code: func (c *nodePlugin) getForbiddenUpdateLabels(modifiedLabels sets.String) sets.String {
  	if len(modifiedLabels) == 0 {
  		return nil
  	}
  
  	forbiddenLabels := sets.NewString()
  	for label := range modifiedLabels {
  		namespace := getLabelNamespace(label)
  		// forbid kubelets from setting node-restriction labels
  		if namespace == v1.LabelNamespaceNodeRestriction || strings.HasSuffix(namespace, "."+v1.LabelNamespaceNodeRestriction) {
  			forbiddenLabels.Insert(label)
  		}
  		// forbid kubelets from setting unknown kubernetes.io and k8s.io labels on update
  		if isKubernetesLabel(label) && !kubeletapis.IsKubeletLabel(label) {
  			// TODO: defer to label policy once available
  			forbiddenLabels.Insert(label)
  		}
  	}
  	return forbiddenLabels
  }
docs: // getForbiddenLabels returns the set of labels that may not be set by the node on update.