Restrict custom post type to only site administrator role

register_post_type() accepts a parameter capabilities in its arguments. See get_post_type_capabilities() for possible values. From the comments:

By default, seven keys are accepted as part of the capabilities array:

• edit_post, read_post, and delete_post are meta capabilities, which are then
  generally mapped to corresponding primitive capabilities depending on the
  context, which would be the post being edited/read/deleted and the user or
  role being checked. Thus these capabilities would generally not be granted
  directly to users or roles.

• edit_posts – Controls whether objects of this post type can be edited.

• edit_others_posts – Controls whether objects of this type owned by other users can be edited. If the post type does not support an author, then this will behave like edit_posts.
• publish_posts – Controls publishing objects of this post type.
• read_private_posts – Controls whether private objects can be read.

These four primitive capabilities are checked in core in various
locations. There are also seven other primitive capabilities which are
not referenced directly in core, except in map_meta_cap(), which takes
the three aforementioned meta capabilities and translates them into
one or more primitive capabilities that must then be checked against
the user or role, depending on the context.

• read – Controls whether objects of this post type can be read.
• delete_posts – Controls whether objects of this post type can be deleted.
• delete_private_posts – Controls whether private objects can be deleted.
• delete_published_posts – Controls whether published objects can be deleted.
• delete_others_posts – Controls whether objects owned by other users can be can be deleted. If the post type does not support an author, then this will behave like delete_posts.
• edit_private_posts – Controls whether private objects can be edited.
• edit_published_posts – Controls whether published objects can be edited.

These additional capabilities are only used in map_meta_cap(). Thus,
they are only assigned by default if the post type is registered with
the 'map_meta_cap' argument set to true (default is false).

In your registration arguments add:

'capabilities' => array(
    'edit_post'          => 'update_core',
    'read_post'          => 'update_core',
    'delete_post'        => 'update_core',
    'edit_posts'         => 'update_core',
    'edit_others_posts'  => 'update_core',
    'delete_posts'       => 'update_core',
    'publish_posts'      => 'update_core',
    'read_private_posts' => 'update_core'
),