?: null | metav1.#LabelSelector @go(NamespaceSelector,*metav1.LabelSelector) @protobuf(5,bytes,opt)

	// ObjectSelector decides whether to run the webhook based on if the

	// object has matching labels. objectSelector is evaluated against both

	// the oldObject and newObject that would be sent to the webhook, and

	// is considered to match if either object matches the selector. A null

	// object (oldObject in the case of create, or newObject in the case of

	// delete) or an object that cannot have labels (like a

	// DeploymentRollback or a PodProxyOptions object) is not considered to

	// match.

	// Use the object selector only if the webhook is opt-in, because end

	// users may skip the admission webhook by setting the labels.

	// Default to the empty LabelSelector, which matches everything.

	// +optional

	objectSelector?: null | metav1.#LabelSelector @go(ObjectSelector,*metav1.LabelSelector) @protobuf(10,bytes,opt)

	// SideEffects states whether this webhook has side effects.

	// Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown).

	// Webhooks with side effects MUST implement a reconciliation system, since a request may be

	// rejected by a future step in the admission chain and the side effects therefore need to be undone.

	// Requests with the dryRun attribute will be auto-rejected if they match a webhook with

	// sideEffects == Unknown or Some.

	sideEffects?: null | #SideEffectClass @go(SideEffects,*SideEffectClass) @protobuf(6,bytes,opt,casttype=SideEffectClass)

	// TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,

	// the webhook call will be ignored or the API call will fail based on the

	// failure policy.

	// The timeout value must be between 1 and 30 seconds.

	// Default to 10 seconds.

	// +optional

	timeoutSeconds?: null | int32 @go(TimeoutSeconds,*int32) @protobuf(7,varint,opt)

	// AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`

	// versions the Webhook expects. API server will try to use first version in

	// the list which it supports. If none of the versions specified in this list

	// supported by API server, validation will fail for this object.

	// If a persisted webhook configuration specifies allowed versions and does not

	// include any versions known to the API Server, calls to the webhook will fail

	// and be subject to the failure policy.

	admissionReviewVersions: [...string] @go(AdmissionReviewVersions,[]string) @protobuf(8,bytes,rep)

	// MatchConditions is a list of conditions that must be met for a request to be sent to this

	// webhook. Match conditions filter requests that have already been matched by the rules,

	// namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.

	// There are a maximum of 64 match conditions allowed.

	//

	// The exact matching logic is (in order):

	//   1. If ANY matchCondition evaluates to FALSE, the webhook is skipped.

	//   2. If ALL matchConditions evaluate to TRUE, the webhook is called.

	//   3. If any matchCondition evaluates to an error (but none are FALSE):

	//      - If failurePolicy=Fail, reject the request

	//      - If failurePolicy=Ignore, the error is ignored and the webhook is skipped

	//

	// This is a beta feature and managed by the AdmissionWebhookMatchConditions feature gate.

	//

	// +patchMergeKey=name

	// +patchStrategy=merge

	// +listType=map

	// +listMapKey=name

	// +featureGate=AdmissionWebhookMatchConditions

	// +optional

	matchConditions?: [...#MatchCondition] @go(MatchConditions,[]MatchCondition) @protobuf(11,bytes,opt)

}

// MutatingWebhook describes an admission webhook and the resources and operations it applies to.

#MutatingWebhook: {

	// The name of the admission webhook.

	// Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where

	// "imagepolicy" is the name of the webhook, and kubernetes.io is the name

	// of the organization.

	// Required.

	name: string @go(Name) @protobuf(1,bytes,opt)

	// ClientConfig defines how to communicate with the hook.

	// Required

	clientConfig: #WebhookClientConfig @go(ClientConfig) @protobuf(2,bytes,opt)

	// Rules describes what operations on what resources/subresources the webhook cares about.

	// The webhook cares about an operation if it matches _any_ Rule.

	// However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks

	// from putting the cluster in a state which cannot be recovered from without completely

	// disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called

	// on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.

	rules?: [...#RuleWithOperations] @go(Rules,[]RuleWithOperations) @protobuf(3,bytes,rep)

	// FailurePolicy defines how unrecognized errors from the admission endpoint are handled -

	// allowed values are Ignore or Fail. Defaults to Fail.

	// +optional

	failurePolicy?: null | #FailurePolicyType @go(FailurePolicy,*FailurePolicyType) @protobuf(4,bytes,opt,casttype=FailurePolicyType)

	// matchPolicy defines how the "rules" list is used to match incoming requests.

	// Allowed values are "Exact" or "Equivalent".

	//

	// - Exact: match a request only if it exactly matches a specified rule.

	// For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,

	// but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,

	// a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook.

	//

	// - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version.

	// For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,

	// and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,

	// a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook.

	//

	// Defaults to "Equivalent"

	// +optional

	matchPolicy?: null | #MatchPolicyType @go(MatchPolicy,*MatchPolicyType) @protobuf(9,bytes,opt,casttype=MatchPolicyType)

	// NamespaceSelector decides whether to run the webhook on an object based

	// on whether the namespace for that object matches the selector. If the

	// object itself is a namespace, the matching is performed on

	// object.metadata.labels. If the object is another cluster scoped resource,

	// it never skips the webhook.

	//

	// For example, to run the webhook on any objects whose namespace is not

	// associated with "runlevel" of "0" or "1";  you will set the selector as

	// follows:

	// "namespaceSelector": {

	//   "matchExpressions": [

	//     {

	//       "key": "runlevel",

	//       "operator": "NotIn",

	//       "values": [

	//         "0",

	//         "1"

	//       ]

	//     }

	//   ]

	// }

	//

	// If instead you want to only run the webhook on any objects whose

	// namespace is associated with the "environment" of "prod" or "staging";

	// you will set the selector as follows:

	// "namespaceSelector": {

	//   "matchExpressions": [

	//     {

	//       "key": "environment",

	//       "operator": "In",

	//       "values": [

	//         "prod",

	//         "staging"

	//       ]

	//     }

	//   ]

	// }

	//

	// See

	// https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/

	// for more examples of label selectors.

	//

	// Default to the empty LabelSelector, which matches everything.

	// +optional

	namespaceSelector?: null | metav1.#LabelSelector @go(NamespaceSelector,*metav1.LabelSelector) @protobuf(5,bytes,opt)

	// ObjectSelector decides whether to run the webhook based on if the

	// object has matching labels. objectSelector is evaluated against both

	// the oldObject and newObject that would be sent to the webhook, and

	// is considered to match if either object matches the selector. A null

	// object (oldObject in the case of create, or newObject in the case of

	// delete) or an object that cannot have labels (like a

	// DeploymentRollback or a PodProxyOptions object) is not considered to

	// match.

	// Use the object selector only if the webhook is opt-in, because end

	// users may skip the admission webhook by setting the labels.

	// Default to the empty LabelSelector, which matches everything.

	// +optional

	objectSelector?: null | metav1.#LabelSelector @go(ObjectSelector,*metav1.LabelSelector) @protobuf(11,bytes,opt)

	// SideEffects states whether this webhook has side effects.

	// Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown).

	// Webhooks with side effects MUST implement a reconciliation system, since a request may be

	// rejected by a future step in the admission chain and the side effects therefore need to be undone.

	// Requests with the dryRun attribute will be auto-rejected if they match a webhook with

	// sideEffects == Unknown or Some.

	sideEffects?: null | #SideEffectClass @go(SideEffects,*SideEffectClass) @protobuf(6,bytes,opt,casttype=SideEffectClass)

	// TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,

	// the webhook call will be ignored or the API call will fail based on the

	// failure policy.

	// The timeout value must be between 1 and 30 seconds.

	// Default to 10 seconds.

	// +optional

	timeoutSeconds?: null | int32 @go(TimeoutSeconds,*int32) @protobuf(7,varint,opt)

	// AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`

	// versions the Webhook expects. API server will try to use first version in

	// the list which it supports. If none of the versions specified in this list

	// supported by API server, validation will fail for this object.

	// If a persisted webhook configuration specifies allowed versions and does not

	// include any versions known to the API Server, calls to the webhook will fail

	// and be subject to the failure policy.

	admissionReviewVersions: [...string] @go(AdmissionReviewVersions,[]string) @protobuf(8,bytes,rep)

	// reinvocationPolicy indicates whether this webhook should be called multiple times as part of a single admission evaluation.

	// Allowed values are "Never" and "IfNeeded".

	//

	// Never: the webhook will not be called more than once in a single admission evaluation.

	//

	// IfNeeded: the webhook will be called at least one additional time as part of the admission evaluation

	// if the object being admitted is modified by other admission plugins after the initial webhook call.

	// Webhooks that specify this option *must* be idempotent, able to process objects they previously admitted.

	// Note:

	// * the number of additional invocations is not guaranteed to be exactly one.

	// * if additional invocations result in further modifications to the object, webhooks are not guaranteed to be invoked again.

	// * webhooks that use this option may be reordered to minimize the number of additional invocations.

	// * to validate an object after all mutations are guaranteed complete, use a validating admission webhook instead.

	//

	// Defaults to "Never".

	// +optional

	reinvocationPolicy?: null | #ReinvocationPolicyType @go(ReinvocationPolicy,*ReinvocationPolicyType) @protobuf(10,bytes,opt,casttype=ReinvocationPolicyType)

	// MatchConditions is a list of conditions that must be met for a request to be sent to this

	// webhook. Match conditions filter requests that have already been matched by the rules,

	// namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.

	// There are a maximum of 64 match conditions allowed.

	//

	// The exact matching logic is (in order):

	//   1. If ANY matchCondition evaluates to FALSE, the webhook is skipped.

	//   2. If ALL matchConditions evaluate to TRUE, the webhook is called.

	//   3. If any matchCondition evaluates to an error (but none are FALSE):

	//      - If failurePolicy=Fail, reject the request

	//      - If failurePolicy=Ignore, the error is ignored and the webhook is skipped

	//

	// This is a beta feature and managed by the AdmissionWebhookMatchConditions feature gate.

	//

	// +patchMergeKey=name

	// +patchStrategy=merge

	// +listType=map

	// +listMapKey=name

	// +featureGate=AdmissionWebhookMatchConditions

	// +optional

	matchConditions?: [...#MatchCondition] @go(MatchConditions,[]MatchCondition) @protobuf(12,bytes,opt)

}

// ReinvocationPolicyType specifies what type of policy the admission hook uses.

// +enum

#ReinvocationPolicyType: string // #enumReinvocationPolicyType

#enumReinvocationPolicyType:

	#NeverReinvocationPolicy |

	#IfNeededReinvocationPolicy

// NeverReinvocationPolicy indicates that the webhook must not be called more than once in a

// single admission evaluation.

#NeverReinvocationPolicy: #ReinvocationPolicyType & "Never"

// IfNeededReinvocationPolicy indicates that the webhook may be called at least one

// additional time as part of the admission evaluation if the object being admitted is

// modified by other admission plugins after the initial webhook call.

#IfNeededReinvocationPolicy: #ReinvocationPolicyType & "IfNeeded"

// RuleWithOperations is a tuple of Operations and Resources. It is recommended to make

// sure that all the tuple expansions are valid.

#RuleWithOperations: {

	// Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or *

	// for all of those operations and any future admission operations that are added.

	// If '*' is present, the length of the slice must be one.

	// Required.

	// +listType=atomic

	operations?: [...#OperationType] @go(Operations,[]OperationType) @protobuf(1,bytes,rep,casttype=OperationType)

	#Rule

}

// OperationType specifies an operation for a request.

// +enum

#OperationType: string // #enumOperationType

#enumOperationType:

	#OperationAll |

	#Create |

	#Update |

	#Delete |

	#Connect

#OperationAll: #OperationType & "*"

#Create:       #OperationType & "CREATE"

#Update:       #OperationType & "UPDATE"

#Delete:       #OperationType & "DELETE"

#Connect:      #OperationType & "CONNECT"

// WebhookClientConfig contains the information to make a TLS

// connection with the webhook

#WebhookClientConfig: {

	// `url` gives the location of the webhook, in standard URL form

	// (`scheme://host:port/path`). Exactly one of `url` or `service`

	// must be specified.

	//

	// The `host` should not refer to a service running in the cluster; use

	// the `service` field instead. The host might be resolved via external

	// DNS in some apiservers (e.g., `kube-apiserver` cannot resolve

	// in-cluster DNS as that would be a layering violation). `host` may

	// also be an IP address.

	//

	// Please note that using `localhost` or `127.0.0.1` as a `host` is

	// risky unless you take great care to run this webhook on all hosts

	// which run an apiserver which might need to make calls to this

	// webhook. Such installs are likely to be non-portable, i.e., not easy

	// to turn up in a new cluster.

	//

	// The scheme must be "https"; the URL must begin with "https://".

	//

	// A path is optional, and if present may be any string permissible in

	// a URL. You may use the path to pass an arbitrary string to the

	// webhook, for example, a cluster identifier.

	//

	// Attempting to use a user or basic auth e.g. "user:password@" is not

	// allowed. Fragments ("#...") and query parameters ("?...") are not

	// allowed, either.

	//

	// +optional

	url?: null | string @go(URL,*string) @protobuf(3,bytes,opt)

	// `service` is a reference to the service for this webhook. Either

	// `service` or `url` must be specified.

	//

	// If the webhook is running within the cluster, then you should use `service`.

	//

	// +optional

	service?: null | #ServiceReference @go(Service,*ServiceReference) @protobuf(1,bytes,opt)

	// `caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.

	// If unspecified, system trust roots on the apiserver are used.

	// +optional

	caBundle?: bytes @go(CABundle,[]byte) @protobuf(2,bytes,opt)

}

// ServiceReference holds a reference to Service.legacy.k8s.io

#ServiceReference: {

	// `namespace` is the namespace of the service.

	// Required

	namespace: string @go(Namespace) @protobuf(1,bytes,opt)

	// `name` is the name of the service.

	// Required

	name: string @go(Name) @protobuf(2,bytes,opt)

	// `path` is an optional URL path which will be sent in any request to

	// this service.

	// +optional

	path?: null | string @go(Path,*string) @protobuf(3,bytes,opt)

	// If specified, the port on the service that hosting webhook.

	// Default to 443 for backward compatibility.

	// `port` should be a valid port number (1-65535, inclusive).

	// +optional

	port?: null | int32 @go(Port,*int32) @protobuf(4,varint,opt)

}

// MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook.

#MatchCondition: {

	// Name is an identifier for this match condition, used for strategic merging of MatchConditions,

	// as well as providing an identifier for logging purposes. A good name should be descriptive of

	// the associated expression.

	// Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and

	// must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or

	// '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an

	// optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')

	//

	// Required.

	name: string @go(Name) @protobuf(1,bytes,opt)

	// Expression represents the expression which will be evaluated by CEL. Must evaluate to bool.

	// CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:

	//

	// 'object' - The object from the incoming request. The value is null for DELETE requests.

	// 'oldObject' - The existing object. The value is null for CREATE requests.

	// 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).

	// 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.

	//   See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz

	// 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the

	//   request resource.

	// Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/

	//

	// Required.

	expression: string @go(Expression) @protobuf(2,bytes,opt)

}

// Code generated by cue get go. DO NOT EDIT.

//cue:generate cue get go k8s.io/api/apps/v1

package v1

#GroupName: "apps"

// Code generated by cue get go. DO NOT EDIT.

//cue:generate cue get go k8s.io/api/apps/v1

package v1

import (

	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

	"k8s.io/apimachinery/pkg/util/intstr"

	"k8s.io/api/core/v1"

	"k8s.io/apimachinery/pkg/runtime"

)

#ControllerRevisionHashLabelKey: "controller-revision-hash"

#StatefulSetRevisionLabel:       "controller-revision-hash"

#DeprecatedRollbackTo:           "deprecated.deployment.rollback.to"

#DeprecatedTemplateGeneration:   "deprecated.daemonset.template.generation"

#StatefulSetPodNameLabel:        "statefulset.kubernetes.io/pod-name"

#PodIndexLabel:                  "apps.kubernetes.io/pod-index"

// StatefulSet represents a set of pods with consistent identities.

// Identities are defined as:

//   - Network: A single stable DNS and hostname.

//   - Storage: As many VolumeClaims as requested.

//

// The StatefulSet guarantees that a given network identity will always

// map to the same storage identity.

#StatefulSet: {

	metav1.#TypeMeta

	// Standard object's metadata.

	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

	// +optional

	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)

	// Spec defines the desired identities of pods in this set.

	// +optional

	spec?: #StatefulSetSpec @go(Spec) @protobuf(2,bytes,opt)

	// Status is the current status of Pods in this StatefulSet. This data

	// may be out of date by some window of time.

	// +optional

	status?: #StatefulSetStatus @go(Status) @protobuf(3,bytes,opt)

}

// PodManagementPolicyType defines the policy for creating pods under a stateful set.

// +enum

#PodManagementPolicyType: string // #enumPodManagementPolicyType

#enumPodManagementPolicyType:

	#OrderedReadyPodManagement |

	#ParallelPodManagement

// OrderedReadyPodManagement will create pods in strictly increasing order on

// scale up and strictly decreasing order on scale down, progressing only when

// the previous pod is ready or terminated. At most one pod will be changed

// at any time.

#OrderedReadyPodManagement: #PodManagementPolicyType & "OrderedReady"

// ParallelPodManagement will create and delete pods as soon as the stateful set

// replica count is changed, and will not wait for pods to be ready or complete

// termination.

#ParallelPodManagement: #PodManagementPolicyType & "Parallel"

// StatefulSetUpdateStrategy indicates the strategy that the StatefulSet

// controller will use to perform updates. It includes any additional parameters

// necessary to perform the update for the indicated strategy.

#StatefulSetUpdateStrategy: {

	// Type indicates the type of the StatefulSetUpdateStrategy.

	// Default is RollingUpdate.

	// +optional

	type?: #StatefulSetUpdateStrategyType @go(Type) @protobuf(1,bytes,opt,casttype=StatefulSetStrategyType)

	// RollingUpdate is used to communicate parameters when Type is RollingUpdateStatefulSetStrategyType.

	// +optional

	rollingUpdate?: null | #RollingUpdateStatefulSetStrategy @go(RollingUpdate,*RollingUpdateStatefulSetStrategy) @protobuf(2,bytes,opt)

}

// StatefulSetUpdateStrategyType is a string enumeration type that enumerates

// all possible update strategies for the StatefulSet controller.

// +enum

#StatefulSetUpdateStrategyType: string // #enumStatefulSetUpdateStrategyType

#enumStatefulSetUpdateStrategyType:

	#RollingUpdateStatefulSetStrategyType |

	#OnDeleteStatefulSetStrategyType

// RollingUpdateStatefulSetStrategyType indicates that update will be

// applied to all Pods in the StatefulSet with respect to the StatefulSet

// ordering constraints. When a scale operation is performed with this

// strategy, new Pods will be created from the specification version indicated

// by the StatefulSet's updateRevision.

#RollingUpdateStatefulSetStrategyType: #StatefulSetUpdateStrategyType & "RollingUpdate"

// OnDeleteStatefulSetStrategyType triggers the legacy behavior. Version

// tracking and ordered rolling restarts are disabled. Pods are recreated

// from the StatefulSetSpec when they are manually deleted. When a scale

// operation is performed with this strategy,specification version indicated

// by the StatefulSet's currentRevision.

#OnDeleteStatefulSetStrategyType: #StatefulSetUpdateStrategyType & "OnDelete"

// RollingUpdateStatefulSetStrategy is used to communicate parameter for RollingUpdateStatefulSetStrategyType.

#RollingUpdateStatefulSetStrategy: {

	// Partition indicates the ordinal at which the StatefulSet should be partitioned

	// for updates. During a rolling update, all pods from ordinal Replicas-1 to

	// Partition are updated. All pods from ordinal Partition-1 to 0 remain untouched.

	// This is helpful in being able to do a canary based deployment. The default value is 0.

	// +optional

	partition?: null | int32 @go(Partition,*int32) @protobuf(1,varint,opt)

	// The maximum number of pods that can be unavailable during the update.

	// Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).

	// Absolute number is calculated from percentage by rounding up. This can not be 0.

	// Defaults to 1. This field is alpha-level and is only honored by servers that enable the

	// MaxUnavailableStatefulSet feature. The field applies to all pods in the range 0 to

	// Replicas-1. That means if there is any unavailable pod in the range 0 to Replicas-1, it

	// will be counted towards MaxUnavailable.

	// +optional

	maxUnavailable?: null | intstr.#IntOrString @go(MaxUnavailable,*intstr.IntOrString) @protobuf(2,varint,opt)

}

// PersistentVolumeClaimRetentionPolicyType is a string enumeration of the policies that will determine

// when volumes from the VolumeClaimTemplates will be deleted when the controlling StatefulSet is

// deleted or scaled down.

#PersistentVolumeClaimRetentionPolicyType: string // #enumPersistentVolumeClaimRetentionPolicyType

#enumPersistentVolumeClaimRetentionPolicyType:

	#RetainPersistentVolumeClaimRetentionPolicyType |

	#DeletePersistentVolumeClaimRetentionPolicyType

// RetainPersistentVolumeClaimRetentionPolicyType is the default

// PersistentVolumeClaimRetentionPolicy and specifies that

// PersistentVolumeClaims associated with StatefulSet VolumeClaimTemplates

// will not be deleted.

#RetainPersistentVolumeClaimRetentionPolicyType: #PersistentVolumeClaimRetentionPolicyType & "Retain"

// RetentionPersistentVolumeClaimRetentionPolicyType specifies that

// PersistentVolumeClaims associated with StatefulSet VolumeClaimTemplates

// will be deleted in the scenario specified in

// StatefulSetPersistentVolumeClaimRetentionPolicy.

#DeletePersistentVolumeClaimRetentionPolicyType: #PersistentVolumeClaimRetentionPolicyType & "Delete"

// StatefulSetPersistentVolumeClaimRetentionPolicy describes the policy used for PVCs

// created from the StatefulSet VolumeClaimTemplates.

#StatefulSetPersistentVolumeClaimRetentionPolicy: {

	// WhenDeleted specifies what happens to PVCs created from StatefulSet

	// VolumeClaimTemplates when the StatefulSet is deleted. The default policy

	// of `Retain` causes PVCs to not be affected by StatefulSet deletion. The

	// `Delete` policy causes those PVCs to be deleted.

	whenDeleted?: #PersistentVolumeClaimRetentionPolicyType @go(WhenDeleted) @protobuf(1,bytes,opt,casttype=PersistentVolumeClaimRetentionPolicyType)

	// WhenScaled specifies what happens to PVCs created from StatefulSet

	// VolumeClaimTemplates when the StatefulSet is scaled down. The default

	// policy of `Retain` causes PVCs to not be affected by a scaledown. The

	// `Delete` policy causes the associated PVCs for any excess pods above

	// the replica count to be deleted.

	whenScaled?: #PersistentVolumeClaimRetentionPolicyType @go(WhenScaled) @protobuf(2,bytes,opt,casttype=PersistentVolumeClaimRetentionPolicyType)

}

// StatefulSetOrdinals describes the policy used for replica ordinal assignment

// in this StatefulSet.

#StatefulSetOrdinals: {

	// start is the number representing the first replica's index. It may be used

	// to number replicas from an alternate index (eg: 1-indexed) over the default

	// 0-indexed names, or to orchestrate progressive movement of replicas from

	// one StatefulSet to another.

	// If set, replica indices will be in the range:

	//   [.spec.ordinals.start, .spec.ordinals.start + .spec.replicas).

	// If unset, defaults to 0. Replica indices will be in the range:

	//   [0, .spec.replicas).

	// +optional

	start: int32 @go(Start) @protobuf(1,varint,opt)

}

// A StatefulSetSpec is the specification of a StatefulSet.

#StatefulSetSpec: {

	// replicas is the desired number of replicas of the given Template.

	// These are replicas in the sense that they are instantiations of the

	// same Template, but individual replicas also have a consistent identity.

	// If unspecified, defaults to 1.

	// TODO: Consider a rename of this field.

	// +optional

	replicas?: null | int32 @go(Replicas,*int32) @protobuf(1,varint,opt)

	// selector is a label query over pods that should match the replica count.

	// It must match the pod template's labels.

	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors

	selector?: null | metav1.#LabelSelector @go(Selector,*metav1.LabelSelector) @protobuf(2,bytes,opt)

	// template is the object that describes the pod that will be created if

	// insufficient replicas are detected. Each pod stamped out by the StatefulSet

	// will fulfill this Template, but have a unique identity from the rest

	// of the StatefulSet. Each pod will be named with the format

	// <statefulsetname>-<podindex>. For example, a pod in a StatefulSet named

	// "web" with index number "3" would be named "web-3".

	// The only allowed template.spec.restartPolicy value is "Always".

	template: v1.#PodTemplateSpec @go(Template) @protobuf(3,bytes,opt)

	// volumeClaimTemplates is a list of claims that pods are allowed to reference.

	// The StatefulSet controller is responsible for mapping network identities to

	// claims in a way that maintains the identity of a pod. Every claim in

	// this list must have at least one matching (by name) volumeMount in one

	// container in the template. A claim in this list takes precedence over

	// any volumes in the template, with the same name.

	// TODO: Define the behavior if a claim already exists with the same name.

	// +optional

	volumeClaimTemplates?: [...v1.#PersistentVolumeClaim] @go(VolumeClaimTemplates,[]v1.PersistentVolumeClaim) @protobuf(4,bytes,rep)

	// serviceName is the name of the service that governs this StatefulSet.

	// This service must exist before the StatefulSet, and is responsible for

	// the network identity of the set. Pods get DNS/hostnames that follow the

	// pattern: pod-specific-string.serviceName.default.svc.cluster.local

	// where "pod-specific-string" is managed by the StatefulSet controller.

	serviceName: string @go(ServiceName) @protobuf(5,bytes,opt)

	// podManagementPolicy controls how pods are created during initial scale up,

	// when replacing pods on nodes, or when scaling down. The default policy is

	// `OrderedReady`, where pods are created in increasing order (pod-0, then

	// pod-1, etc) and the controller will wait until each pod is ready before

	// continuing. When scaling down, the pods are removed in the opposite order.

	// The alternative policy is `Parallel` which will create pods in parallel

	// to match the desired scale without waiting, and on scale down will delete

	// all pods at once.

	// +optional

	podManagementPolicy?: #PodManagementPolicyType @go(PodManagementPolicy) @protobuf(6,bytes,opt,casttype=PodManagementPolicyType)

	// updateStrategy indicates the StatefulSetUpdateStrategy that will be

	// employed to update Pods in the StatefulSet when a revision is made to

	// Template.

	updateStrategy?: #StatefulSetUpdateStrategy @go(UpdateStrategy) @protobuf(7,bytes,opt)

	// revisionHistoryLimit is the maximum number of revisions that will

	// be maintained in the StatefulSet's revision history. The revision history

	// consists of all revisions not represented by a currently applied

	// StatefulSetSpec version. The default value is 10.

	revisionHistoryLimit?: null | int32 @go(RevisionHistoryLimit,*int32) @protobuf(8,varint,opt)

	// Minimum number of seconds for which a newly created pod should be ready

	// without any of its container crashing for it to be considered available.

	// Defaults to 0 (pod will be considered available as soon as it is ready)

	// +optional

	minReadySeconds?: int32 @go(MinReadySeconds) @protobuf(9,varint,opt)

	// persistentVolumeClaimRetentionPolicy describes the lifecycle of persistent

	// volume claims created from volumeClaimTemplates. By default, all persistent

	// volume claims are created as needed and retained until manually deleted. This

	// policy allows the lifecycle to be altered, for example by deleting persistent

	// volume claims when their stateful set is deleted, or when their pod is scaled

	// down. This requires the StatefulSetAutoDeletePVC feature gate to be enabled,

	// which is alpha.  +optional

	persistentVolumeClaimRetentionPolicy?: null | #StatefulSetPersistentVolumeClaimRetentionPolicy @go(PersistentVolumeClaimRetentionPolicy,*StatefulSetPersistentVolumeClaimRetentionPolicy) @protobuf(10,bytes,opt)

	// ordinals controls the numbering of replica indices in a StatefulSet. The

	// default ordinals behavior assigns a "0" index to the first replica and

	// increments the index by one for each additional replica requested. Using

	// the ordinals field requires the StatefulSetStartOrdinal feature gate to be

	// enabled, which is beta.

	// +optional

	ordinals?: null | #StatefulSetOrdinals @go(Ordinals,*StatefulSetOrdinals) @protobuf(11,bytes,opt)

}

// StatefulSetStatus represents the current state of a StatefulSet.

#StatefulSetStatus: {

	// observedGeneration is the most recent generation observed for this StatefulSet. It corresponds to the

	// StatefulSet's generation, which is updated on mutation by the API Server.

	// +optional

	observedGeneration?: int64 @go(ObservedGeneration) @protobuf(1,varint,opt)

	// replicas is the number of Pods created by the StatefulSet controller.

	replicas: int32 @go(Replicas) @protobuf(2,varint,opt)

	// readyReplicas is the number of pods created for this StatefulSet with a Ready Condition.

	readyReplicas?: int32 @go(ReadyReplicas) @protobuf(3,varint,opt)

	// currentReplicas is the number of Pods created by the StatefulSet controller from the StatefulSet version

	// indicated by currentRevision.

	currentReplicas?: int32 @go(CurrentReplicas) @protobuf(4,varint,opt)

	// updatedReplicas is the number of Pods created by the StatefulSet controller from the StatefulSet version

	// indicated by updateRevision.

	updatedReplicas?: int32 @go(UpdatedReplicas) @protobuf(5,varint,opt)

	// currentRevision, if not empty, indicates the version of the StatefulSet used to generate Pods in the

	// sequence [0,currentReplicas).

	currentRevision?: string @go(CurrentRevision) @protobuf(6,bytes,opt)

	// updateRevision, if not empty, indicates the version of the StatefulSet used to generate Pods in the sequence

	// [replicas-updatedReplicas,replicas)

	updateRevision?: string @go(UpdateRevision) @protobuf(7,bytes,opt)

	// collisionCount is the count of hash collisions for the StatefulSet. The StatefulSet controller

	// uses this field as a collision avoidance mechanism when it needs to create the name for the

	// newest ControllerRevision.

	// +optional

	collisionCount?: null | int32 @go(CollisionCount,*int32) @protobuf(9,varint,opt)

	// Represents the latest available observations of a statefulset's current state.

	// +optional

	// +patchMergeKey=type

	// +patchStrategy=merge

	conditions?: [...#StatefulSetCondition] @go(Conditions,[]StatefulSetCondition) @protobuf(10,bytes,rep)

	// Total number of available pods (ready for at least minReadySeconds) targeted by this statefulset.

	// +optional

	availableReplicas: int32 @go(AvailableReplicas) @protobuf(11,varint,opt)

}

#StatefulSetConditionType: string

// StatefulSetCondition describes the state of a statefulset at a certain point.

#StatefulSetCondition: {

	// Type of statefulset condition.

	type: #StatefulSetConditionType @go(Type) @protobuf(1,bytes,opt,casttype=StatefulSetConditionType)

	// Status of the condition, one of True, False, Unknown.

	status: v1.#ConditionStatus @go(Status) @protobuf(2,bytes,opt,casttype=k8s.io/api/core/v1.ConditionStatus)

	// Last time the condition transitioned from one status to another.

	// +optional

	lastTransitionTime?: metav1.#Time @go(LastTransitionTime) @protobuf(3,bytes,opt)

	// The reason for the condition's last transition.

	// +optional

	reason?: string @go(Reason) @protobuf(4,bytes,opt)

	// A human readable message indicating details about the transition.

	// +optional

	message?: string @go(Message) @protobuf(5,bytes,opt)

}

// StatefulSetList is a collection of StatefulSets.

#StatefulSetList: {

	metav1.#TypeMeta

	// Standard list's metadata.

	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

	// +optional

	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)

	// Items is the list of stateful sets.

	items: [...#StatefulSet] @go(Items,[]StatefulSet) @protobuf(2,bytes,rep)

}

// Deployment enables declarative updates for Pods and ReplicaSets.

#Deployment: {

	metav1.#TypeMeta

	// Standard object's metadata.

	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

	// +optional

	metadata?: metav1.#ObjectMeta @go(ObjectMeta) @protobuf(1,bytes,opt)

	// Specification of the desired behavior of the Deployment.

	// +optional

	spec?: #DeploymentSpec @go(Spec) @protobuf(2,bytes,opt)

	// Most recently observed status of the Deployment.

	// +optional

	status?: #DeploymentStatus @go(Status) @protobuf(3,bytes,opt)

}

// DeploymentSpec is the specification of the desired behavior of the Deployment.

#DeploymentSpec: {

	// Number of desired pods. This is a pointer to distinguish between explicit

	// zero and not specified. Defaults to 1.

	// +optional

	replicas?: null | int32 @go(Replicas,*int32) @protobuf(1,varint,opt)

	// Label selector for pods. Existing ReplicaSets whose pods are

	// selected by this will be the ones affected by this deployment.

	// It must match the pod template's labels.

	selector?: null | metav1.#LabelSelector @go(Selector,*metav1.LabelSelector) @protobuf(2,bytes,opt)

	// Template describes the pods that will be created.

	// The only allowed template.spec.restartPolicy value is "Always".

	template: v1.#PodTemplateSpec @go(Template) @protobuf(3,bytes,opt)

	// The deployment strategy to use to replace existing pods with new ones.

	// +optional

	// +patchStrategy=retainKeys

	strategy?: #DeploymentStrategy @go(Strategy) @protobuf(4,bytes,opt)

	// Minimum number of seconds for which a newly created pod should be ready

	// without any of its container crashing, for it to be considered available.

	// Defaults to 0 (pod will be considered available as soon as it is ready)

	// +optional

	minReadySeconds?: int32 @go(MinReadySeconds) @protobuf(5,varint,opt)

	// The number of old ReplicaSets to retain to allow rollback.

	// This is a pointer to distinguish between explicit zero and not specified.

	// Defaults to 10.

	// +optional

	revisionHistoryLimit?: null | int32 @go(RevisionHistoryLimit,*int32) @protobuf(6,varint,opt)

	// Indicates that the deployment is paused.

	// +optional

	paused?: bool @go(Paused) @protobuf(7,varint,opt)

	// The maximum time in seconds for a deployment to make progress before it

	// is considered to be failed. The deployment controller will continue to

	// process failed deployments and a condition with a ProgressDeadlineExceeded

	// reason will be surfaced in the deployment status. Note that progress will

	// not be estimated during the time a deployment is paused. Defaults to 600s.

	progressDeadlineSeconds?: null | int32 @go(ProgressDeadlineSeconds,*int32) @protobuf(9,varint,opt)

}

// DefaultDeploymentUniqueLabelKey is the default key of the selector that is added

// to existing ReplicaSets (and label key that is added to its pods) to prevent the existing ReplicaSets

// to select new pods (and old pods being select by new ReplicaSet).

#DefaultDeploymentUniqueLabelKey: "pod-template-hash"

// DeploymentStrategy describes how to replace existing pods with new ones.

#DeploymentStrategy: {

	// Type of deployment. Can be "Recreate" or "RollingUpdate". Default is RollingUpdate.

	// +optional

	type?: #DeploymentStrategyType @go(Type) @protobuf(1,bytes,opt,casttype=DeploymentStrategyType)

	// Rolling update config params. Present only if DeploymentStrategyType =

	// RollingUpdate.

	//---

	// TODO: Update this to follow our convention for oneOf, whatever we decide it

	// to be.

	// +optional

	rollingUpdate?: null | #RollingUpdateDeployment @go(RollingUpdate,*RollingUpdateDeployment) @protobuf(2,bytes,opt)

}

// +enum

#DeploymentStrategyType: string // #enumDeploymentStrategyType

#enumDeploymentStrategyType:

	#RecreateDeploymentStrategyType |

	#RollingUpdateDeploymentStrategyType

// Kill all existing pods before creating new ones.

#RecreateDeploymentStrategyType: #DeploymentStrategyType & "Recreate"

// Replace the old ReplicaSets by new one using rolling update i.e gradually scale down the old ReplicaSets and scale up the new one.

#RollingUpdateDeploymentStrategyType: #DeploymentStrategyType & "RollingUpdate"

// Spec to control the desired behavior of rolling update.

#RollingUpdateDeployment: {

	// The maximum number of pods that can be unavailable during the update.

	// Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).

	// Absolute number is calculated from percentage by rounding down.

	// This can not be 0 if MaxSurge is 0.

	// Defaults to 25%.

	// Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods

	// immediately when the rolling update starts. Once new pods are ready, old ReplicaSet

	// can be scaled down further, followed by scaling up the new ReplicaSet, ensuring

	// that the total number of pods available at all times during the update is at

	// least 70% of desired pods.

	// +optional

	maxUnavailable?: null | intstr.#IntOrString @go(MaxUnavailable,*intstr.IntOrString) @protobuf(1,bytes,opt)

	// The maximum number of pods that can be scheduled above the desired number of

	// pods.

	// Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).

	// This can not be 0 if MaxUnavailable is 0.

	// Absolute number is calculated from percentage by rounding up.

	// Defaults to 25%.

	// Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when

	// the rolling update starts, such that the total number of old and new pods do not exceed

	// 130% of desired pods. Once old pods have been killed,

	// new ReplicaSet can be scaled up further, ensuring that total number of pods running

	// at any time during the update is at most 130% of desired pods.

	// +optional

	maxSurge?: null | intstr.#IntOrString @go(MaxSurge,*intstr.IntOrString) @protobuf(2,bytes,opt)

}

// DeploymentStatus is the most recently observed status of the Deployment.

#DeploymentStatus: {

	// The generation observed by the deployment controller.

	// +optional

	observedGeneration?: int64 @go(ObservedGeneration) @protobuf(1,varint,opt)

	// Total number of non-terminated pods targeted by this deployment (their labels match the selector).

	// +optional

	replicas?: int32 @go(Replicas) @protobuf(2,varint,opt)

	// Total number of non-terminated pods targeted by this deployment that have the desired template spec.

	// +optional

	updatedReplicas?: int32 @go(UpdatedReplicas) @protobuf(3,varint,opt)

	// readyReplicas is the number of pods targeted by this Deployment with a Ready Condition.

	// +optional

	readyReplicas?: int32 @go(ReadyReplicas) @protobuf(7,varint,opt)

	// Total number of available pods (ready for at least minReadySeconds) targeted by this deployment.

	// +optional

	availableReplicas?: int32 @go(AvailableReplicas) @protobuf(4,varint,opt)

	// Total number of unavailable pods targeted by this deployment. This is the total number of

	// pods that are still required for the deployment to have 100% available capacity. They may

	// either be pods that are running but not yet available or pods that still have not been created.

	// +optional

	unavailableReplicas?: int32 @go(UnavailableReplicas) @protobuf(5,varint,opt)

	// Represents the latest available observations of a deployment's current state.

	// +patchMergeKey=type

	// +patchStrategy=merge

	conditions?: [...#DeploymentCondition] @go(Conditions,[]DeploymentCondition) @protobuf(6,bytes,rep)

	// Count of hash collisions for the Deployment. The Deployment controller uses this

	// field as a collision avoidance mechanism when it needs to create the name for the

	// newest ReplicaSet.

	// +optional

	collisionCount?: null | int32 @go(CollisionCount,*int32) @protobuf(8,varint,opt)

}

#DeploymentConditionType: string // #enumDeploymentConditionType

#enumDeploymentConditionType:

	#DeploymentAvailable |

	#DeploymentProgressing |

	#DeploymentReplicaFailure

// Available means the deployment is available, ie. at least the minimum available

// replicas required are up and running for at least minReadySeconds.

#DeploymentAvailable: #DeploymentConditionType & "Available"

// Progressing means the deployment is progressing. Progress for a deployment is

// considered when a new replica set is created or adopted, and when new pods scale

// up or old pods scale down. Progress is not estimated for paused deployments or

// when progressDeadlineSeconds is not specified.

#DeploymentProgressing: #DeploymentConditionType & "Progressing"

// ReplicaFailure is added in a deployment when one of its pods fails to be created

// or deleted.

#DeploymentReplicaFailure: #DeploymentConditionType & "ReplicaFailure"

// DeploymentCondition describes the state of a deployment at a certain point.

#DeploymentCondition: {

	// Type of deployment condition.

	type: #DeploymentConditionType @go(Type) @protobuf(1,bytes,opt,casttype=DeploymentConditionType)

	// Status of the condition, one of True, False, Unknown.

	status: v1.#ConditionStatus @go(Status) @protobuf(2,bytes,opt,casttype=k8s.io/api/core/v1.ConditionStatus)

	// The last time this condition was updated.

	lastUpdateTime?: metav1.#Time @go(LastUpdateTime) @protobuf(6,bytes,opt)

	// Last time the condition transitioned from one status to another.

	lastTransitionTime?: metav1.#Time @go(LastTransitionTime) @protobuf(7,bytes,opt)

	// The reason for the condition's last transition.

	reason?: string @go(Reason) @protobuf(4,bytes,opt)

	// A human readable message indicating details about the transition.

	message?: string @go(Message) @protobuf(5,bytes,opt)

}

// DeploymentList is a list of Deployments.

#DeploymentList: {

	metav1.#TypeMeta

	// Standard list metadata.

	// +optional

	metadata?: metav1.#ListMeta @go(ListMeta) @protobuf(1,bytes,opt)

	// Items is the list of Deployments.

	items: [...#Deployment] @go(Items,[]Deployment) @protobuf(2,bytes,rep)

}

// DaemonSetUpdateStrategy is a struct used to control the update strategy for a DaemonSet.

#DaemonSetUpdateStrategy: {

	// Type of daemon set update. Can be "RollingUpdate" or "OnDelete". Default is RollingUpdate.

	// +optional

	type?: #DaemonSetUpdateStrategyType @go(Type) @protobuf(1,bytes,opt)

	// Rolling update config params. Present only if type = "RollingUpdate".

	//---

	// TODO: Update this to follow our convention for oneOf, whatever we decide it

	// to be. Same as Deployment `strategy.rollingUpdate`.

	// See https://github.com/kubernetes/kubernetes/issues/35345

	// +optional

	rollingUpdate?: null | #RollingUpdateDaemonSet @go(RollingUpdate,*RollingUpdateDaemonSet) @protobuf(2,bytes,opt)

}

// +enum

#DaemonSetUpdateStrategyType: string // #enumDaemonSetUpdateStrategyType

#enumDaemonSetUpdateStrategyType:

	#RollingUpdateDaemonSetStrategyType |

	#OnDeleteDaemonSetStrategyType

// Replace the old daemons by new ones using rolling update i.e replace them on each node one after the other.

#RollingUpdateDaemonSetStrategyType: #DaemonSetUpdateStrategyType & "RollingUpdate"

// Replace the old daemons only when it's killed

#OnDeleteDaemonSetStrategyType: #DaemonSetUpdateStrategyType & "OnDelete"

// Spec to control the desired behavior of daemon set rolling update.

#RollingUpdateDaemonSet: {

	// The maximum number of DaemonSet pods that can be unavailable during the

	// update. Value can be an absolute number (ex: 5) or a percentage of total

	// number of DaemonSet pods at the start of the update (ex: 10%). Absolute

	// number is calculated from percentage by rounding up.

	// This cannot be 0 if MaxSurge is 0

	// Default value is 1.

	// Example: when this is set to 30%, at most 30% of the total number of nodes

	// that should be running the daemon pod (i.e. status.desiredNumberScheduled)

	// can have their pods stopped for an update at any given time. The update

	// starts by stopping at most 30% of those DaemonSet pods and then brings

	// up new DaemonSet pods in their place. Once the new pods are available,

	// it then proceeds onto other DaemonSet pods, thus ensuring that at least

	// 70% of original number of DaemonSet pods are available at all times during

	// the update.

	// +optional

	maxUnavailable?: null | intstr.#IntOrString @go(MaxUnavailable,*intstr.IntOrString) @protobuf(1,bytes,opt)

	// The maximum number of nodes with an existing available DaemonSet pod that

	// can have an updated DaemonSet pod during during an update.

	// Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).

	// This can not be 0 if MaxUnavailable is 0.

	// Absolute number is calculated from percentage by rounding up to a minimum of 1.

	// Default value is 0.

	// Example: when this is set to 30%, at most 30% of the total number of nodes

	// that should be running the daemon pod (i.e. status.desiredNumberScheduled)

	// can have their a new pod created before the old pod is marked as deleted.

	// The update starts by launching new pods on 30% of nodes. Once an updated

	// pod is available (Ready for at least minReadySeconds) the old DaemonSet pod

	// on that node is marked deleted. If the old pod becomes unavailable for any

	// reason (Ready transitions to false, is evicted, or is drained) an updated

	// pod is immediatedly created on that node without considering surge limits.

	// Allowing surge implies the possibility that the resources consumed by the

	// daemonset on any given node can double if the readiness check fails, and

	// so resource intensive daemonsets should take into account that they may

	// cause evictions during disruption.

	// +optional

	maxSurge?: null | intstr.#IntOrString @go(MaxSurge,*intstr.IntOrString) @protobuf(2,bytes,opt)

}

// DaemonSetSpec is the specification of a daemon set.

#DaemonSetSpec: {

	// A label query over pods that are managed by the daemon set.

	// Must match in order to be controlled.

	// It must match the pod template's labels.

	// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors

	selector?: null | metav1.#LabelSelector @go(Selector,*metav1.LabelSelector) @protobuf(1,bytes,opt)

	// An object that describes the pod that will be created.

	// The DaemonSet will create exactly one copy of this pod on every node

	// that matches the template's node selector (or on every node if no node

	// selector is specified).

	// The only allowed template.spec.restartPolicy value is "Always".

	// More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#pod-template

	template: v1.#PodTemplateSpec @go(Template) @protobuf(2,bytes,opt)

	// An update strategy to replace existing DaemonSet pods with new pods.

	// +optional

	updateStrategy?: #DaemonSetUpdateStrategy @go(UpdateStrategy) @protobuf(3,bytes,opt)

	// The minimum number of seconds for which a newly created DaemonSet pod should

	// be ready without any of its container crashing, for it to be considered

	// available. Defaults to 0 (pod will be considered available as soon as it

	// is ready).

	// +optional

	minReadySeconds?: int32 @go(MinReadySeconds) @protobuf(4,varint,opt)

	// The number of old history to retain to allow rollback.

	// This is a pointer to distinguish between explicit zero and not specified.

	// Defaults to 10.

	// +optional

	revisionHistoryLimit?: null | int32 @go(RevisionHistoryLimit,*int32) @protobuf(6,varint,opt)

}

// DaemonSetStatus represents the current status of a daemon set.

#DaemonSetStatus: {

	// The number of nodes that are running at least 1

	// daemon pod and are supposed to run the daemon pod.

	// More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/

	currentNumberScheduled: int32 @go(CurrentNumberScheduled) @protobuf(1,varint,opt)

	// The number of nodes that are running the daemon pod, but are

	// not supposed to run the daemon pod.

	// More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/

	numberMisscheduled: int32 @go(NumberMisscheduled) @protobuf(2,varint,opt)

	// The total number of nodes that should be running the daemon

	// pod (including nodes correctly running the daemon pod).

	// More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/

	desiredNumberScheduled: int32 @go(DesiredNumberScheduled) @protobuf(3,varint,opt)

	// numberReady is the number of nodes that should be running the daemon pod and have one

	// or more of the daemon pod running with a Ready Condition.

	numberReady: int32 @go(NumberReady) @protobuf(4,varint,opt)

	// The most recent generation observed by the daemon set controller.

	// +optional

	observedGeneration?: int64 @go(ObservedGeneration) @protobuf(5,varint,opt)

	// The total number of nodes that are running updated daemon pod

	// +optional

	updatedNumberScheduled?: int32 @go(UpdatedNumberScheduled) @protobuf(6,varint,opt)

	// The number of nodes that should be running the

	// daemon pod and have one or more of the daemon pod running and

	// available (ready for at least spec.minReadySeconds)

	// +optional

	numberAvailable?: int32 @go(NumberAvailable) @protobuf(7,varint,opt)

	// The number of nodes that should be running the

	// daemon pod and have none of the daemon pod running and available

	// (ready for at least spec.minReadySeconds)

	// +optional

	numberUnavailable?: int32 @go(NumberUnavailable) @protobuf(8,varint,opt)

	// Count of hash collisions for the DaemonSet. The DaemonSet controller

	// uses this field as a collision avoidance mechanism when it needs to

	// create the name for the newest ControllerRevision.

	// +optional

	collisionCount?: null | int32 @go(CollisionCount,*int32) @protobuf(9,varint,opt)