func mutatePodObject(rawObj *runtime.RawExtension) *admissionv1.AdmissionResponse {
	pod := corev1.Pod{}
	deserializer := codecs.UniversalDeserializer()
	if _, _, err := deserializer.Decode(rawObj.Raw, nil, &pod); err != nil {
		log.Printf("ERROR: failed to deserialize Pod object: %v", err)
		return errResponse(err)
	}
	reviewResponse := admissionv1.AdmissionResponse{}
	reviewResponse.Allowed = true
	patches := []jsonPatch{}
	if pod.ObjectMeta.Annotations == nil {
		patches = append(patches, jsonPatch{Op: "add", Path: "/metadata/annotations", Value: map[string]string{}})
	}
	patch, err := patchResourceAnnotation(&pod)
	if err != nil {
		return errResponse(err)
	}
	patches = append(patches, patch)
	reviewResponse.Patch, err = json.Marshal(patches)
	if err != nil {
		log.Printf("ERROR: failed to marshal Pod patch: %v", err)
		return errResponse(err)
	}
	patchType := admissionv1.PatchTypeJSONPatch
	reviewResponse.PatchType = &patchType
	return &reviewResponse
}
Handle AdmissionReview requests for Pod objects
package main
import (
	"encoding/json"
	"errors"
	"fmt"
	"io/ioutil"
	"log"
	"net/http"
	admissionv1 "k8s.io/api/admission/v1"
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"
	"k8s.io/apimachinery/pkg/runtime/serializer"
	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
	"sigs.k8s.io/yaml"
)
type jsonPatch struct {
	Op    string      `json:"op"`
	Path  string      `json:"path"`
	Value interface{} `json:"value"`
}
type podResourceRequirements struct {
	InitContainers map[string]corev1.ResourceRequirements `json:"initContainers"`
	Containers     map[string]corev1.ResourceRequirements `json:"containers"`
}
var scheme = runtime.NewScheme()
var codecs = serializer.NewCodecFactory(scheme)
func init() {
	utilruntime.Must(corev1.AddToScheme(scheme))
	utilruntime.Must(admissionv1.AddToScheme(scheme))
}
func errResponse(err error) *admissionv1.AdmissionResponse {
	return &admissionv1.AdmissionResponse{
		Result: &metav1.Status{
			Message: err.Error(),
		},
	}
}
func stringify(r interface{}) string {
	out, err := yaml.Marshal(r)
	if err != nil {
		return fmt.Sprintf("!!!!!\nUnable to stringify %T: %v\n!!!!!", r, err)
	}
	return string(out)
}
func handle(w http.ResponseWriter, r *http.Request) {
	var body []byte
	if r.Body != nil {
		if data, err := ioutil.ReadAll(r.Body); err == nil {
			body = data
		}
	}
	contentType := r.Header.Get("Content-Type")
	if contentType != "application/json" {
		log.Printf("ERROR: incorrect Content-Type (received %s, expect application/json", contentType)
		return
	}
	arReq := admissionv1.AdmissionReview{}
	arRsp := admissionv1.AdmissionReview{}
	deserializer := codecs.UniversalDeserializer()
	if _, _, err := deserializer.Decode(body, nil, &arReq); err != nil {
		log.Printf("ERROR: deserializing admission request failed: %v", err)
		arRsp.Response = errResponse(err)
	} else if arReq.Request == nil {
		log.Printf("REQUEST empty")
		arRsp.Response = errResponse(errors.New("Empty request"))
	} else {
		log.Printf("REQUEST:\n%s", stringify(&arReq))
		if arReq.Request.Resource.Group != "" || arReq.Request.Resource.Version != "v1" {
			arRsp.Response = errResponse(fmt.Errorf("Unexpected resource group/version '%s/%s'", arReq.Request.Resource.Group, arReq.Request.Resource.Version))
		} else {
			res := arReq.Request.Resource.Resource
			switch res {
			case "pods":
				arRsp.Kind = "AdmissionReview"
				arRsp.APIVersion = "admission.k8s.io/v1"
				arRsp.Response = mutatePodObject(&arReq.Request.Object)
			default:
				arRsp.Response = errResponse(fmt.Errorf("Unexpected resource %s", arReq.Request.Resource))
			}
		}
		arRsp.Response.UID = arReq.Request.UID
	}
	log.Printf("RESPONSE:\n%s", stringify(arRsp.Response))
	respBytes, err := json.Marshal(arRsp)
	if err != nil {
		log.Printf("ERROR: json marshal failed: %v", err)
	}
	if _, err := w.Write(respBytes); err != nil {
		log.Printf("ERROR: failed to write HTTP response: %v", err)
	}
}