20 lines
810 B
YAML
20 lines
810 B
YAML
|
# iMessage delivery for the cluster.
|
||
|
|
#
|
||
|
|
# BlueBubbles' server is a macOS Electron app paired with an Objective-C helper
|
||
|
|
# that hooks Messages.app private APIs — it cannot be containerised on Linux,
|
||
|
|
# because containers share the host kernel and macOS needs XNU + Cocoa. The only
|
||
|
|
# way to run it on Talos is a full macOS VM under QEMU/KVM (Docker-OSX), which
|
||
|
|
# needs a privileged pod with /dev/kvm.
|
||
|
|
#
|
||
|
|
# Hence privileged PodSecurity: the cluster default from the Talos controlplane
|
||
|
|
# is `enforce: baseline`, which forbids privileged containers and host devices.
|
||
|
|
# Scope is limited to this namespace.
|
||
|
|
apiVersion: v1
|
||
|
|
kind: Namespace
|
||
|
|
metadata:
|
||
|
|
name: sms
|
||
|
|
labels:
|
||
|
|
pod-security.kubernetes.io/enforce: privileged
|
||
|
|
pod-security.kubernetes.io/audit: privileged
|
||
|
|
pod-security.kubernetes.io/warn: privileged
|