func admitServices(ar v1beta1.AdmissionReview, o *options) *v1beta1.AdmissionResponse {
	var reviewResponse = &v1beta1.AdmissionResponse{
		Allowed: true,
	}
	serviceResource := metav1.GroupVersionResource{Group: "", Version: "v1", Resource: "services"}
	if ar.Request.Resource != serviceResource {
		glog.Errorf("expect resource to be %s", serviceResource)
		return nil
	}
	raw := ar.Request.Object.Raw
	service := v1.Service{}
	if err := json.Unmarshal(raw, &service); err != nil {
		glog.Error(err)
		return nil
	}
	if service.Spec.Type == "LoadBalancer" {
		validateLB(reviewResponse, service, o)
	}
	return reviewResponse
}
only allow pods to pull images from specific registry.
package main
import (
	"encoding/json"
	"flag"
	"fmt"
	"io/ioutil"
	"net/http"
	"github.com/golang/glog"
	"k8s.io/api/admission/v1beta1"
	"k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)
type options struct {
	ServiceAnnotationKey   string
	ServiceAnnotationValue string
	PortNumber             string
}
var (
	Options options
)