code: func (p *podNodeSelector) Validate(a admission.Attributes, o admission.ObjectInterfaces) error {
  	if shouldIgnore(a) {
  		return nil
  	}
  	if !p.WaitForReady() {
  		return admission.NewForbidden(a, fmt.Errorf("not yet ready to handle request"))
  	}
  
  	resource := a.GetResource().GroupResource()
  	pod := a.GetObject().(*api.Pod)
  
  	namespaceNodeSelector, err := p.getNamespaceNodeSelectorMap(a.GetNamespace())
  	if err != nil {
  		return err
  	}
  	if labels.Conflicts(namespaceNodeSelector, labels.Set(pod.Spec.NodeSelector)) {
  		return errors.NewForbidden(resource, pod.Name, fmt.Errorf("pod node label selector conflicts with its namespace node label selector"))
  	}
  
  	// whitelist verification
  	whitelist, err := labels.ConvertSelectorToLabelsMap(p.clusterNodeSelectors[a.GetNamespace()])
  	if err != nil {
  		return err
  	}
  	if !labels.AreLabelsInWhiteList(pod.Spec.NodeSelector, whitelist) {
  		return errors.NewForbidden(resource, pod.Name, fmt.Errorf("pod node label selector labels conflict with its namespace whitelist"))
  	}
  
  	return nil
  }
docs: // Validate ensures that the pod node selector is allowed