With patch on namespaces, remove the pod-security.kubernetes.io/enforce label from an existing namespace, or set it to privileged, disabling PSA there

Or with create on namespaces, create a fresh namespace with no PSA label at all, which starts permissive

Either path assumes no restrictive cluster-wide default (AdmissionConfiguration).

With such a default, both fall back to it instead of to permissive

On its own this only removes a guard.

Creating the privileged pod needs a pods create verb, which this path does not include