k8s/bootstrap/phase3-forgejo/namespace.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: cicd
  labels:
    # privileged: the forgejo-runner's dind (docker-in-docker) sidecar requires
    # securityContext.privileged=true, which baseline/restricted PSS reject
    # (the ReplicaSet silently creates 0 pods). gitea, redis and CNPG here are
    # already privileged-tolerant.
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/warn: privileged
fix(bootstrap): correct cluster config + complete Phase4 ArgoCD bootstrap permanent fixes 2026-08-18 15:08:03 -07:00			`apiVersion: v1`
			`kind: Namespace`
			`metadata:`
			`name: cicd`
			`labels:`
fix(forgejo-runner): cicd ns PSS privileged (dind needs it) + mount homelab-ca as ConfigMap not Secret — runner RS created 0 pods under baseline PSS, then FailedMount because homelab-ca is a ConfigMap trust bundle, not a Secret 2026-08-12 16:25:18 -07:00			`# privileged: the forgejo-runner's dind (docker-in-docker) sidecar requires`
			`# securityContext.privileged=true, which baseline/restricted PSS reject`
			`# (the ReplicaSet silently creates 0 pods). gitea, redis and CNPG here are`
			`# already privileged-tolerant.`
			`pod-security.kubernetes.io/enforce: privileged`
			`pod-security.kubernetes.io/audit: privileged`
			`pod-security.kubernetes.io/warn: privileged`