diff --git a/bootstrap/calico/namespace.yaml b/bootstrap/calico/namespace.yaml index 27cd9ea119d661cc0918c13b3f168d3300e40f90..65f8e79629eef7f56c6c40651bc408eceba28c51 100644 --- a/bootstrap/calico/namespace.yaml +++ b/bootstrap/calico/namespace.yaml @@ -3,4 +3,7 @@ kind: Namespace metadata: name: tigera-operator labels: - kyverno.shivering-isles.com/class: "system" + kyverno.shivering-isles.com/class: "system" + pod-security.kubernetes.io/enforce: privileged + pod-security.kubernetes.io/audit: privileged + pod-security.kubernetes.io/warn: privileged diff --git a/infrastructure/longhorn/namespace.yaml b/infrastructure/longhorn/namespace.yaml index 6b1119d699b686c70fd3ea29c75a2deb0df241f3..12fdb44283b0b191f3f4983c37b126a7820c4f84 100644 --- a/infrastructure/longhorn/namespace.yaml +++ b/infrastructure/longhorn/namespace.yaml @@ -6,3 +6,6 @@ metadata: name: longhorn-system kyverno.shivering-isles.com/class: "system" kustomize.toolkit.fluxcd.io/prune: disabled + pod-security.kubernetes.io/enforce: privileged + pod-security.kubernetes.io/audit: privileged + pod-security.kubernetes.io/warn: privileged diff --git a/infrastructure/metallb/namespace.yaml b/infrastructure/metallb/namespace.yaml index 57ae827fa8b49f2b1906f403749ec41c99f6dfc9..f7ad6ef9bee5d521441a09fe4e5a56a9cba47d46 100644 --- a/infrastructure/metallb/namespace.yaml +++ b/infrastructure/metallb/namespace.yaml @@ -4,4 +4,7 @@ metadata: name: metallb-system labels: name: metallb-system - kyverno.shivering-isles.com/class: "system" + kyverno.shivering-isles.com/class: "system" + pod-security.kubernetes.io/enforce: privileged + pod-security.kubernetes.io/audit: privileged + pod-security.kubernetes.io/warn: privileged diff --git a/infrastructure/monitoring/namespace.yaml b/infrastructure/monitoring/namespace.yaml index dfdc3f8b3e1a2c760877352365a52ff9d7b2260a..6e28f37a1d0700cd80ab21d5afe03b099094c32e 100644 --- a/infrastructure/monitoring/namespace.yaml +++ b/infrastructure/monitoring/namespace.yaml @@ -6,3 +6,6 @@ metadata: name: monitoring-system kyverno.shivering-isles.com/class: "system" monitoring.shivering-isles.com/network-access-required: "true" + pod-security.kubernetes.io/enforce: privileged + pod-security.kubernetes.io/audit: privileged + pod-security.kubernetes.io/warn: privileged diff --git a/infrastructure/node-features/namespace.yaml b/infrastructure/node-features/namespace.yaml index 2d112c5bbfb53236ea2758d1072b1cd816c399d8..78b38b95a96d5b365e1c13715ad47e2be52d9e39 100644 --- a/infrastructure/node-features/namespace.yaml +++ b/infrastructure/node-features/namespace.yaml @@ -5,3 +5,6 @@ metadata: labels: name: node-features-system kyverno.shivering-isles.com/class: "system" + pod-security.kubernetes.io/enforce: privileged + pod-security.kubernetes.io/audit: privileged + pod-security.kubernetes.io/warn: privileged