code: func (s *mustMatchPatterns) Validate(pod *api.Pod) field.ErrorList {
  	allErrs := field.ErrorList{}
  
  	var sysctls []api.Sysctl
  	if pod.Spec.SecurityContext != nil {
  		sysctls = pod.Spec.SecurityContext.Sysctls
  	}
  
  	fieldPath := field.NewPath("pod", "spec", "securityContext").Child("sysctls")
  
  	for i, sysctl := range sysctls {
  		switch {
  		case s.isForbidden(sysctl.Name):
  			allErrs = append(allErrs, field.ErrorList{field.Forbidden(fieldPath.Index(i), fmt.Sprintf("sysctl %q is not allowed", sysctl.Name))}...)
  		case s.isSafe(sysctl.Name):
  			continue
  		case s.isAllowedUnsafe(sysctl.Name):
  			continue
  		default:
  			allErrs = append(allErrs, field.ErrorList{field.Forbidden(fieldPath.Index(i), fmt.Sprintf("unsafe sysctl %q is not allowed", sysctl.Name))}...)
  		}
  	}
  
  	return allErrs
  }
docs: // Validate ensures that the specified values fall within the range of the strategy.