code: func (w *patternWhitelist) Admit(attrs *lifecycle.PodAdmitAttributes) lifecycle.PodAdmitResult {
  	pod := attrs.Pod
  	if pod.Spec.SecurityContext == nil || len(pod.Spec.SecurityContext.Sysctls) == 0 {
  		return lifecycle.PodAdmitResult{
  			Admit: true,
  		}
  	}
  
  	var hostNet, hostIPC bool
  	if pod.Spec.SecurityContext != nil {
  		hostNet = pod.Spec.HostNetwork
  		hostIPC = pod.Spec.HostIPC
  	}
  	for _, s := range pod.Spec.SecurityContext.Sysctls {
  		if err := w.validateSysctl(s.Name, hostNet, hostIPC); err != nil {
  			return lifecycle.PodAdmitResult{
  				Admit:   false,
  				Reason:  ForbiddenReason,
  				Message: fmt.Sprintf("forbidden sysctl: %v", err),
  			}
  		}
  	}
  
  	return lifecycle.PodAdmitResult{
  		Admit: true,
  	}
  }
docs: // Admit checks that all sysctls given in pod's security context
  // are valid according to the whitelist.