kubernetes/staging/src/k8s.io/pod-security-admission/webhook/manifests/10-namespace.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: pod-security-webhook
  labels:
    # Even though the validating webhook excludes intercepting this namespace to avoid a circular dependency,
    # the deployment pod spec is compatible with the restricted level, so mark the namespace as restricted anyway.
    pod-security.kubernetes.io/enforce: restricted