fix: set logging/monitoring namespaces privileged PSS for promtail/node-exporter hostPath access

2026-08-18 15:08:02 -07:00
parent cd861a75e6
commit dc1ab77b54
2 changed files with 24 additions and 0 deletions
@@ -100,6 +100,11 @@ spec:
    server: https://kubernetes.default.svc
    namespace: monitoring
  syncPolicy:
+    managedNamespaceMetadata:
+      # node-exporter needs hostNetwork/hostPID/hostPath/hostPort; blocked by
+      # default baseline PSS (DaemonSet created 0 pods, Prometheus STS stuck).
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
    automated:
      prune: true
      selfHeal: true