{
  "description": "ParamRef describes how to locate the params to be used as input to expressions of rules applied by a policy binding.",
  "properties": {
    "name": {
      "description": "name is the name of the resource being referenced.\n\nOne of `name` or `selector` must be set, but `name` and `selector` are mutually exclusive properties. If one is set, the other must be unset.\n\nA single parameter used for all admission requests can be configured by setting the `name` field, leaving `selector` blank, and setting namespace if `paramKind` is namespace-scoped.",
      "type": [
        "string",
        "null"
      ]
    },
    "namespace": {
      "description": "namespace is the namespace of the referenced resource. Allows limiting the search for params to a specific namespace. Applies to both `name` and `selector` fields.\n\nA per-namespace parameter may be used by specifying a namespace-scoped `paramKind` in the policy and leaving this field empty.\n\n- If `paramKind` is cluster-scoped, this field MUST be unset. Setting this field results in a configuration error.\n\n- If `paramKind` is namespace-scoped, the namespace of the object being evaluated for admission will be used when this field is left unset. Take care that if this is left empty the binding must not match any cluster-scoped resources, which will result in an error.",
      "type": [
        "string",
        "null"
      ]
    },
    "parameterNotFoundAction": {
      "description": "`parameterNotFoundAction` controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. If set to `Deny`, then no matched parameters will be subject to the `failurePolicy` of the policy.\n\nAllowed values are `Allow` or `Deny`\n\nRequired",
      "type": [
        "string",
        "null"
      ]
    },
    "selector": {
      "description": "A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.",
      "properties": {
        "matchExpressions": {
          "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
          "items": {
            "description": "A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.",
            "properties": {
              "key": {
                "description": "key is the label key that the selector applies to.",
                "type": "string"
              },
              "operator": {
                "description": "operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.",
                "type": "string"
              },
              "values": {
                "description": "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.",
                "items": {
                  "type": [
                    "string",
                    "null"
                  ]
                },
                "type": [
                  "array",
                  "null"
                ],
                "x-kubernetes-list-type": "atomic"
              }
            },
            "required": [
              "key",
              "operator"
            ],
            "type": [
              "object",
              "null"
            ],
            "additionalProperties": false
          },
          "type": [
            "array",
            "null"
          ],
          "x-kubernetes-list-type": "atomic"
        },
        "matchLabels": {
          "additionalProperties": {
            "type": [
              "string",
              "null"
            ]
          },
          "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
          "type": [
            "object",
            "null"
          ]
        }
      },
      "type": [
        "object",
        "null"
      ],
      "x-kubernetes-map-type": "atomic",
      "additionalProperties": false
    }
  },
  "type": "object",
  "x-kubernetes-map-type": "atomic",
  "additionalProperties": false,
  "$schema": "http://json-schema.org/schema#"
}