code: func (p *podNodeSelector) Admit(a admission.Attributes, o admission.ObjectInterfaces) error {
  	if shouldIgnore(a) {
  		return nil
  	}
  	if !p.WaitForReady() {
  		return admission.NewForbidden(a, fmt.Errorf("not yet ready to handle request"))
  	}
  
  	resource := a.GetResource().GroupResource()
  	pod := a.GetObject().(*api.Pod)
  	namespaceNodeSelector, err := p.getNamespaceNodeSelectorMap(a.GetNamespace())
  	if err != nil {
  		return err
  	}
  
  	if labels.Conflicts(namespaceNodeSelector, labels.Set(pod.Spec.NodeSelector)) {
  		return errors.NewForbidden(resource, pod.Name, fmt.Errorf("pod node label selector conflicts with its namespace node label selector"))
  	}
  
  	// Merge pod node selector = namespace node selector + current pod node selector
  	// second selector wins
  	podNodeSelectorLabels := labels.Merge(namespaceNodeSelector, pod.Spec.NodeSelector)
  	pod.Spec.NodeSelector = map[string]string(podNodeSelectorLabels)
  	return p.Validate(a, o)
  }
docs: // Admit enforces that pod and its namespace node label selectors matches at least a node in the cluster.