yeah if you give a user namespace edit access, then PSA is not going to help you (apart from that default config option you listed, but then even that is tricky

yeah if you give a user namespace edit access, then PSA is not going to help you (apart from that default config option you listed, but then even that is tricky as you need to know the namespaces to exempt like kube-system and others) Kubeadm is a pretty barebones option, which I think needs work to scale (you're on the hook to add all the bells and whistles to create a full k8s environment) There's validating admission policy coming along (https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/ https://kubernetes.io/docs/reference/access-authn-authz/vali...) beta in 1.28, but you still need the policies to apply. Really for a more "batteries included" kind of cluster, you'd need one of the larger distributions that tries to do more out of the box. Obviously OpenShift is the ultimate example of that (for on-prem) but it massively increases the complexity of the environment.