Currently hypershift sets the pod security admission level of control plane namespaces as `privileged`. The reason for this is that the router we create in that namespace needs privilege escalation. However, this is achievable with a policy of `baseline`.

all

always

1. Create a hosted cluster
2. Inspect labels of hosted control plane namespace
3.

pod-security.kubernetes.io/enforce is set to 'privileged'

pod-security.kubernetes.io/enforce is set to 'baseline'