apiVersion: v1
kind: Namespace
metadata:
  name: cicd
  labels:
    # Baseline allows most workloads while blocking clearly dangerous configurations
    # Redis needs some relaxed settings but doesn't need full privileged access
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/audit: baseline
    pod-security.kubernetes.io/warn: baseline