apiVersion: v1
kind: Namespace
metadata:
name: pod-security-webhook
labels:
# Even though the validating webhook excludes intercepting this namespace to avoid a circular dependency,
# the deployment pod spec is compatible with the restricted level, so mark the namespace as restricted anyway.
pod-security.kubernetes.io/enforce: restricted