in controller/webhook.go [300:314]
func (whsvr *WebhookServer) getRoleArn(nsLabels map[string]string, podMetadata *metav1.ObjectMeta) string {
annotations := podMetadata.GetAnnotations()
if annotations == nil {
annotations = map[string]string{}
}
roleArn := annotations[signingProxyWebhookAnnotationRoleArnKey]
if strings.TrimSpace(roleArn) == "" {
roleArn = nsLabels[signingProxyWebhookLabelRoleArnKey]
}
return roleArn
}