apiVersion: v1
kind: Namespace
metadata:
  name: gitea
  labels:
    # The Gitea Actions runner uses a privileged Docker-in-Docker sidecar,
    # which PodSecurity "baseline" forbids
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/warn: privileged