code: func (p *Provision) Admit(a admission.Attributes, o admission.ObjectInterfaces) error {
  	// Don't create a namespace if the request is for a dry-run.
  	if a.IsDryRun() {
  		return nil
  	}
  
  	// if we're here, then we've already passed authentication, so we're allowed to do what we're trying to do
  	// if we're here, then the API server has found a route, which means that if we have a non-empty namespace
  	// its a namespaced resource.
  	if len(a.GetNamespace()) == 0 || a.GetKind().GroupKind() == api.Kind("Namespace") {
  		return nil
  	}
  	// we need to wait for our caches to warm
  	if !p.WaitForReady() {
  		return admission.NewForbidden(a, fmt.Errorf("not yet ready to handle request"))
  	}
  
  	_, err := p.namespaceLister.Get(a.GetNamespace())
  	if err == nil {
  		return nil
  	}
  
  	if !errors.IsNotFound(err) {
  		return admission.NewForbidden(a, err)
  	}
  
  	namespace := &corev1.Namespace{
  		ObjectMeta: metav1.ObjectMeta{
  			Name:      a.GetNamespace(),
  			Namespace: "",
  		},
  		Status: corev1.NamespaceStatus{},
  	}
  
  	_, err = p.client.CoreV1().Namespaces().Create(namespace)
  	if err != nil && !errors.IsAlreadyExists(err) {
  		return admission.NewForbidden(a, err)
  	}
  
  	return nil
  }
docs: // Admit makes an admission decision based on the request attributes