_isPermitted (namespace, descriptor) {
    let allowed = true
    let reason = ''

    if (!namespace.metadata.annotations) {
      allowed = !this._enforceNamespaceAnnotation
      reason = this._enforceNamespaceAnnotation ? 'Namespace annotation is required' : ''
      return {
        allowed, reason
      }
    }

    // 1. testing naming convention if defined in namespace

    const externalData = descriptor.data || descriptor.properties
    const namingConvention = namespace.metadata.annotations[this._namingPermittedAnnotation]
    let reNaming = new RegExp()
    if (Array.isArray(namingConvention)) {
      reNaming = new RegExp(namingConvention.join('|'))
    } else {
      reNaming = new RegExp(namingConvention)
    }

    if (!namingConvention && this._enforceNamespaceAnnotation) {
      allowed = false
      reason = `Missing required annotation ${this._namingPermittedAnnotation} on namespace ${namespace.metadata.name}`
      return {
        allowed, reason
      }
    }

    // Testing data property
    if (namingConvention && externalData) {
      externalData.forEach((secretProperty, index) => {
        if ('path' in secretProperty && !reNaming.test(secretProperty.path)) {
          allowed = false
          reason = `path ${secretProperty.path} does not match naming convention ${namingConvention}`
          return {
            allowed, reason
          }
        }

        if ('key' in secretProperty && !reNaming.test(secretProperty.key)) {
          allowed = false
          reason = `key name ${secretProperty.key} does not match naming convention ${namingConvention}`
          return {
            allowed, reason
          }
        }
      })
    }

    // Testing DataFrom property
    const externalDataFrom = descriptor.dataFrom
    if (namingConvention && externalDataFrom) {
      externalDataFrom.forEach((secretProperty, index) => {
        if (!reNaming.test(secretProperty)) {
          allowed = false
          reason = `key name ${secretProperty} does not match naming convention ${namingConvention}`
          return {
            allowed, reason
          }
        }
      })
    }

    // 2. testing assume role if configured

    const role = descriptor.roleArn || descriptor.vaultRole

    if (!role) {
      return {
        allowed, reason
      }
    }

    if (!namespace.metadata.annotations[this._rolePermittedAnnotation] && this._enforceNamespaceAnnotation) {
      allowed = false
      reason = `Missing required annotation ${this._rolePermittedAnnotation} on namespace ${namespace.metadata.name}`
      return {
        allowed, reason
      }
    }
    // an empty annotation value allows access to all roles
    const re = new RegExp(namespace.metadata.annotations[this._rolePermittedAnnotation])

    if (!re.test(role)) {
      allowed = false
      reason = `namespace does not allow to assume role ${role}`
    }

    return {
      allowed,
      reason
    }
  }
checks if the supplied namespace is allowed to sync the given secret

@param {Object} namespace namespace object
@param {Object} descriptor secret descriptor