apiVersion: v1
kind: Namespace
metadata:
  name: jarvis
  labels:
    # Both images run unprivileged and drop every capability, so the strictest profile applies
    # cleanly. Declared here rather than assumed: under `restricted`, a container that tries to run
    # as root is refused at admission, which is a far better failure than discovering it later.
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest