fix(promtail): set logging ns privileged via managedNamespaceMetadata — promtail hostPath/privileged/DAC_READ_SEARCH blocked by baseline PSS, DaemonSet created 0 pods

2026-07-21 11:03:58 -07:00
parent 3f4653ac56
commit 34e996475f
1 changed files with 19 additions and 0 deletions
@@ -26,6 +26,11 @@ spec:
    server: https://kubernetes.default.svc
    namespace: logging
  syncPolicy:
+    managedNamespaceMetadata:
+      # promtail needs privileged (hostPath log/journal, DAC_READ_SEARCH,
+      # privileged:true) to tail node logs — default baseline PSS blocks it.
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
    automated:
      prune: true
      selfHeal: true
@@ -55,9 +60,16 @@ spec:
    server: https://kubernetes.default.svc
    namespace: logging
  syncPolicy:
+    managedNamespaceMetadata:
+      # promtail needs privileged (hostPath log/journal, DAC_READ_SEARCH,
+      # privileged:true) to tail node logs — default baseline PSS blocks it.
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
    automated:
      prune: true
      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
 ---
 apiVersion: argoproj.io/v1alpha1
 kind: Application
@@ -82,6 +94,13 @@ spec:
    server: https://kubernetes.default.svc
    namespace: logging
  syncPolicy:
+    managedNamespaceMetadata:
+      # promtail needs privileged (hostPath log/journal, DAC_READ_SEARCH,
+      # privileged:true) to tail node logs — default baseline PSS blocks it.
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
    automated:
      prune: true
      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true