---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.21.0
  name: rulestatuses.capsule.clastix.io
spec:
  group: capsule.clastix.io
  names:
    kind: RuleStatus
    listKind: RuleStatusList
    plural: rulestatuses
    singular: rulestatus
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Ready Status
      jsonPath: .status.conditions[?(@.type=="Ready")].status
      name: Ready
      type: string
    - description: Ready Message
      jsonPath: .status.conditions[?(@.type=="Ready")].message
      name: Message
      type: string
    - description: Age
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1beta2
    schema:
      openAPIV3Schema:
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            items:
              description: For future implementation where users might manage RuleStatus
                CRs themselves
              properties:
                audience:
                  description: |-
                    Audience limits this rule to matching request subjects.
                    An empty audience matches every request.
                  items:
                    properties:
                      kind:
                        enum:
                        - User
                        - Group
                        - ServiceAccount
                        - Custom
                        type: string
                      name:
                        type: string
                    required:
                    - kind
                    - name
                    type: object
                  type: array
                enforce:
                  description: Enforcement for given rule
                  properties:
                    action:
                      default: deny
                      description: |-
                        Declare the action being performed on the enforcement rule:
                        deny: On match, deny admission request
                        allow: On match, allowed admission request
                        audit: On match, audit (post event) of admission request
                      enum:
                      - allow
                      - deny
                      - audit
                      type: string
                    ingress:
                      description: Enforcement for Ingress and Gateway API resource
                        hostnames.
                      properties:
                        hostnames:
                          description: |-
                            Hostnames defines allowed, denied, or audited hostname expressions.
                            A resource targeted by an allow or deny rule must declare non-empty values
                            in all hostname fields. Audit-only rules record missing hostnames without
                            denying them.
                          items:
                            description: |-
                              At least one of Exact or Exp must be set.
                              Both may be set together.
                            properties:
                              exact:
                                description: Exact matches one of the provided values
                                  exactly.
                                items:
                                  type: string
                                minItems: 1
                                type: array
                              exp:
                                description: Exp matches regular expression.
                                minLength: 1
                                type: string
                              negate:
                                default: false
                                description: Negate regular Expression
                                type: boolean
                            type: object
                            x-kubernetes-validations:
                            - message: at least one of exact or exp must be set
                              rule: has(self.exact) || has(self.exp)
                          minItems: 1
                          type: array
                        types:
                          description: Types defines the resource kinds to which hostname
                            enforcement applies.
                          items:
                            enum:
                            - Ingress
                            - Route
                            - ListenerSet
                            - HTTPRoute
                            - Gateway
                            - TLSRoute
                            - GRPCRoute
                            type: string
                          minItems: 1
                          type: array
                      type: object
                    metadata:
                      description: Enforcement for object metadata on namespaced resources.
                      items:
                        description: MetadataRule defines metadata constraints for
                          namespaced resources.
                        properties:
                          annotations:
                            additionalProperties:
                              properties:
                                default:
                                  description: |-
                                    Default is applied by admission mutation when the concrete metadata key is absent.
                                    It is not reconciled after admission.
                                  type: string
                                managed:
                                  description: |-
                                    Managed is enforced by admission mutation and reconciled by the RuleStatus
                                    controller using server-side apply when the rule configuration changes.
                                  type: string
                                required:
                                  default: false
                                  description: |-
                                    Required enforces that the metadata key must be present.

                                    This is mainly meaningful with action=allow. Deny and audit rules remain
                                    value matchers and do not require missing metadata to exist.
                                  type: boolean
                                values:
                                  description: |-
                                    Values defines allowed, denied, or audited values for the metadata key.

                                    If Required=true and Values is empty, only presence is enforced.
                                  items:
                                    description: |-
                                      At least one of Exact or Exp must be set.
                                      Both may be set together.
                                    properties:
                                      exact:
                                        description: Exact matches one of the provided
                                          values exactly.
                                        items:
                                          type: string
                                        minItems: 1
                                        type: array
                                      exp:
                                        description: Exp matches regular expression.
                                        minLength: 1
                                        type: string
                                      negate:
                                        default: false
                                        description: Negate regular Expression
                                        type: boolean
                                    type: object
                                    x-kubernetes-validations:
                                    - message: at least one of exact or exp must be
                                        set
                                      rule: has(self.exact) || has(self.exp)
                                  type: array
                              type: object
                            description: Annotations defines metadata policies by
                              annotation key.
                            type: object
                          apiGroups:
                            description: |-
                              API groups or API group/version selectors of the referents.

                              Empty or omitted APIGroups means the core Kubernetes API version "v1".
                              Use "*" to match all API groups and versions.

                              Examples:
                              - [] or [""] means core "v1".
                              - ["v1"] means core "v1".
                              - ["apps"] means any version in the "apps" API group.
                              - ["apps/v1"] means only "apps/v1".
                              - ["apps", "batch/v1"] means any "apps" version and "batch/v1".
                              - ["*"] means all API groups and versions.
                            items:
                              type: string
                            type: array
                          kinds:
                            description: |-
                              Kinds of the referents.

                              Use "*" to match all kinds.
                            items:
                              minLength: 1
                              type: string
                            minItems: 1
                            type: array
                          labels:
                            additionalProperties:
                              properties:
                                default:
                                  description: |-
                                    Default is applied by admission mutation when the concrete metadata key is absent.
                                    It is not reconciled after admission.
                                  type: string
                                managed:
                                  description: |-
                                    Managed is enforced by admission mutation and reconciled by the RuleStatus
                                    controller using server-side apply when the rule configuration changes.
                                  type: string
                                required:
                                  default: false
                                  description: |-
                                    Required enforces that the metadata key must be present.

                                    This is mainly meaningful with action=allow. Deny and audit rules remain
                                    value matchers and do not require missing metadata to exist.
                                  type: boolean
                                values:
                                  description: |-
                                    Values defines allowed, denied, or audited values for the metadata key.

                                    If Required=true and Values is empty, only presence is enforced.
                                  items:
                                    description: |-
                                      At least one of Exact or Exp must be set.
                                      Both may be set together.
                                    properties:
                                      exact:
                                        description: Exact matches one of the provided
                                          values exactly.
                                        items:
                                          type: string
                                        minItems: 1
                                        type: array
                                      exp:
                                        description: Exp matches regular expression.
                                        minLength: 1
                                        type: string
                                      negate:
                                        default: false
                                        description: Negate regular Expression
                                        type: boolean
                                    type: object
                                    x-kubernetes-validations:
                                    - message: at least one of exact or exp must be
                                        set
                                      rule: has(self.exact) || has(self.exp)
                                  type: array
                              type: object
                            description: Labels defines metadata policies by label
                              key.
                            type: object
                        required:
                        - kinds
                        type: object
                        x-kubernetes-validations:
                        - message: at least one of labels or annotations must be set
                          rule: has(self.labels) || has(self.annotations)
                      type: array
                    services:
                      description: Enforcement for Services.
                      properties:
                        externalIPs:
                          description: ExternalIPs defines constraints for spec.externalIPs.
                          properties:
                            cidrs:
                              description: |-
                                CIDRs restricts spec.externalIPs. Individual IP addresses are treated as
                                host CIDRs (/32 for IPv4 and /128 for IPv6).
                                For deny rules, empty means all external IPs are denied. For allow and
                                audit rules, empty means no external IP restriction.
                              items:
                                type: string
                              type: array
                          type: object
                        externalNames:
                          description: ExternalNames defines additional constraints
                            for Services of type ExternalName.
                          properties:
                            hostnames:
                              description: |-
                                Hostnames restricts spec.externalName.
                                Empty means no additional hostname restriction once ExternalName is allowed by types.
                              items:
                                description: |-
                                  At least one of Exact or Exp must be set.
                                  Both may be set together.
                                properties:
                                  exact:
                                    description: Exact matches one of the provided
                                      values exactly.
                                    items:
                                      type: string
                                    minItems: 1
                                    type: array
                                  exp:
                                    description: Exp matches regular expression.
                                    minLength: 1
                                    type: string
                                  negate:
                                    default: false
                                    description: Negate regular Expression
                                    type: boolean
                                type: object
                                x-kubernetes-validations:
                                - message: at least one of exact or exp must be set
                                  rule: has(self.exact) || has(self.exp)
                              type: array
                          type: object
                        loadBalancers:
                          description: LoadBalancers defines additional constraints
                            for Services of type LoadBalancer.
                          properties:
                            cidrs:
                              description: |-
                                CIDRs restricts spec.loadBalancerIP and spec.loadBalancerSourceRanges.
                                Empty means no additional CIDR restriction once LoadBalancer is allowed by types.
                              items:
                                type: string
                              type: array
                          type: object
                        nodePorts:
                          description: NodePorts defines additional constraints for
                            nodePort values.
                          properties:
                            ports:
                              description: |-
                                Ports restricts explicitly requested nodePort values.
                                Empty means no additional port restriction once NodePort is allowed by types.
                              items:
                                properties:
                                  from:
                                    format: int32
                                    maximum: 65535
                                    minimum: 1
                                    type: integer
                                  to:
                                    format: int32
                                    maximum: 65535
                                    minimum: 1
                                    type: integer
                                required:
                                - from
                                - to
                                type: object
                              type: array
                          type: object
                        types:
                          description: |-
                            Types defines the Service types matched by this rule.

                            Supported values:
                            - ClusterIP
                            - NodePort
                            - LoadBalancer
                            - ExternalName
                          items:
                            enum:
                            - ClusterIP
                            - NodePort
                            - LoadBalancer
                            - ExternalName
                            type: string
                          type: array
                      type: object
                    workloads:
                      description: Enforcement for Workloads (Pods)
                      properties:
                        qosClasses:
                          description: |-
                            Define Pod QoS classes matched by this enforcement rule.
                            Supported values are Guaranteed, Burstable and BestEffort.
                          items:
                            description: PodQOSClass defines the supported qos classes
                              of Pods.
                            type: string
                          type: array
                        registries:
                          description: |-
                            Define registries which are allowed to be used within this tenant
                            The rules are aggregated, since you can use Regular Expressions the match registry endpoints
                          items:
                            properties:
                              exact:
                                description: Exact matches one of the provided values
                                  exactly.
                                items:
                                  type: string
                                minItems: 1
                                type: array
                              exp:
                                description: Exp matches regular expression.
                                minLength: 1
                                type: string
                              negate:
                                default: false
                                description: Negate regular Expression
                                type: boolean
                              policy:
                                description: Allowed PullPolicy for the given registry.
                                  Supplying no value allows all policies.
                                items:
                                  description: PullPolicy describes a policy for if/when
                                    to pull a container image
                                  type: string
                                type: array
                            type: object
                            x-kubernetes-validations:
                            - message: at least one of exact or exp must be set
                              rule: has(self.exact) || has(self.exp)
                          type: array
                        resources:
                          description: |-
                            Resources defines mutation and enforcement policies for Pod and container
                            resource requests and limits. The workload targets select where the
                            policies apply. With no targets, resource policies apply to all compatible
                            locations: Pod-level resources, regular containers, and init containers.
                            Resource names unsupported at Pod level still apply to compatible container
                            locations.
                            Mutation is applied when a Pod is created. Remove and MatchRequest manage
                            explicit values, Default fills an absent value, and Ratio fills an absent
                            limit from its request. An explicit Ratio violation is then handled by the
                            enclosing allow, deny, or audit action.
                          properties:
                            limits:
                              additionalProperties:
                                description: WorkloadResourceLimitPolicy defines how
                                  a resource limit is mutated and enforced.
                                properties:
                                  policy:
                                    description: |-
                                      Policy selects how the limit is handled: Preserve leaves it unchanged,
                                      Default fills an absent limit, Remove deletes it, MatchRequest manages it
                                      to equal the request, and Ratio defaults an absent limit and enforces the
                                      maximum multiplier against explicitly supplied limits.
                                    enum:
                                    - Preserve
                                    - Default
                                    - Remove
                                    - MatchRequest
                                    - Ratio
                                    type: string
                                  value:
                                    anyOf:
                                    - type: integer
                                    - type: string
                                    description: |-
                                      Value is the quantity applied by Default or the maximum limit-to-request
                                      multiplier applied by Ratio.
                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                    x-kubernetes-int-or-string: true
                                required:
                                - policy
                                type: object
                                x-kubernetes-validations:
                                - message: value must be set only for the Default
                                    and Ratio policies
                                  rule: 'self.policy == ''Default'' || self.policy
                                    == ''Ratio'' ? has(self.value) : !has(self.value)'
                              description: Limits defines policies for resource limits.
                              minProperties: 1
                              type: object
                            requests:
                              additionalProperties:
                                description: WorkloadResourceRequestPolicy defines
                                  how a resource request is mutated.
                                properties:
                                  policy:
                                    description: |-
                                      Policy selects how the request is handled: Preserve leaves it unchanged,
                                      Default fills an absent request, and Remove deletes it.
                                    enum:
                                    - Preserve
                                    - Default
                                    - Remove
                                    type: string
                                  value:
                                    anyOf:
                                    - type: integer
                                    - type: string
                                    description: Value is the quantity applied by
                                      the Default policy.
                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                    x-kubernetes-int-or-string: true
                                required:
                                - policy
                                type: object
                                x-kubernetes-validations:
                                - message: value must be set only for the Default
                                    policy
                                  rule: 'self.policy == ''Default'' ? has(self.value)
                                    : !has(self.value)'
                              description: Requests defines policies for resource
                                requests.
                              minProperties: 1
                              type: object
                          type: object
                          x-kubernetes-validations:
                          - message: at least one of requests or limits must be set
                            rule: has(self.requests) || has(self.limits)
                        schedulers:
                          description: |-
                            Schedulers defines schedulerName matchers for Pod admission.

                            The rule is evaluated against pod.spec.schedulerName.
                            Empty schedulerName is ignored and is not normalized to default-scheduler.
                          items:
                            description: |-
                              At least one of Exact or Exp must be set.
                              Both may be set together.
                            properties:
                              exact:
                                description: Exact matches one of the provided values
                                  exactly.
                                items:
                                  type: string
                                minItems: 1
                                type: array
                              exp:
                                description: Exp matches regular expression.
                                minLength: 1
                                type: string
                              negate:
                                default: false
                                description: Negate regular Expression
                                type: boolean
                            type: object
                            x-kubernetes-validations:
                            - message: at least one of exact or exp must be set
                              rule: has(self.exact) || has(self.exp)
                          type: array
                        targets:
                          description: |-
                            Define the enforcement targets this rule applies to.
                            If empty, each webhook applies its own backwards-compatible default.
                          items:
                            enum:
                            - pod
                            - pod/initcontainers
                            - pod/ephemeralcontainers
                            - pod/containers
                            - pod/volumes
                            type: string
                          type: array
                      type: object
                  type: object
                quota:
                  description: |-
                    Quota contains native Kubernetes ResourceQuota specifications shared by
                    all namespaces selected by this rule. Unlike Enforce, quota accounting is
                    independent of the request audience.
                  items:
                    description: |-
                      ResourceQuotaRule defines a named ResourceQuota specification generated by a
                      Tenant rule. Name is the durable identity of the generated
                      GlobalResourceQuota and must be unique across all rules of a Tenant.
                    properties:
                      hard:
                        additionalProperties:
                          anyOf:
                          - type: integer
                          - type: string
                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                          x-kubernetes-int-or-string: true
                        description: |-
                          hard is the set of desired hard limits for each named resource.
                          More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
                        type: object
                      name:
                        description: |-
                          Name is the stable identity of this quota within the Tenant. Changing the
                          name replaces the generated GlobalResourceQuota; changing the quota or its
                          namespace selector updates the existing object.
                        maxLength: 63
                        minLength: 1
                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                        type: string
                      scopeSelector:
                        description: |-
                          scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota
                          but expressed using ScopeSelectorOperator in combination with possible values.
                          For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.
                        properties:
                          matchExpressions:
                            description: A list of scope selector requirements by
                              scope of the resources.
                            items:
                              description: |-
                                A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator
                                that relates the scope name and values.
                              properties:
                                operator:
                                  description: |-
                                    Represents a scope's relationship to a set of values.
                                    Valid operators are In, NotIn, Exists, DoesNotExist.
                                  type: string
                                scopeName:
                                  description: The name of the scope that the selector
                                    applies to.
                                  type: string
                                values:
                                  description: |-
                                    An array of string values. If the operator is In or NotIn,
                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                    the values array must be empty.
                                    This array is replaced during a strategic merge patch.
                                  items:
                                    type: string
                                  type: array
                                  x-kubernetes-list-type: atomic
                              required:
                              - operator
                              - scopeName
                              type: object
                            type: array
                            x-kubernetes-list-type: atomic
                        type: object
                        x-kubernetes-map-type: atomic
                      scopes:
                        description: |-
                          A collection of filters that must match each object tracked by a quota.
                          If not specified, the quota matches all objects.
                        items:
                          description: A ResourceQuotaScope defines a filter that
                            must match each object tracked by a quota
                          type: string
                        type: array
                        x-kubernetes-list-type: atomic
                    required:
                    - name
                    type: object
                  type: array
                  x-kubernetes-list-map-keys:
                  - name
                  x-kubernetes-list-type: map
              type: object
            type: array
          status:
            description: RuleStatus contains the accumulated rules applying to namespace
              it's deployed in.
            properties:
              conditions:
                description: Conditions
                items:
                  description: Condition contains details for one aspect of the current
                    state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
              observedGeneration:
                description: ObservedGeneration is the most recent generation the
                  controller has observed.
                format: int64
                type: integer
              rule:
                description: |-
                  Deprecated: use Rules.
                  Rule contains a legacy flattened view and cannot fully represent action-aware rules.
                properties:
                  audience:
                    description: |-
                      Audience limits this rule to matching request subjects.
                      An empty audience matches every request.
                    items:
                      properties:
                        kind:
                          enum:
                          - User
                          - Group
                          - ServiceAccount
                          - Custom
                          type: string
                        name:
                          type: string
                      required:
                      - kind
                      - name
                      type: object
                    type: array
                  enforce:
                    description: Enforcement for given rule
                    properties:
                      action:
                        default: deny
                        description: |-
                          Declare the action being performed on the enforcement rule:
                          deny: On match, deny admission request
                          allow: On match, allowed admission request
                          audit: On match, audit (post event) of admission request
                        enum:
                        - allow
                        - deny
                        - audit
                        type: string
                      ingress:
                        description: Enforcement for Ingress and Gateway API resource
                          hostnames.
                        properties:
                          hostnames:
                            description: |-
                              Hostnames defines allowed, denied, or audited hostname expressions.
                              A resource targeted by an allow or deny rule must declare non-empty values
                              in all hostname fields. Audit-only rules record missing hostnames without
                              denying them.
                            items:
                              description: |-
                                At least one of Exact or Exp must be set.
                                Both may be set together.
                              properties:
                                exact:
                                  description: Exact matches one of the provided values
                                    exactly.
                                  items:
                                    type: string
                                  minItems: 1
                                  type: array
                                exp:
                                  description: Exp matches regular expression.
                                  minLength: 1
                                  type: string
                                negate:
                                  default: false
                                  description: Negate regular Expression
                                  type: boolean
                              type: object
                              x-kubernetes-validations:
                              - message: at least one of exact or exp must be set
                                rule: has(self.exact) || has(self.exp)
                            minItems: 1
                            type: array
                          types:
                            description: Types defines the resource kinds to which
                              hostname enforcement applies.
                            items:
                              enum:
                              - Ingress
                              - Route
                              - ListenerSet
                              - HTTPRoute
                              - Gateway
                              - TLSRoute
                              - GRPCRoute
                              type: string
                            minItems: 1
                            type: array
                        type: object
                      metadata:
                        description: Enforcement for object metadata on namespaced
                          resources.
                        items:
                          description: MetadataRule defines metadata constraints for
                            namespaced resources.
                          properties:
                            annotations:
                              additionalProperties:
                                properties:
                                  default:
                                    description: |-
                                      Default is applied by admission mutation when the concrete metadata key is absent.
                                      It is not reconciled after admission.
                                    type: string
                                  managed:
                                    description: |-
                                      Managed is enforced by admission mutation and reconciled by the RuleStatus
                                      controller using server-side apply when the rule configuration changes.
                                    type: string
                                  required:
                                    default: false
                                    description: |-
                                      Required enforces that the metadata key must be present.

                                      This is mainly meaningful with action=allow. Deny and audit rules remain
                                      value matchers and do not require missing metadata to exist.
                                    type: boolean
                                  values:
                                    description: |-
                                      Values defines allowed, denied, or audited values for the metadata key.

                                      If Required=true and Values is empty, only presence is enforced.
                                    items:
                                      description: |-
                                        At least one of Exact or Exp must be set.
                                        Both may be set together.
                                      properties:
                                        exact:
                                          description: Exact matches one of the provided
                                            values exactly.
                                          items:
                                            type: string
                                          minItems: 1
                                          type: array
                                        exp:
                                          description: Exp matches regular expression.
                                          minLength: 1
                                          type: string
                                        negate:
                                          default: false
                                          description: Negate regular Expression
                                          type: boolean
                                      type: object
                                      x-kubernetes-validations:
                                      - message: at least one of exact or exp must
                                          be set
                                        rule: has(self.exact) || has(self.exp)
                                    type: array
                                type: object
                              description: Annotations defines metadata policies by
                                annotation key.
                              type: object
                            apiGroups:
                              description: |-
                                API groups or API group/version selectors of the referents.

                                Empty or omitted APIGroups means the core Kubernetes API version "v1".
                                Use "*" to match all API groups and versions.

                                Examples:
                                - [] or [""] means core "v1".
                                - ["v1"] means core "v1".
                                - ["apps"] means any version in the "apps" API group.
                                - ["apps/v1"] means only "apps/v1".
                                - ["apps", "batch/v1"] means any "apps" version and "batch/v1".
                                - ["*"] means all API groups and versions.
                              items:
                                type: string
                              type: array
                            kinds:
                              description: |-
                                Kinds of the referents.

                                Use "*" to match all kinds.
                              items:
                                minLength: 1
                                type: string
                              minItems: 1
                              type: array
                            labels:
                              additionalProperties:
                                properties:
                                  default:
                                    description: |-
                                      Default is applied by admission mutation when the concrete metadata key is absent.
                                      It is not reconciled after admission.
                                    type: string
                                  managed:
                                    description: |-
                                      Managed is enforced by admission mutation and reconciled by the RuleStatus
                                      controller using server-side apply when the rule configuration changes.
                                    type: string
                                  required:
                                    default: false
                                    description: |-
                                      Required enforces that the metadata key must be present.

                                      This is mainly meaningful with action=allow. Deny and audit rules remain
                                      value matchers and do not require missing metadata to exist.
                                    type: boolean
                                  values:
                                    description: |-
                                      Values defines allowed, denied, or audited values for the metadata key.

                                      If Required=true and Values is empty, only presence is enforced.
                                    items:
                                      description: |-
                                        At least one of Exact or Exp must be set.
                                        Both may be set together.
                                      properties:
                                        exact:
                                          description: Exact matches one of the provided
                                            values exactly.
                                          items:
                                            type: string
                                          minItems: 1
                                          type: array
                                        exp:
                                          description: Exp matches regular expression.
                                          minLength: 1
                                          type: string
                                        negate:
                                          default: false
                                          description: Negate regular Expression
                                          type: boolean
                                      type: object
                                      x-kubernetes-validations:
                                      - message: at least one of exact or exp must
                                          be set
                                        rule: has(self.exact) || has(self.exp)
                                    type: array
                                type: object
                              description: Labels defines metadata policies by label
                                key.
                              type: object
                          required:
                          - kinds
                          type: object
                          x-kubernetes-validations:
                          - message: at least one of labels or annotations must be
                              set
                            rule: has(self.labels) || has(self.annotations)
                        type: array
                      services:
                        description: Enforcement for Services.
                        properties:
                          externalIPs:
                            description: ExternalIPs defines constraints for spec.externalIPs.
                            properties:
                              cidrs:
                                description: |-
                                  CIDRs restricts spec.externalIPs. Individual IP addresses are treated as
                                  host CIDRs (/32 for IPv4 and /128 for IPv6).
                                  For deny rules, empty means all external IPs are denied. For allow and
                                  audit rules, empty means no external IP restriction.
                                items:
                                  type: string
                                type: array
                            type: object
                          externalNames:
                            description: ExternalNames defines additional constraints
                              for Services of type ExternalName.
                            properties:
                              hostnames:
                                description: |-
                                  Hostnames restricts spec.externalName.
                                  Empty means no additional hostname restriction once ExternalName is allowed by types.
                                items:
                                  description: |-
                                    At least one of Exact or Exp must be set.
                                    Both may be set together.
                                  properties:
                                    exact:
                                      description: Exact matches one of the provided
                                        values exactly.
                                      items:
                                        type: string
                                      minItems: 1
                                      type: array
                                    exp:
                                      description: Exp matches regular expression.
                                      minLength: 1
                                      type: string
                                    negate:
                                      default: false
                                      description: Negate regular Expression
                                      type: boolean
                                  type: object
                                  x-kubernetes-validations:
                                  - message: at least one of exact or exp must be
                                      set
                                    rule: has(self.exact) || has(self.exp)
                                type: array
                            type: object
                          loadBalancers:
                            description: LoadBalancers defines additional constraints
                              for Services of type LoadBalancer.
                            properties:
                              cidrs:
                                description: |-
                                  CIDRs restricts spec.loadBalancerIP and spec.loadBalancerSourceRanges.
                                  Empty means no additional CIDR restriction once LoadBalancer is allowed by types.
                                items:
                                  type: string
                                type: array
                            type: object
                          nodePorts:
                            description: NodePorts defines additional constraints
                              for nodePort values.
                            properties:
                              ports:
                                description: |-
                                  Ports restricts explicitly requested nodePort values.
                                  Empty means no additional port restriction once NodePort is allowed by types.
                                items:
                                  properties:
                                    from:
                                      format: int32
                                      maximum: 65535
                                      minimum: 1
                                      type: integer
                                    to:
                                      format: int32
                                      maximum: 65535
                                      minimum: 1
                                      type: integer
                                  required:
                                  - from
                                  - to
                                  type: object
                                type: array
                            type: object
                          types:
                            description: |-
                              Types defines the Service types matched by this rule.

                              Supported values:
                              - ClusterIP
                              - NodePort
                              - LoadBalancer
                              - ExternalName
                            items:
                              enum:
                              - ClusterIP
                              - NodePort
                              - LoadBalancer
                              - ExternalName
                              type: string
                            type: array
                        type: object
                      workloads:
                        description: Enforcement for Workloads (Pods)
                        properties:
                          qosClasses:
                            description: |-
                              Define Pod QoS classes matched by this enforcement rule.
                              Supported values are Guaranteed, Burstable and BestEffort.
                            items:
                              description: PodQOSClass defines the supported qos classes
                                of Pods.
                              type: string
                            type: array
                          registries:
                            description: |-
                              Define registries which are allowed to be used within this tenant
                              The rules are aggregated, since you can use Regular Expressions the match registry endpoints
                            items:
                              properties:
                                exact:
                                  description: Exact matches one of the provided values
                                    exactly.
                                  items:
                                    type: string
                                  minItems: 1
                                  type: array
                                exp:
                                  description: Exp matches regular expression.
                                  minLength: 1
                                  type: string
                                negate:
                                  default: false
                                  description: Negate regular Expression
                                  type: boolean
                                policy:
                                  description: Allowed PullPolicy for the given registry.
                                    Supplying no value allows all policies.
                                  items:
                                    description: PullPolicy describes a policy for
                                      if/when to pull a container image
                                    type: string
                                  type: array
                              type: object
                              x-kubernetes-validations:
                              - message: at least one of exact or exp must be set
                                rule: has(self.exact) || has(self.exp)
                            type: array
                          resources:
                            description: |-
                              Resources defines mutation and enforcement policies for Pod and container
                              resource requests and limits. The workload targets select where the
                              policies apply. With no targets, resource policies apply to all compatible
                              locations: Pod-level resources, regular containers, and init containers.
                              Resource names unsupported at Pod level still apply to compatible container
                              locations.
                              Mutation is applied when a Pod is created. Remove and MatchRequest manage
                              explicit values, Default fills an absent value, and Ratio fills an absent
                              limit from its request. An explicit Ratio violation is then handled by the
                              enclosing allow, deny, or audit action.
                            properties:
                              limits:
                                additionalProperties:
                                  description: WorkloadResourceLimitPolicy defines
                                    how a resource limit is mutated and enforced.
                                  properties:
                                    policy:
                                      description: |-
                                        Policy selects how the limit is handled: Preserve leaves it unchanged,
                                        Default fills an absent limit, Remove deletes it, MatchRequest manages it
                                        to equal the request, and Ratio defaults an absent limit and enforces the
                                        maximum multiplier against explicitly supplied limits.
                                      enum:
                                      - Preserve
                                      - Default
                                      - Remove
                                      - MatchRequest
                                      - Ratio
                                      type: string
                                    value:
                                      anyOf:
                                      - type: integer
                                      - type: string
                                      description: |-
                                        Value is the quantity applied by Default or the maximum limit-to-request
                                        multiplier applied by Ratio.
                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                      x-kubernetes-int-or-string: true
                                  required:
                                  - policy
                                  type: object
                                  x-kubernetes-validations:
                                  - message: value must be set only for the Default
                                      and Ratio policies
                                    rule: 'self.policy == ''Default'' || self.policy
                                      == ''Ratio'' ? has(self.value) : !has(self.value)'
                                description: Limits defines policies for resource
                                  limits.
                                minProperties: 1
                                type: object
                              requests:
                                additionalProperties:
                                  description: WorkloadResourceRequestPolicy defines
                                    how a resource request is mutated.
                                  properties:
                                    policy:
                                      description: |-
                                        Policy selects how the request is handled: Preserve leaves it unchanged,
                                        Default fills an absent request, and Remove deletes it.
                                      enum:
                                      - Preserve
                                      - Default
                                      - Remove
                                      type: string
                                    value:
                                      anyOf:
                                      - type: integer
                                      - type: string
                                      description: Value is the quantity applied by
                                        the Default policy.
                                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                      x-kubernetes-int-or-string: true
                                  required:
                                  - policy
                                  type: object
                                  x-kubernetes-validations:
                                  - message: value must be set only for the Default
                                      policy
                                    rule: 'self.policy == ''Default'' ? has(self.value)
                                      : !has(self.value)'
                                description: Requests defines policies for resource
                                  requests.
                                minProperties: 1
                                type: object
                            type: object
                            x-kubernetes-validations:
                            - message: at least one of requests or limits must be
                                set
                              rule: has(self.requests) || has(self.limits)
                          schedulers:
                            description: |-
                              Schedulers defines schedulerName matchers for Pod admission.

                              The rule is evaluated against pod.spec.schedulerName.
                              Empty schedulerName is ignored and is not normalized to default-scheduler.
                            items:
                              description: |-
                                At least one of Exact or Exp must be set.
                                Both may be set together.
                              properties:
                                exact:
                                  description: Exact matches one of the provided values
                                    exactly.
                                  items:
                                    type: string
                                  minItems: 1
                                  type: array
                                exp:
                                  description: Exp matches regular expression.
                                  minLength: 1
                                  type: string
                                negate:
                                  default: false
                                  description: Negate regular Expression
                                  type: boolean
                              type: object
                              x-kubernetes-validations:
                              - message: at least one of exact or exp must be set
                                rule: has(self.exact) || has(self.exp)
                            type: array
                          targets:
                            description: |-
                              Define the enforcement targets this rule applies to.
                              If empty, each webhook applies its own backwards-compatible default.
                            items:
                              enum:
                              - pod
                              - pod/initcontainers
                              - pod/ephemeralcontainers
                              - pod/containers
                              - pod/volumes
                              type: string
                            type: array
                        type: object
                    type: object
                  quota:
                    description: |-
                      Quota contains native Kubernetes ResourceQuota specifications shared by
                      all namespaces selected by this rule. Unlike Enforce, quota accounting is
                      independent of the request audience.
                    items:
                      description: |-
                        ResourceQuotaRule defines a named ResourceQuota specification generated by a
                        Tenant rule. Name is the durable identity of the generated
                        GlobalResourceQuota and must be unique across all rules of a Tenant.
                      properties:
                        hard:
                          additionalProperties:
                            anyOf:
                            - type: integer
                            - type: string
                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                            x-kubernetes-int-or-string: true
                          description: |-
                            hard is the set of desired hard limits for each named resource.
                            More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
                          type: object
                        name:
                          description: |-
                            Name is the stable identity of this quota within the Tenant. Changing the
                            name replaces the generated GlobalResourceQuota; changing the quota or its
                            namespace selector updates the existing object.
                          maxLength: 63
                          minLength: 1
                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                          type: string
                        scopeSelector:
                          description: |-
                            scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota
                            but expressed using ScopeSelectorOperator in combination with possible values.
                            For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.
                          properties:
                            matchExpressions:
                              description: A list of scope selector requirements by
                                scope of the resources.
                              items:
                                description: |-
                                  A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator
                                  that relates the scope name and values.
                                properties:
                                  operator:
                                    description: |-
                                      Represents a scope's relationship to a set of values.
                                      Valid operators are In, NotIn, Exists, DoesNotExist.
                                    type: string
                                  scopeName:
                                    description: The name of the scope that the selector
                                      applies to.
                                    type: string
                                  values:
                                    description: |-
                                      An array of string values. If the operator is In or NotIn,
                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                      the values array must be empty.
                                      This array is replaced during a strategic merge patch.
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                required:
                                - operator
                                - scopeName
                                type: object
                              type: array
                              x-kubernetes-list-type: atomic
                          type: object
                          x-kubernetes-map-type: atomic
                        scopes:
                          description: |-
                            A collection of filters that must match each object tracked by a quota.
                            If not specified, the quota matches all objects.
                          items:
                            description: A ResourceQuotaScope defines a filter that
                              must match each object tracked by a quota
                            type: string
                          type: array
                          x-kubernetes-list-type: atomic
                      required:
                      - name
                      type: object
                    type: array
                    x-kubernetes-list-map-keys:
                    - name
                    x-kubernetes-list-type: map
                type: object
              rules:
                description: |-
                  Rules contains the effective namespace rules after tenant rule selection.
                  Order is preserved from the originating Tenant rules.
                items:
                  description: For future implementation where users might manage
                    RuleStatus CRs themselves
                  properties:
                    audience:
                      description: |-
                        Audience limits this rule to matching request subjects.
                        An empty audience matches every request.
                      items:
                        properties:
                          kind:
                            enum:
                            - User
                            - Group
                            - ServiceAccount
                            - Custom
                            type: string
                          name:
                            type: string
                        required:
                        - kind
                        - name
                        type: object
                      type: array
                    enforce:
                      description: Enforcement for given rule
                      properties:
                        action:
                          default: deny
                          description: |-
                            Declare the action being performed on the enforcement rule:
                            deny: On match, deny admission request
                            allow: On match, allowed admission request
                            audit: On match, audit (post event) of admission request
                          enum:
                          - allow
                          - deny
                          - audit
                          type: string
                        ingress:
                          description: Enforcement for Ingress and Gateway API resource
                            hostnames.
                          properties:
                            hostnames:
                              description: |-
                                Hostnames defines allowed, denied, or audited hostname expressions.
                                A resource targeted by an allow or deny rule must declare non-empty values
                                in all hostname fields. Audit-only rules record missing hostnames without
                                denying them.
                              items:
                                description: |-
                                  At least one of Exact or Exp must be set.
                                  Both may be set together.
                                properties:
                                  exact:
                                    description: Exact matches one of the provided
                                      values exactly.
                                    items:
                                      type: string
                                    minItems: 1
                                    type: array
                                  exp:
                                    description: Exp matches regular expression.
                                    minLength: 1
                                    type: string
                                  negate:
                                    default: false
                                    description: Negate regular Expression
                                    type: boolean
                                type: object
                                x-kubernetes-validations:
                                - message: at least one of exact or exp must be set
                                  rule: has(self.exact) || has(self.exp)
                              minItems: 1
                              type: array
                            types:
                              description: Types defines the resource kinds to which
                                hostname enforcement applies.
                              items:
                                enum:
                                - Ingress
                                - Route
                                - ListenerSet
                                - HTTPRoute
                                - Gateway
                                - TLSRoute
                                - GRPCRoute
                                type: string
                              minItems: 1
                              type: array
                          type: object
                        metadata:
                          description: Enforcement for object metadata on namespaced
                            resources.
                          items:
                            description: MetadataRule defines metadata constraints
                              for namespaced resources.
                            properties:
                              annotations:
                                additionalProperties:
                                  properties:
                                    default:
                                      description: |-
                                        Default is applied by admission mutation when the concrete metadata key is absent.
                                        It is not reconciled after admission.
                                      type: string
                                    managed:
                                      description: |-
                                        Managed is enforced by admission mutation and reconciled by the RuleStatus
                                        controller using server-side apply when the rule configuration changes.
                                      type: string
                                    required:
                                      default: false
                                      description: |-
                                        Required enforces that the metadata key must be present.

                                        This is mainly meaningful with action=allow. Deny and audit rules remain
                                        value matchers and do not require missing metadata to exist.
                                      type: boolean
                                    values:
                                      description: |-
                                        Values defines allowed, denied, or audited values for the metadata key.

                                        If Required=true and Values is empty, only presence is enforced.
                                      items:
                                        description: |-
                                          At least one of Exact or Exp must be set.
                                          Both may be set together.
                                        properties:
                                          exact:
                                            description: Exact matches one of the
                                              provided values exactly.
                                            items:
                                              type: string
                                            minItems: 1
                                            type: array
                                          exp:
                                            description: Exp matches regular expression.
                                            minLength: 1
                                            type: string
                                          negate:
                                            default: false
                                            description: Negate regular Expression
                                            type: boolean
                                        type: object
                                        x-kubernetes-validations:
                                        - message: at least one of exact or exp must
                                            be set
                                          rule: has(self.exact) || has(self.exp)
                                      type: array
                                  type: object
                                description: Annotations defines metadata policies
                                  by annotation key.
                                type: object
                              apiGroups:
                                description: |-
                                  API groups or API group/version selectors of the referents.

                                  Empty or omitted APIGroups means the core Kubernetes API version "v1".
                                  Use "*" to match all API groups and versions.

                                  Examples:
                                  - [] or [""] means core "v1".
                                  - ["v1"] means core "v1".
                                  - ["apps"] means any version in the "apps" API group.
                                  - ["apps/v1"] means only "apps/v1".
                                  - ["apps", "batch/v1"] means any "apps" version and "batch/v1".
                                  - ["*"] means all API groups and versions.
                                items:
                                  type: string
                                type: array
                              kinds:
                                description: |-
                                  Kinds of the referents.

                                  Use "*" to match all kinds.
                                items:
                                  minLength: 1
                                  type: string
                                minItems: 1
                                type: array
                              labels:
                                additionalProperties:
                                  properties:
                                    default:
                                      description: |-
                                        Default is applied by admission mutation when the concrete metadata key is absent.
                                        It is not reconciled after admission.
                                      type: string
                                    managed:
                                      description: |-
                                        Managed is enforced by admission mutation and reconciled by the RuleStatus
                                        controller using server-side apply when the rule configuration changes.
                                      type: string
                                    required:
                                      default: false
                                      description: |-
                                        Required enforces that the metadata key must be present.

                                        This is mainly meaningful with action=allow. Deny and audit rules remain
                                        value matchers and do not require missing metadata to exist.
                                      type: boolean
                                    values:
                                      description: |-
                                        Values defines allowed, denied, or audited values for the metadata key.

                                        If Required=true and Values is empty, only presence is enforced.
                                      items:
                                        description: |-
                                          At least one of Exact or Exp must be set.
                                          Both may be set together.
                                        properties:
                                          exact:
                                            description: Exact matches one of the
                                              provided values exactly.
                                            items:
                                              type: string
                                            minItems: 1
                                            type: array
                                          exp:
                                            description: Exp matches regular expression.
                                            minLength: 1
                                            type: string
                                          negate:
                                            default: false
                                            description: Negate regular Expression
                                            type: boolean
                                        type: object
                                        x-kubernetes-validations:
                                        - message: at least one of exact or exp must
                                            be set
                                          rule: has(self.exact) || has(self.exp)
                                      type: array
                                  type: object
                                description: Labels defines metadata policies by label
                                  key.
                                type: object
                            required:
                            - kinds
                            type: object
                            x-kubernetes-validations:
                            - message: at least one of labels or annotations must
                                be set
                              rule: has(self.labels) || has(self.annotations)
                          type: array
                        services:
                          description: Enforcement for Services.
                          properties:
                            externalIPs:
                              description: ExternalIPs defines constraints for spec.externalIPs.
                              properties:
                                cidrs:
                                  description: |-
                                    CIDRs restricts spec.externalIPs. Individual IP addresses are treated as
                                    host CIDRs (/32 for IPv4 and /128 for IPv6).
                                    For deny rules, empty means all external IPs are denied. For allow and
                                    audit rules, empty means no external IP restriction.
                                  items:
                                    type: string
                                  type: array
                              type: object
                            externalNames:
                              description: ExternalNames defines additional constraints
                                for Services of type ExternalName.
                              properties:
                                hostnames:
                                  description: |-
                                    Hostnames restricts spec.externalName.
                                    Empty means no additional hostname restriction once ExternalName is allowed by types.
                                  items:
                                    description: |-
                                      At least one of Exact or Exp must be set.
                                      Both may be set together.
                                    properties:
                                      exact:
                                        description: Exact matches one of the provided
                                          values exactly.
                                        items:
                                          type: string
                                        minItems: 1
                                        type: array
                                      exp:
                                        description: Exp matches regular expression.
                                        minLength: 1
                                        type: string
                                      negate:
                                        default: false
                                        description: Negate regular Expression
                                        type: boolean
                                    type: object
                                    x-kubernetes-validations:
                                    - message: at least one of exact or exp must be
                                        set
                                      rule: has(self.exact) || has(self.exp)
                                  type: array
                              type: object
                            loadBalancers:
                              description: LoadBalancers defines additional constraints
                                for Services of type LoadBalancer.
                              properties:
                                cidrs:
                                  description: |-
                                    CIDRs restricts spec.loadBalancerIP and spec.loadBalancerSourceRanges.
                                    Empty means no additional CIDR restriction once LoadBalancer is allowed by types.
                                  items:
                                    type: string
                                  type: array
                              type: object
                            nodePorts:
                              description: NodePorts defines additional constraints
                                for nodePort values.
                              properties:
                                ports:
                                  description: |-
                                    Ports restricts explicitly requested nodePort values.
                                    Empty means no additional port restriction once NodePort is allowed by types.
                                  items:
                                    properties:
                                      from:
                                        format: int32
                                        maximum: 65535
                                        minimum: 1
                                        type: integer
                                      to:
                                        format: int32
                                        maximum: 65535
                                        minimum: 1
                                        type: integer
                                    required:
                                    - from
                                    - to
                                    type: object
                                  type: array
                              type: object
                            types:
                              description: |-
                                Types defines the Service types matched by this rule.

                                Supported values:
                                - ClusterIP
                                - NodePort
                                - LoadBalancer
                                - ExternalName
                              items:
                                enum:
                                - ClusterIP
                                - NodePort
                                - LoadBalancer
                                - ExternalName
                                type: string
                              type: array
                          type: object
                        workloads:
                          description: Enforcement for Workloads (Pods)
                          properties:
                            qosClasses:
                              description: |-
                                Define Pod QoS classes matched by this enforcement rule.
                                Supported values are Guaranteed, Burstable and BestEffort.
                              items:
                                description: PodQOSClass defines the supported qos
                                  classes of Pods.
                                type: string
                              type: array
                            registries:
                              description: |-
                                Define registries which are allowed to be used within this tenant
                                The rules are aggregated, since you can use Regular Expressions the match registry endpoints
                              items:
                                properties:
                                  exact:
                                    description: Exact matches one of the provided
                                      values exactly.
                                    items:
                                      type: string
                                    minItems: 1
                                    type: array
                                  exp:
                                    description: Exp matches regular expression.
                                    minLength: 1
                                    type: string
                                  negate:
                                    default: false
                                    description: Negate regular Expression
                                    type: boolean
                                  policy:
                                    description: Allowed PullPolicy for the given
                                      registry. Supplying no value allows all policies.
                                    items:
                                      description: PullPolicy describes a policy for
                                        if/when to pull a container image
                                      type: string
                                    type: array
                                type: object
                                x-kubernetes-validations:
                                - message: at least one of exact or exp must be set
                                  rule: has(self.exact) || has(self.exp)
                              type: array
                            resources:
                              description: |-
                                Resources defines mutation and enforcement policies for Pod and container
                                resource requests and limits. The workload targets select where the
                                policies apply. With no targets, resource policies apply to all compatible
                                locations: Pod-level resources, regular containers, and init containers.
                                Resource names unsupported at Pod level still apply to compatible container
                                locations.
                                Mutation is applied when a Pod is created. Remove and MatchRequest manage
                                explicit values, Default fills an absent value, and Ratio fills an absent
                                limit from its request. An explicit Ratio violation is then handled by the
                                enclosing allow, deny, or audit action.
                              properties:
                                limits:
                                  additionalProperties:
                                    description: WorkloadResourceLimitPolicy defines
                                      how a resource limit is mutated and enforced.
                                    properties:
                                      policy:
                                        description: |-
                                          Policy selects how the limit is handled: Preserve leaves it unchanged,
                                          Default fills an absent limit, Remove deletes it, MatchRequest manages it
                                          to equal the request, and Ratio defaults an absent limit and enforces the
                                          maximum multiplier against explicitly supplied limits.
                                        enum:
                                        - Preserve
                                        - Default
                                        - Remove
                                        - MatchRequest
                                        - Ratio
                                        type: string
                                      value:
                                        anyOf:
                                        - type: integer
                                        - type: string
                                        description: |-
                                          Value is the quantity applied by Default or the maximum limit-to-request
                                          multiplier applied by Ratio.
                                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                        x-kubernetes-int-or-string: true
                                    required:
                                    - policy
                                    type: object
                                    x-kubernetes-validations:
                                    - message: value must be set only for the Default
                                        and Ratio policies
                                      rule: 'self.policy == ''Default'' || self.policy
                                        == ''Ratio'' ? has(self.value) : !has(self.value)'
                                  description: Limits defines policies for resource
                                    limits.
                                  minProperties: 1
                                  type: object
                                requests:
                                  additionalProperties:
                                    description: WorkloadResourceRequestPolicy defines
                                      how a resource request is mutated.
                                    properties:
                                      policy:
                                        description: |-
                                          Policy selects how the request is handled: Preserve leaves it unchanged,
                                          Default fills an absent request, and Remove deletes it.
                                        enum:
                                        - Preserve
                                        - Default
                                        - Remove
                                        type: string
                                      value:
                                        anyOf:
                                        - type: integer
                                        - type: string
                                        description: Value is the quantity applied
                                          by the Default policy.
                                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                        x-kubernetes-int-or-string: true
                                    required:
                                    - policy
                                    type: object
                                    x-kubernetes-validations:
                                    - message: value must be set only for the Default
                                        policy
                                      rule: 'self.policy == ''Default'' ? has(self.value)
                                        : !has(self.value)'
                                  description: Requests defines policies for resource
                                    requests.
                                  minProperties: 1
                                  type: object
                              type: object
                              x-kubernetes-validations:
                              - message: at least one of requests or limits must be
                                  set
                                rule: has(self.requests) || has(self.limits)
                            schedulers:
                              description: |-
                                Schedulers defines schedulerName matchers for Pod admission.

                                The rule is evaluated against pod.spec.schedulerName.
                                Empty schedulerName is ignored and is not normalized to default-scheduler.
                              items:
                                description: |-
                                  At least one of Exact or Exp must be set.
                                  Both may be set together.
                                properties:
                                  exact:
                                    description: Exact matches one of the provided
                                      values exactly.
                                    items:
                                      type: string
                                    minItems: 1
                                    type: array
                                  exp:
                                    description: Exp matches regular expression.
                                    minLength: 1
                                    type: string
                                  negate:
                                    default: false
                                    description: Negate regular Expression
                                    type: boolean
                                type: object
                                x-kubernetes-validations:
                                - message: at least one of exact or exp must be set
                                  rule: has(self.exact) || has(self.exp)
                              type: array
                            targets:
                              description: |-
                                Define the enforcement targets this rule applies to.
                                If empty, each webhook applies its own backwards-compatible default.
                              items:
                                enum:
                                - pod
                                - pod/initcontainers
                                - pod/ephemeralcontainers
                                - pod/containers
                                - pod/volumes
                                type: string
                              type: array
                          type: object
                      type: object
                    quota:
                      description: |-
                        Quota contains native Kubernetes ResourceQuota specifications shared by
                        all namespaces selected by this rule. Unlike Enforce, quota accounting is
                        independent of the request audience.
                      items:
                        description: |-
                          ResourceQuotaRule defines a named ResourceQuota specification generated by a
                          Tenant rule. Name is the durable identity of the generated
                          GlobalResourceQuota and must be unique across all rules of a Tenant.
                        properties:
                          hard:
                            additionalProperties:
                              anyOf:
                              - type: integer
                              - type: string
                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                              x-kubernetes-int-or-string: true
                            description: |-
                              hard is the set of desired hard limits for each named resource.
                              More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
                            type: object
                          name:
                            description: |-
                              Name is the stable identity of this quota within the Tenant. Changing the
                              name replaces the generated GlobalResourceQuota; changing the quota or its
                              namespace selector updates the existing object.
                            maxLength: 63
                            minLength: 1
                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                            type: string
                          scopeSelector:
                            description: |-
                              scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota
                              but expressed using ScopeSelectorOperator in combination with possible values.
                              For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.
                            properties:
                              matchExpressions:
                                description: A list of scope selector requirements
                                  by scope of the resources.
                                items:
                                  description: |-
                                    A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator
                                    that relates the scope name and values.
                                  properties:
                                    operator:
                                      description: |-
                                        Represents a scope's relationship to a set of values.
                                        Valid operators are In, NotIn, Exists, DoesNotExist.
                                      type: string
                                    scopeName:
                                      description: The name of the scope that the
                                        selector applies to.
                                      type: string
                                    values:
                                      description: |-
                                        An array of string values. If the operator is In or NotIn,
                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                        the values array must be empty.
                                        This array is replaced during a strategic merge patch.
                                      items:
                                        type: string
                                      type: array
                                      x-kubernetes-list-type: atomic
                                  required:
                                  - operator
                                  - scopeName
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                            type: object
                            x-kubernetes-map-type: atomic
                          scopes:
                            description: |-
                              A collection of filters that must match each object tracked by a quota.
                              If not specified, the quota matches all objects.
                            items:
                              description: A ResourceQuotaScope defines a filter that
                                must match each object tracked by a quota
                              type: string
                            type: array
                            x-kubernetes-list-type: atomic
                        required:
                        - name
                        type: object
                      type: array
                      x-kubernetes-list-map-keys:
                      - name
                      x-kubernetes-list-type: map
                  type: object
                type: array
            required:
            - conditions
            type: object
        required:
        - metadata
        type: object
    served: true
    storage: true
    subresources:
      status: {}
