fix(ingress-nginx): set privileged PodSecurity via managedNamespaceMetadata — hostPort 80/443 blocked by default baseline enforce, makes label permanent in IaC

2026-07-20 12:56:05 -07:00
parent d841bbdb95
commit ce1fc4e296
1 changed files with 5 additions and 0 deletions
@@ -61,6 +61,11 @@ spec:
    server: https://kubernetes.default.svc
    namespace: ingress-nginx
  syncPolicy:
+    managedNamespaceMetadata:
+      # hostPort 80/443 requires the privileged PodSecurity level; the default
+      # baseline/restricted enforce blocks the controller DaemonSet.
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
    automated:
      prune: true
      selfHeal: true