code: func (m *Matcher) GetNamespaceLabels(attr admission.Attributes) (map[string]string, error) {
  	// If the request itself is creating or updating a namespace, then get the
  	// labels from attr.Object, because namespaceLister doesn't have the latest
  	// namespace yet.
  	//
  	// However, if the request is deleting a namespace, then get the label from
  	// the namespace in the namespaceLister, because a delete request is not
  	// going to change the object, and attr.Object will be a DeleteOptions
  	// rather than a namespace object.
  	if attr.GetResource().Resource == "namespaces" &&
  		len(attr.GetSubresource()) == 0 &&
  		(attr.GetOperation() == admission.Create || attr.GetOperation() == admission.Update) {
  		accessor, err := meta.Accessor(attr.GetObject())
  		if err != nil {
  			return nil, err
  		}
  		return accessor.GetLabels(), nil
  	}
  
  	namespaceName := attr.GetNamespace()
  	namespace, err := m.NamespaceLister.Get(namespaceName)
  	if err != nil && !apierrors.IsNotFound(err) {
  		return nil, err
  	}
  	if apierrors.IsNotFound(err) {
  		// in case of latency in our caches, make a call direct to storage to verify that it truly exists or not
  		namespace, err = m.Client.CoreV1().Namespaces().Get(namespaceName, metav1.GetOptions{})
  		if err != nil {
  			return nil, err
  		}
  	}
  	return namespace.Labels, nil
  }
docs: // GetNamespaceLabels gets the labels of the namespace related to the attr.