Sync the self-hosting stack

2026-08-27 17:52:23 +02:00
parent af6710d849
commit 02ab18aff1
12 changed files with 1407 additions and 0 deletions
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: jarvis
+  labels:
+    # Both images run unprivileged and drop every capability, so the strictest profile applies
+    # cleanly. Declared here rather than assumed: under `restricted`, a container that tries to run
+    # as root is refused at admission, which is a far better failure than discovering it later.
+    pod-security.kubernetes.io/enforce: restricted
+    pod-security.kubernetes.io/enforce-version: latest