code: func tryEnsureNamespace(client corev1client.NamespaceInterface, namespace string) error {
  	_, getErr := client.Get(namespace, metav1.GetOptions{})
  	if getErr == nil {
  		return nil
  	}
  
  	if fatalGetErr := utilerrors.FilterOut(getErr, apierrors.IsNotFound, apierrors.IsForbidden); fatalGetErr != nil {
  		return fatalGetErr
  	}
  
  	ns := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: namespace}}
  	_, createErr := client.Create(ns)
  
  	return utilerrors.FilterOut(createErr, apierrors.IsAlreadyExists, apierrors.IsForbidden)
  }
docs: // tryEnsureNamespace gets or creates the given namespace while ignoring forbidden errors.
  // It is a best effort attempt as the user may not be able to get or create namespaces.
  // This allows us to handle flows where the user can only mutate roles and role bindings.