From ce1fc4e2961765f16276d82b0909edb190922589 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Mon, 20 Jul 2026 12:56:05 -0700
Subject: [PATCH] =?UTF-8?q?fix(ingress-nginx):=20set=20privileged=20PodSec?=
 =?UTF-8?q?urity=20via=20managedNamespaceMetadata=20=E2=80=94=20hostPort?=
 =?UTF-8?q?=2080/443=20blocked=20by=20default=20baseline=20enforce,=20make?=
 =?UTF-8?q?s=20label=20permanent=20in=20IaC?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 k8s/argocd/apps/00-substrate.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/k8s/argocd/apps/00-substrate.yaml b/k8s/argocd/apps/00-substrate.yaml
index 37a68d0..1bedc2e 100644
--- a/k8s/argocd/apps/00-substrate.yaml
+++ b/k8s/argocd/apps/00-substrate.yaml
@@ -61,6 +61,11 @@ spec:
     server: https://kubernetes.default.svc
     namespace: ingress-nginx
   syncPolicy:
+    managedNamespaceMetadata:
+      # hostPort 80/443 requires the privileged PodSecurity level; the default
+      # baseline/restricted enforce blocks the controller DaemonSet.
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
     automated:
       prune: true
       selfHeal: true