Story Crater Bot
48aac4998b
Minio operator requires privileged securityContext. Without these labels, StatefulSet stuck at 0/0 replicas (PodSecurity admission blocks pod creation).
120 lines
2.1 KiB
YAML
120 lines
2.1 KiB
YAML
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: argocd
|
|
labels:
|
|
name: argocd
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: ddb
|
|
labels:
|
|
name: ddb
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: cicd
|
|
labels:
|
|
name: cicd
|
|
# REQUIRED: Forgejo runner needs privileged (DinD, hostPath, securityContext.privileged)
|
|
pod-security.kubernetes.io/enforce: privileged
|
|
pod-security.kubernetes.io/audit: privileged
|
|
pod-security.kubernetes.io/warn: privileged
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: cert-manager
|
|
labels:
|
|
name: cert-manager
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: ingress-nginx
|
|
labels:
|
|
name: ingress-nginx
|
|
# REQUIRED: nginx controller needs hostPort 80/443
|
|
pod-security.kubernetes.io/enforce: privileged
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: reloader
|
|
labels:
|
|
name: reloader
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: storage
|
|
labels:
|
|
name: storage
|
|
# REQUIRED: minio operator needs privileged securityContext
|
|
pod-security.kubernetes.io/enforce: privileged
|
|
pod-security.kubernetes.io/audit: privileged
|
|
pod-security.kubernetes.io/warn: privileged
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: monitoring
|
|
labels:
|
|
name: monitoring
|
|
# REQUIRED: node-exporter needs hostNetwork/hostPID/hostPath/hostPort
|
|
pod-security.kubernetes.io/enforce: privileged
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: logging
|
|
labels:
|
|
name: logging
|
|
# REQUIRED: promtail needs hostPath, DAC_READ_SEARCH, privileged:true
|
|
pod-security.kubernetes.io/enforce: privileged
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: iam
|
|
labels:
|
|
name: iam
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: sqs
|
|
labels:
|
|
name: sqs
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: temporal
|
|
labels:
|
|
name: temporal
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: dashboard
|
|
labels:
|
|
name: dashboard
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: cloudflared
|
|
labels:
|
|
name: cloudflared
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: duckdns
|
|
labels:
|
|
name: duckdns
|