Change:
spec.variables should be marked omitempty. I'm trying to create a validating admission policy that uses in v1.27 as follows: I'm setting : to "Strict" in CreateOptions so that the server will reject requests with unknown fields but it complains that the don't exist in v1.27 and it does make sense because this field was introduced in v1.28: I'm using a 1.28 client.
/sig api-machinery
/assign
/assign /triage accepted
Thanks for raising this! /cc

Discussion:
// +listType=map // +listMapKey=name // +optional <del> Variables []Variable `json:"variables" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,7,rep,name=variables"` </del> <ins> Variables []Variable `json:"variables,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,7,rep,name=variables"` </ins> } type MatchCondition v1.MatchCondition

// +listType=map // +listMapKey=name // +optional <del> Variables []Variable `json:"variables" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,7,rep,name=variables"` </del> <ins> Variables []Variable `json:"variables,omitempty" patchStrategy:"merge" patchMergeKey:"name" protobuf:"bytes,7,rep,name=variables"` </ins> } // ParamKind is a tuple of Group Kind and Version.

<del> { "kind": "ValidatingAdmissionPolicy", "apiVersion": "admissionregistration.k8s.io/v1alpha1", "metadata": { "name": "nameValue", "generateName": "generateNameValue", "namespace": "namespaceValue", "selfLink": "selfLinkValue", "uid": "uidValue", "resourceVersion": "resourceVersionValue", "generation": 7, "creationTimestamp": "2008-01-01T01:01:01Z", "deletionTimestamp": "2009-01-01T01:01:01Z", "deletionGracePeriodSeconds": 10, "labels": { "labelsKey": "labelsValue" }, "annotations": { "annotationsKey": "annotationsValue" }, "ownerReferences": [ { "apiVersion": "apiVersionValue", "kind": "kindValue", "name": "nameValue", "uid": "uidValue", "controller": true, "blockOwnerDeletion": true } ], "finalizers": [ "finalizersValue" ], "managedFields": [ { "manager": "managerValue", "operation": "operationValue", "apiVersion": "apiVersionValue", "time": "2004-01-01T01:01:01Z", "fieldsType": "fieldsTypeValue", "fieldsV1": {}, "subresource": "subresourceValue" } ] }, "spec": { "paramKind": { "apiVersion": "apiVersionValue", "kind": "kindValue" }, "matchConstraints": { "namespaceSelector": { "matchLabels": { "matchLabelsKey": "matchLabelsValue" }, "matchExpressions": [ { "key": "keyValue", "operator": "operatorValue", "values": [ "valuesValue" ] } ] }, "objectSelector": { "matchLabels": { "matchLabelsKey": "matchLabelsValue" }, "matchExpressions": [ { "key": "keyValue", "operator": "operatorValue", "values": [ "valuesValue" ] } ] }, "resourceRules": [ { "resourceNames": [ "resourceNamesValue" ], "operations": [ "operationsValue" ], "apiGroups": [ "apiGroupsValue" ], "apiVersions": [ "apiVersionsValue" ], "resources": [ "resourcesValue" ], "scope": "scopeValue" } ], "excludeResourceRules": [ { "resourceNames": [ "resourceNamesValue" ], "operations": [ "operationsValue" ], "apiGroups": [ "apiGroupsValue" ], "apiVersions": [ "apiVersionsValue" ], "resources": [ "resourcesValue" ], "scope": "scopeValue" } ], "matchPolicy": "matchPolicyValue" }, "validations": [ { "expression": "expressionValue", "message": "messageValue", "reason": "reasonValue", "messageExpression": "messageExpressionValue" } ], "failurePolicy": "failurePolicyValue", "auditAnnotations": [ { "key": "keyValue", "valueExpression": "valueExpressionValue" } ], "matchConditions": [ { "name": "nameValue", "expression": "expressionValue" } ], "variables": null }, "status": { "observedGeneration": 1, "typeChecking": { "expressionWarnings": [ { "fieldRef": "fieldRefValue", "warning": "warningValue" } ] }, "conditions": [ { "type": "typeValue", "status": "statusValue", "observedGeneration": 3, "lastTransitionTime": "2004-01-01T01:01:01Z", "reason": "reasonValue", "message": "messageValue" } ] } } </del>  No newline at end of file

<del> apiVersion: admissionregistration.k8s.io/v1alpha1 kind: ValidatingAdmissionPolicy metadata: annotations: annotationsKey: annotationsValue creationTimestamp: "2008-01-01T01:01:01Z" deletionGracePeriodSeconds: 10 deletionTimestamp: "2009-01-01T01:01:01Z" finalizers: - finalizersValue generateName: generateNameValue generation: 7 labels: labelsKey: labelsValue managedFields: - apiVersion: apiVersionValue fieldsType: fieldsTypeValue fieldsV1: {} manager: managerValue operation: operationValue subresource: subresourceValue time: "2004-01-01T01:01:01Z" name: nameValue namespace: namespaceValue ownerReferences: - apiVersion: apiVersionValue blockOwnerDeletion: true controller: true kind: kindValue name: nameValue uid: uidValue resourceVersion: resourceVersionValue selfLink: selfLinkValue uid: uidValue spec: auditAnnotations: - key: keyValue valueExpression: valueExpressionValue failurePolicy: failurePolicyValue matchConditions: - expression: expressionValue name: nameValue matchConstraints: excludeResourceRules: - apiGroups: - apiGroupsValue apiVersions: - apiVersionsValue operations: - operationsValue resourceNames: - resourceNamesValue resources: - resourcesValue scope: scopeValue matchPolicy: matchPolicyValue namespaceSelector: matchExpressions: - key: keyValue operator: operatorValue values: - valuesValue matchLabels: matchLabelsKey: matchLabelsValue objectSelector: matchExpressions: - key: keyValue operator: operatorValue values: - valuesValue matchLabels: matchLabelsKey: matchLabelsValue resourceRules: - apiGroups: - apiGroupsValue apiVersions: - apiVersionsValue operations: - operationsValue resourceNames: - resourceNamesValue resources: - resourcesValue scope: scopeValue paramKind: apiVersion: apiVersionValue kind: kindValue validations: - expression: expressionValue message: messageValue messageExpression: messageExpressionValue reason: reasonValue variables: null status: conditions: - lastTransitionTime: "2004-01-01T01:01:01Z" message: messageValue observedGeneration: 3 reason: reasonValue status: statusValue type: typeValue observedGeneration: 1 typeChecking: expressionWarnings: - fieldRef: fieldRefValue warning: warningValue </del>