code: func validatePodSecurityPolicySysctls(fldPath *field.Path, sysctls []string) field.ErrorList {
  	allErrs := field.ErrorList{}
  
  	if len(sysctls) == 0 {
  		return allErrs
  	}
  
  	coversAll := false
  	for i, s := range sysctls {
  		if len(s) == 0 {
  			allErrs = append(allErrs, field.Invalid(fldPath.Index(i), sysctls[i], fmt.Sprintf("empty sysctl not allowed")))
  		} else if !IsValidSysctlPattern(string(s)) {
  			allErrs = append(
  				allErrs,
  				field.Invalid(fldPath.Index(i), sysctls[i], fmt.Sprintf("must have at most %d characters and match regex %s",
  					apivalidation.SysctlMaxLength,
  					SysctlPatternFmt,
  				)),
  			)
  		} else if s[0] == '*' {
  			coversAll = true
  		}
  	}
  
  	if coversAll && len(sysctls) > 1 {
  		allErrs = append(allErrs, field.Forbidden(fldPath.Child("items"), fmt.Sprintf("if '*' is present, must not specify other sysctls")))
  	}
  
  	return allErrs
  }
docs: // validatePodSecurityPolicySysctls validates the sysctls fields of PodSecurityPolicy.