# Namespace for GPU node-level plumbing (device plugin, and later DCGM).
#
# PodSecurity must be `privileged` here. The cluster default from the Talos
# controlplane config is `enforce: baseline` with exemptions only for
# kube-system, and a device plugin cannot satisfy baseline: it has to mount the
# kubelet device-plugin socket and the CDI/driver directories as hostPath
# volumes, which baseline forbids outright:
#
#   Error creating: pods "nvidia-device-plugin-xxxxx" is forbidden:
#   violates PodSecurity "baseline:latest": hostPath volumes
#   (volumes "kubelet-device-plugins-dir", "mps-root", "mps-shm", "cdi-root")
#
# This is inherent to how device plugins work, not a workaround. Scope is
# limited to this namespace; the engine namespace (llm-serving) stays on the
# cluster default.
apiVersion: v1
kind: Namespace
metadata:
  name: gpu-system
  labels:
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/warn: privileged