code: func (a *Plugin) Validate(attributes admission.Attributes, o admission.ObjectInterfaces) (err error) {
  	// Ignore all calls to subresources or resources other than pods.
  	if attributes.GetSubresource() != "" || attributes.GetResource().GroupResource() != api.Resource("pods") {
  		return nil
  	}
  
  	pod, ok := attributes.GetObject().(*api.Pod)
  	if !ok {
  		return apierrors.NewBadRequest("Resource was marked with kind Pod but was unable to be converted")
  	}
  
  	// Build list of ImageReviewContainerSpec
  	var imageReviewContainerSpecs []v1alpha1.ImageReviewContainerSpec
  	containers := make([]api.Container, 0, len(pod.Spec.Containers)+len(pod.Spec.InitContainers))
  	containers = append(containers, pod.Spec.Containers...)
  	containers = append(containers, pod.Spec.InitContainers...)
  	for _, c := range containers {
  		imageReviewContainerSpecs = append(imageReviewContainerSpecs, v1alpha1.ImageReviewContainerSpec{
  			Image: c.Image,
  		})
  	}
  	imageReview := v1alpha1.ImageReview{
  		Spec: v1alpha1.ImageReviewSpec{
  			Containers:  imageReviewContainerSpecs,
  			Annotations: a.filterAnnotations(pod.Annotations),
  			Namespace:   attributes.GetNamespace(),
  		},
  	}
  	if err := a.admitPod(pod, attributes, &imageReview); err != nil {
  		return admission.NewForbidden(attributes, err)
  	}
  	return nil
  }
docs: // Validate makes an admission decision based on the request attributes