code: func (s *strategy) ValidatePod(pod *api.Pod) field.ErrorList {
  	allErrs := field.ErrorList{}
  	podSpecFieldPath := field.NewPath("pod", "metadata", "annotations").Key(api.SeccompPodAnnotationKey)
  	podProfile := pod.Annotations[api.SeccompPodAnnotationKey]
  
  	if !s.allowAnyProfile && len(s.allowedProfiles) == 0 && podProfile != "" {
  		allErrs = append(allErrs, field.Forbidden(podSpecFieldPath, "seccomp may not be set"))
  		return allErrs
  	}
  
  	if !s.profileAllowed(podProfile) {
  		msg := fmt.Sprintf("%s is not an allowed seccomp profile. Valid values are %v", podProfile, s.allowedProfilesString)
  		allErrs = append(allErrs, field.Forbidden(podSpecFieldPath, msg))
  	}
  
  	return allErrs
  }
docs: // ValidatePod ensures that the specified values on the pod fall within the range
  // of the strategy.