13 lines
482 B
YAML
13 lines
482 B
YAML
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: cicd
|
|
labels:
|
|
# privileged: the forgejo-runner's dind (docker-in-docker) sidecar requires
|
|
# securityContext.privileged=true, which baseline/restricted PSS reject
|
|
# (the ReplicaSet silently creates 0 pods). gitea, redis and CNPG here are
|
|
# already privileged-tolerant.
|
|
pod-security.kubernetes.io/enforce: privileged
|
|
pod-security.kubernetes.io/audit: privileged
|
|
pod-security.kubernetes.io/warn: privileged
|