A bundle is a versioned set of policies plus the ValidatingAdmissionPolicyBindings that switch them on. Nothing is enforced until you label a namespace, so a bundle is safe to install and then roll out one namespace at a time.
bundles2 policies193 bindings780 licenseApache-2.0Every bundle ships three bindings per policy, one per mode, each keyed to its own namespace label. Installing the bundle changes nothing on its own — the label is the switch, and you move one namespace at a time.
the API server returns a warning and admits the objectthe violation is written to the audit log and the object is admittedthe object is rejectedEach bundle page lists its own three label keys — the two bundles use different label prefixes — plus the per-policy opt-out label and the exact kubectl lines.
Pod Security Admission is the Kubernetes Pod Security Standards, rewritten as native admission policies. cenroq Best Practices is broader: pod hardening plus RBAC, secrets, exposure and risky-configuration guardrails.
Best practice validating admission bundle that enforces pod hardening, safer runtime defaults, and broader cluster guardrails (RBAC, secrets, exposure, and risky config restrictions) for a strong security baseline.
Pod Security Standards implemented as Validating Admission Policies, with the same levels (baseline and restricted).
Downloading and applying YAML by hand works. kubeapt makes it repeatable: install a bundle, pin its version, scan a cluster for the gaps it would close, and validate before you enforce.