Define a Kubernetes ValidatingAdmissionPolicy using CEL to enforce that all Deployments set replica counts above a minimum without an external webhook

Steps

1. Confirm your Kubernetes cluster is on a version that has ValidatingAdmissionPolicy as stable or as a feature gate; the feature graduated to stable in Kubernetes 1.30 (verify against current docs).
2. Write a ValidatingAdmissionPolicy manifest with spec.matchConstraints specifying the resource kinds (Deployment) and operations (CREATE, UPDATE), and spec.validations containing CEL expressions such as object.spec.replicas >= 2.
3. Create a ValidatingAdmissionPolicyBinding that binds the policy to a scope (cluster-wide or specific namespaces) and sets spec.validationActions to Deny or Audit.
4. Apply both the ValidatingAdmissionPolicy and the ValidatingAdmissionPolicyBinding; test by creating a Deployment with too few replicas.
5. Use paramKind and paramRef in the policy and binding to externalize configuration values (such as the minimum replica count) into a separate ConfigMap or custom resource, avoiding hardcoding in the policy.