code: func (d *DenyExec) Validate(a admission.Attributes, o admission.ObjectInterfaces) (err error) {
  	path := a.GetResource().Resource
  	if subresource := a.GetSubresource(); subresource != "" {
  		path = path + "/" + subresource
  	}
  	// Only handle exec or attach requests on pods
  	if path != "pods/exec" && path != "pods/attach" {
  		return nil
  	}
  	pod, err := d.client.CoreV1().Pods(a.GetNamespace()).Get(a.GetName(), metav1.GetOptions{})
  	if err != nil {
  		return admission.NewForbidden(a, err)
  	}
  
  	if d.hostNetwork && pod.Spec.HostNetwork {
  		return admission.NewForbidden(a, fmt.Errorf("cannot exec into or attach to a container using host network"))
  	}
  
  	if d.hostPID && pod.Spec.HostPID {
  		return admission.NewForbidden(a, fmt.Errorf("cannot exec into or attach to a container using host pid"))
  	}
  
  	if d.hostIPC && pod.Spec.HostIPC {
  		return admission.NewForbidden(a, fmt.Errorf("cannot exec into or attach to a container using host ipc"))
  	}
  
  	if d.privileged && isPrivileged(pod) {
  		return admission.NewForbidden(a, fmt.Errorf("cannot exec into or attach to a privileged container"))
  	}
  
  	return nil
  }
docs: // Validate makes an admission decision based on the request attributes