*LabelSelectorAttributesindicatesalabellimitedaccess.Webhookauthorsareencouragedto*ensurerawSelectorandrequirementsarenotbothset*considertherequirementsfieldifset*nottrytoparseorconsidertherawSelectorfieldifset.ThisistoavoidanotherCVE-2022-2880(i.e.gettingdifferentsystemstoagreeonhowexactlytoparseaqueryisnotsomethingwewant),seehttps://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.