code: func (m *Matcher) MatchNamespaceSelector(h *v1beta1.Webhook, attr admission.Attributes) (bool, *apierrors.StatusError) {
  	namespaceName := attr.GetNamespace()
  	if len(namespaceName) == 0 && attr.GetResource().Resource != "namespaces" {
  		// If the request is about a cluster scoped resource, and it is not a
  		// namespace, it is never exempted.
  		// TODO: figure out a way selective exempt cluster scoped resources.
  		// Also update the comment in types.go
  		return true, nil
  	}
  	namespaceLabels, err := m.GetNamespaceLabels(attr)
  	// this means the namespace is not found, for backwards compatibility,
  	// return a 404
  	if apierrors.IsNotFound(err) {
  		status, ok := err.(apierrors.APIStatus)
  		if !ok {
  			return false, apierrors.NewInternalError(err)
  		}
  		return false, &apierrors.StatusError{status.Status()}
  	}
  	if err != nil {
  		return false, apierrors.NewInternalError(err)
  	}
  	// TODO: adding an LRU cache to cache the translation
  	selector, err := metav1.LabelSelectorAsSelector(h.NamespaceSelector)
  	if err != nil {
  		return false, apierrors.NewInternalError(err)
  	}
  	return selector.Matches(labels.Set(namespaceLabels)), nil
  }
docs: // MatchNamespaceSelector decideds whether the request matches the
  // namespaceSelctor of the webhook. Only when they match, the webhook is called.