fix: remove privileged init container, set pod-security baseline for OpenSearch

k8s/infra/databases/opensearch.yaml

@@ -7,6 +7,10 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: poimen
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/audit: baseline
+    pod-security.kubernetes.io/warn: baseline
 ---
 
 # OpenSearch Service (Headless for StatefulSet discovery)
@@ -108,14 +112,7 @@ spec:
         app.kubernetes.io/name: opensearch
     spec:
       serviceAccountName: opensearch
-      
+      hostNetwork: false
-      # Init container: set vm.max_map_count (required by Elasticsearch/OpenSearch)
-      initContainers:
-        - name: set-vm-max-map-count
-          image: busybox:1.35
-          command: ['sysctl', '-w', 'vm.max_map_count=262144']
-          securityContext:
-            privileged: true
       
       containers:
         - name: opensearch