This script will tell you the most restrictive policy to apply to each namespace in your cluster based on curently running pods.

podsecurityaudit.sh

#!/bin/bash

set -euo pipefail

function checknspolicy() {
    ns=$1
    policy=$2

    out=$(kubectl label --dry-run=server --overwrite ns $ns pod-security.kubernetes.io/enforce=${policy} 2>&1 > /dev/null)

    if [ -z "$out" ]; then
        echo "true"
    else
        echo "false"
    fi
}

function findbestpolicy() {
    POLICYLIST="restricted baseline privileged"

    ns=$1

    for policy in $POLICYLIST; do
        if [ $(checknspolicy $ns $policy) == "true" ]; then
            echo $policy
            break
        fi
    done
}

for n in $(kubectl get namespaces -o jsonpath="{.items[*].metadata.name}"); do
    echo -n "$n: "
    findbestpolicy $n
done