code: func (p *plugin) Admit(attributes admission.Attributes, o admission.ObjectInterfaces) error {
  	// Ignore all calls to subresources or resources other than pods.
  	if len(attributes.GetSubresource()) != 0 || attributes.GetResource().GroupResource() != core.Resource("pods") {
  		return nil
  	}
  
  	pod, ok := attributes.GetObject().(*core.Pod)
  	if !ok {
  		return errors.NewBadRequest(fmt.Sprintf("expected *core.Pod but got %T", attributes.GetObject()))
  	}
  
  	resources := sets.String{}
  	for _, container := range pod.Spec.Containers {
  		for resourceName := range container.Resources.Requests {
  			if helper.IsExtendedResourceName(resourceName) {
  				resources.Insert(string(resourceName))
  			}
  		}
  	}
  	for _, container := range pod.Spec.InitContainers {
  		for resourceName := range container.Resources.Requests {
  			if helper.IsExtendedResourceName(resourceName) {
  				resources.Insert(string(resourceName))
  			}
  		}
  	}
  
  	// Doing .List() so that we get a stable sorted list.
  	// This allows us to test adding tolerations for multiple extended resources.
  	for _, resource := range resources.List() {
  		helper.AddOrUpdateTolerationInPod(pod, &core.Toleration{
  			Key:      resource,
  			Operator: core.TolerationOpExists,
  			Effect:   core.TaintEffectNoSchedule,
  		})
  	}
  
  	return nil
  }
docs: // Admit updates the toleration of a pod based on the resources requested by it.
  // If an extended resource of name "example.com/device" is requested, it adds
  // a toleration with key "example.com/device", operator "Exists" and effect "NoSchedule".
  // The rationale for this is described in:
  // https://github.com/kubernetes/kubernetes/issues/55080