apiVersion: v1
kind: Namespace
metadata:
  name: cicd
  labels:
    # privileged: the forgejo-runner's dind (docker-in-docker) sidecar requires
    # securityContext.privileged=true, which baseline/restricted PSS reject
    # (the ReplicaSet silently creates 0 pods). gitea, redis and CNPG here are
    # already privileged-tolerant.
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/warn: privileged