Glossary
Pod Security Admission
The built-in Kubernetes admission controller that enforces the Pod Security Standards (privileged, baseline, restricted) per namespace via labels.
Pod Security Admission (PSA) applies the Pod Security Standards (privileged, baseline, restricted) to namespaces through labels such as pod-security.kubernetes.io/enforce: baseline. It has three modes: enforce rejects violating Pods, audit adds an annotation to the audit event, warn returns a warning to the client.
enforce applies to Pods, not to workload objects: a privileged DaemonSet can be accepted while its Pods are rejected, so check the Pod creations before concluding. Enforcing baseline blocks privileged containers, host namespaces and hostPath volumes. See the PSA documentation.