fix: set logging/monitoring namespaces privileged PSS for promtail/node-exporter hostPath access

k8s/argocd/apps/10-storage-observability.yaml

@@ -100,6 +100,11 @@ spec:
     server: https://kubernetes.default.svc
     namespace: monitoring
   syncPolicy:
+    managedNamespaceMetadata:
+      # node-exporter needs hostNetwork/hostPID/hostPath/hostPort; blocked by
+      # default baseline PSS (DaemonSet created 0 pods, Prometheus STS stuck).
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
     automated:
       prune: true
       selfHeal: true

k8s/argocd/apps/20-logging.yaml

@@ -26,6 +26,11 @@ spec:
     server: https://kubernetes.default.svc
     namespace: logging
   syncPolicy:
+    managedNamespaceMetadata:
+      # promtail needs privileged (hostPath log/journal, DAC_READ_SEARCH,
+      # privileged:true) to tail node logs — default baseline PSS blocks it.
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
     automated:
       prune: true
       selfHeal: true
@@ -55,9 +60,16 @@ spec:
     server: https://kubernetes.default.svc
     namespace: logging
   syncPolicy:
+    managedNamespaceMetadata:
+      # promtail needs privileged (hostPath log/journal, DAC_READ_SEARCH,
+      # privileged:true) to tail node logs — default baseline PSS blocks it.
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
     automated:
       prune: true
       selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
 ---
 apiVersion: argoproj.io/v1alpha1
 kind: Application
@@ -82,6 +94,13 @@ spec:
     server: https://kubernetes.default.svc
     namespace: logging
   syncPolicy:
+    managedNamespaceMetadata:
+      # promtail needs privileged (hostPath log/journal, DAC_READ_SEARCH,
+      # privileged:true) to tail node logs — default baseline PSS blocks it.
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
     automated:
       prune: true
       selfHeal: true
+    syncOptions:
+      - CreateNamespace=true