16 lines
761 B
YAML
16 lines
761 B
YAML
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
# First, alone. Everything below is namespaced, and a sync that applied them in parallel
|
|
# would race the namespace's own creation — including the Pod Security labels above, which
|
|
# decide whether any of these pods are admitted at all.
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "-3"
|
|
name: jarvis
|
|
labels:
|
|
# Both images run unprivileged and drop every capability, so the strictest profile applies
|
|
# cleanly. Declared here rather than assumed: under `restricted`, a container that tries to run
|
|
# as root is refused at admission, which is a far better failure than discovering it later.
|
|
pod-security.kubernetes.io/enforce: restricted
|
|
pod-security.kubernetes.io/enforce-version: latest
|