A Kubernetes cluster tenant can launch privileged Pods in contravention of therestricted Pod Security Standardmandated...

ThePodSecurity admission controllerenforces Pod Security Standards (Baseline, Restricted, Privileged)based on namespace labels.

If a tenant has full CRUD on the namespace object, they canmodify the namespace labelsto remove or weaken the restriction (e.g., setting pod-security.kubernetes.io/enforce=privileged).

This allows privileged Pods to be admitted despite the security policy.

Incorrect options:

(A) is false — namespace-level access allows tampering.

(C) is invalid — PodSecurity admission is not namespace-deployed, it’s a cluster-wide admission controller.

(D) is unrelated — Secrets from other namespaces wouldn’t directly bypass PodSecurity enforcement.