From b393049241191ff6a42c25adedd85abbdcff5943 Mon Sep 17 00:00:00 2001
From: Valentin Haudiquet <valentin.haudiquet@canonical.com>
Date: Sat, 22 Aug 2026 12:31:03 +0200
Subject: [PATCH] gitea: make namespace privileged for actions runners

---
 kubernetes/dev/gitea/namespace.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/kubernetes/dev/gitea/namespace.yaml b/kubernetes/dev/gitea/namespace.yaml
index 09a988f..cf1075e 100644
--- a/kubernetes/dev/gitea/namespace.yaml
+++ b/kubernetes/dev/gitea/namespace.yaml
@@ -2,3 +2,10 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: gitea
+  labels:
+    # The Gitea Actions runner uses a privileged Docker-in-Docker sidecar,
+    # which PodSecurity "baseline" forbids
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/enforce-version: latest
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged