code: func (*AlwaysPullImages) Validate(attributes admission.Attributes, o admission.ObjectInterfaces) (err error) {
  	if shouldIgnore(attributes) {
  		return nil
  	}
  
  	pod, ok := attributes.GetObject().(*api.Pod)
  	if !ok {
  		return apierrors.NewBadRequest("Resource was marked with kind Pod but was unable to be converted")
  	}
  
  	for i := range pod.Spec.InitContainers {
  		if pod.Spec.InitContainers[i].ImagePullPolicy != api.PullAlways {
  			return admission.NewForbidden(attributes,
  				field.NotSupported(field.NewPath("spec", "initContainers").Index(i).Child("imagePullPolicy"),
  					pod.Spec.InitContainers[i].ImagePullPolicy, []string{string(api.PullAlways)},
  				),
  			)
  		}
  	}
  	for i := range pod.Spec.Containers {
  		if pod.Spec.Containers[i].ImagePullPolicy != api.PullAlways {
  			return admission.NewForbidden(attributes,
  				field.NotSupported(field.NewPath("spec", "containers").Index(i).Child("imagePullPolicy"),
  					pod.Spec.Containers[i].ImagePullPolicy, []string{string(api.PullAlways)},
  				),
  			)
  		}
  	}
  
  	return nil
  }
docs: // Validate makes sure that all containers are set to always pull images