From 88f8a764de7f05b316028c184eb7ffdda1fc1e58 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 21 Jul 2026 11:05:04 -0700
Subject: [PATCH] =?UTF-8?q?fix(prometheus):=20set=20monitoring=20ns=20priv?=
 =?UTF-8?q?ileged=20via=20managedNamespaceMetadata=20=E2=80=94=20node-expo?=
 =?UTF-8?q?rter=20hostNetwork/hostPID/hostPath=20blocked=20by=20baseline?=
 =?UTF-8?q?=20PSS?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 k8s/argocd/apps/10-storage-observability.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/k8s/argocd/apps/10-storage-observability.yaml b/k8s/argocd/apps/10-storage-observability.yaml
index e706d76..ef9a212 100644
--- a/k8s/argocd/apps/10-storage-observability.yaml
+++ b/k8s/argocd/apps/10-storage-observability.yaml
@@ -100,6 +100,11 @@ spec:
     server: https://kubernetes.default.svc
     namespace: monitoring
   syncPolicy:
+    managedNamespaceMetadata:
+      # node-exporter needs hostNetwork/hostPID/hostPath/hostPort; blocked by
+      # default baseline PSS (DaemonSet created 0 pods, Prometheus STS stuck).
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
     automated:
       prune: true
       selfHeal: true