From 34e996475f596d647d29fc9366d0c26baed65839 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 21 Jul 2026 11:03:58 -0700
Subject: [PATCH] =?UTF-8?q?fix(promtail):=20set=20logging=20ns=20privilege?=
 =?UTF-8?q?d=20via=20managedNamespaceMetadata=20=E2=80=94=20promtail=20hos?=
 =?UTF-8?q?tPath/privileged/DAC=5FREAD=5FSEARCH=20blocked=20by=20baseline?=
 =?UTF-8?q?=20PSS,=20DaemonSet=20created=200=20pods?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 k8s/argocd/apps/20-logging.yaml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/k8s/argocd/apps/20-logging.yaml b/k8s/argocd/apps/20-logging.yaml
index fbd5fdb..9426a07 100644
--- a/k8s/argocd/apps/20-logging.yaml
+++ b/k8s/argocd/apps/20-logging.yaml
@@ -26,6 +26,11 @@ spec:
     server: https://kubernetes.default.svc
     namespace: logging
   syncPolicy:
+    managedNamespaceMetadata:
+      # promtail needs privileged (hostPath log/journal, DAC_READ_SEARCH,
+      # privileged:true) to tail node logs — default baseline PSS blocks it.
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
     automated:
       prune: true
       selfHeal: true
@@ -55,9 +60,16 @@ spec:
     server: https://kubernetes.default.svc
     namespace: logging
   syncPolicy:
+    managedNamespaceMetadata:
+      # promtail needs privileged (hostPath log/journal, DAC_READ_SEARCH,
+      # privileged:true) to tail node logs — default baseline PSS blocks it.
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
     automated:
       prune: true
       selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
 ---
 apiVersion: argoproj.io/v1alpha1
 kind: Application
@@ -82,6 +94,13 @@ spec:
     server: https://kubernetes.default.svc
     namespace: logging
   syncPolicy:
+    managedNamespaceMetadata:
+      # promtail needs privileged (hostPath log/journal, DAC_READ_SEARCH,
+      # privileged:true) to tail node logs — default baseline PSS blocks it.
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
     automated:
       prune: true
       selfHeal: true
+    syncOptions:
+      - CreateNamespace=true