apiVersion: v1
kind: Namespace
metadata:
  # First, alone. Everything below is namespaced, and a sync that applied them in parallel
  # would race the namespace's own creation — including the Pod Security labels above, which
  # decide whether any of these pods are admitted at all.
  annotations:
    argocd.argoproj.io/sync-wave: "-3"
  name: jarvis
  labels:
    # Both images run unprivileged and drop every capability, so the strictest profile applies
    # cleanly. Declared here rather than assumed: under `restricted`, a container that tries to run
    # as root is refused at admission, which is a far better failure than discovering it later.
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest