Constraint match section

# excludedNamespaces <array>: ExcludedNamespaces is a list of namespace names. # If defined, a constraint only applies to resources not in a listed namespace. # ExcludedNamespaces also supports a prefix or suffix based glob.  For example, # `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, # and `excludedNamespaces: [*-system]` matches both `kube-system` and # `gatekeeper-system`. excludedNamespaces:   # <list item: string>: A string that supports globbing at its front or end.   # Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will   # match "kube-system" or "gatekeeper-system".  The asterisk is required for   # wildcard matching.   - <string> kinds:   # <list item: object>: Kinds accepts a list of objects with apiGroups and   # kinds fields that list the groups/kinds of objects to which the mutation   # will apply. If multiple groups/kinds objects are specified, only one match   # is needed for the resource to be in scope.   - # apiGroups <array>: APIGroups is the API groups the resources belong to.     # '*' is all groups. If '*' is present, the length of the slice must be     # one. Required.     apiGroups:       - <string>     kinds:       - <string> # labelSelector <object>: LabelSelector is the combination of two optional # fields: `matchLabels` and `matchExpressions`.  These two fields provide # different methods of selecting or excluding k8s objects based on the label # keys and values included in object metadata.  All selection expressions from # both sections are ANDed to determine if an object meets the cumulative # requirements of the selector. labelSelector:   # matchExpressions <array>: matchExpressions is a list of label selector   # requirements. The requirements are ANDed.   matchExpressions:     # <list item: object>: A label selector requirement is a selector that     # contains values, a key, and an operator that relates the key and values.     - # key <string>: key is the label key that the selector applies to.       key: <string>       # operator <string>: operator represents a key's relationship to a set       # of values. Valid operators are In, NotIn, Exists and DoesNotExist.       operator: <string>       # values <array>: values is an array of string values. If the operator       # is In or NotIn, the values array must be non-empty. If the operator       # is Exists or DoesNotExist, the values array must be empty. This array       # is replaced during a strategic merge patch.       values:         - <string>   # matchLabels <object>: matchLabels is a map of {key,value} pairs. A single   # {key,value} in the matchLabels map is equivalent to an element of   # matchExpressions, whose key field is "key", the operator is "In", and the   # values array contains only "value". The requirements are ANDed.   matchLabels:     [key]: <string> # name <string>: Name is the name of an object.  If defined, it will match # against objects with the specified name.  Name also supports a prefix or # suffix glob.  For example, `name: pod-*` would match both `pod-a` and # `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`. name: <string> # namespaceSelector <object>: NamespaceSelector is a label selector against an # object's containing namespace or the object itself, if the object is a # namespace. namespaceSelector:   # matchExpressions <array>: matchExpressions is a list of label selector   # requirements. The requirements are ANDed.   matchExpressions:     # <list item: object>: A label selector requirement is a selector that     # contains values, a key, and an operator that relates the key and values.     - # key <string>: key is the label key that the selector applies to.       key: <string>       # operator <string>: operator represents a key's relationship to a set       # of values. Valid operators are In, NotIn, Exists and DoesNotExist.       operator: <string>       # values <array>: values is an array of string values. If the operator       # is In or NotIn, the values array must be non-empty. If the operator       # is Exists or DoesNotExist, the values array must be empty. This array       # is replaced during a strategic merge patch.       values:         - <string>   # matchLabels <object>: matchLabels is a map of {key,value} pairs. A single   # {key,value} in the matchLabels map is equivalent to an element of   # matchExpressions, whose key field is "key", the operator is "In", and the   # values array contains only "value". The requirements are ANDed.   matchLabels:     [key]: <string> # namespaces <array>: Namespaces is a list of namespace names. If defined, a # constraint only applies to resources in a listed namespace.  Namespaces also # supports a prefix or suffix based glob.  For example, `namespaces: [kube-*]` # matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` # matches both `kube-system` and `gatekeeper-system`. namespaces:   # <list item: string>: A string that supports globbing at its front or end.   # Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will   # match "kube-system" or "gatekeeper-system".  The asterisk is required for   # wildcard matching.   - <string> # scope <string>: Scope determines if cluster-scoped and/or namespaced-scoped # resources are matched.  Accepts `*`, `Cluster`, or `Namespaced`. (defaults to # `*`) scope: <string> # source <string>: Source determines whether generated or original resources # are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A # value of `Generated` will only match generated resources, while `Original` # will only match regular resources. # Allowed Values: All, Generated, Original source: <string>