patch namespaces
Removing the pod-security.kubernetes.io/enforce label disables Pod Security Admission for that namespace, permitting privileged pods, unless the cluster sets a restrictive cluster-wide default via AdmissionConfiguration.
Removal then falls back to that default, not to permissive.
- API Group
- (core)
- Scope
- cluster
- Audit Level
- Request
Escalation Paths
With patch on namespaces, remove the pod-security.kubernetes.io/enforce label from an existing namespace, or set it to privileged, disabling PSA there
Or with create on namespaces, create a fresh namespace with no PSA label at all, which starts permissive
Either path assumes no restrictive cluster-wide default (AdmissionConfiguration).
With such a default, both fall back to it instead of to permissive
Create privileged pods freely in the now-unenforced namespace
Additional rights needed: