From ff00f666a0aea2149bf3955ccb8b711113e06dbb Mon Sep 17 00:00:00 2001
From: Scooby Husky <garrettstone499@gmail.com>
Date: Sun, 15 Mar 2026 22:27:39 -0500
Subject: [PATCH] Add privileged PodSecurity label to 8 namespaces for NetBird
 router

NetBird router deployments require NET_ADMIN capability, which is
blocked by the default baseline PodSecurity standard. Add
managedNamespaceMetadata with pod-security.kubernetes.io/enforce:
privileged to argocd, frigate, gitlab, grafana, guacamole,
home-assistant, teslamate, and vault ArgoCD Applications.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 argocd-apps/apps/argocd.yaml            | 3 +++
 argocd-apps/apps/frigate.yaml           | 3 +++
 argocd-apps/apps/gitlab.yaml            | 3 +++
 argocd-apps/apps/guacamole.yaml         | 3 +++
 argocd-apps/apps/home-assistant.yaml    | 3 +++
 argocd-apps/apps/teslamate.yaml         | 3 +++
 argocd-apps/infrastructure/grafana.yaml | 3 +++
 argocd-apps/infrastructure/vault.yaml   | 3 +++
 8 files changed, 24 insertions(+)

diff --git a/argocd-apps/apps/argocd.yaml b/argocd-apps/apps/argocd.yaml
index 9d92324..93c9210 100644
--- a/argocd-apps/apps/argocd.yaml
+++ b/argocd-apps/apps/argocd.yaml
@@ -29,6 +29,9 @@ spec:
     automated:
       prune: true
       selfHeal: true
+    managedNamespaceMetadata:
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true
diff --git a/argocd-apps/apps/frigate.yaml b/argocd-apps/apps/frigate.yaml
index bcb42d2..2a7d2ea 100644
--- a/argocd-apps/apps/frigate.yaml
+++ b/argocd-apps/apps/frigate.yaml
@@ -29,6 +29,9 @@ spec:
     automated:
       prune: true
       selfHeal: true
+    managedNamespaceMetadata:
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true
diff --git a/argocd-apps/apps/gitlab.yaml b/argocd-apps/apps/gitlab.yaml
index 814aadb..31fd4bc 100644
--- a/argocd-apps/apps/gitlab.yaml
+++ b/argocd-apps/apps/gitlab.yaml
@@ -37,6 +37,9 @@ spec:
     automated:
       prune: true
       selfHeal: true
+    managedNamespaceMetadata:
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true
diff --git a/argocd-apps/apps/guacamole.yaml b/argocd-apps/apps/guacamole.yaml
index 04ffbc9..95a46cb 100644
--- a/argocd-apps/apps/guacamole.yaml
+++ b/argocd-apps/apps/guacamole.yaml
@@ -20,6 +20,9 @@ spec:
     automated:
       prune: true
       selfHeal: true
+    managedNamespaceMetadata:
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true
diff --git a/argocd-apps/apps/home-assistant.yaml b/argocd-apps/apps/home-assistant.yaml
index 3066eba..60e6cc9 100644
--- a/argocd-apps/apps/home-assistant.yaml
+++ b/argocd-apps/apps/home-assistant.yaml
@@ -29,6 +29,9 @@ spec:
     automated:
       prune: true
       selfHeal: true
+    managedNamespaceMetadata:
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true
diff --git a/argocd-apps/apps/teslamate.yaml b/argocd-apps/apps/teslamate.yaml
index d2142b8..7b8dd3c 100644
--- a/argocd-apps/apps/teslamate.yaml
+++ b/argocd-apps/apps/teslamate.yaml
@@ -29,6 +29,9 @@ spec:
     automated:
       prune: true
       selfHeal: true
+    managedNamespaceMetadata:
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true
diff --git a/argocd-apps/infrastructure/grafana.yaml b/argocd-apps/infrastructure/grafana.yaml
index 172c9a2..48a7f08 100644
--- a/argocd-apps/infrastructure/grafana.yaml
+++ b/argocd-apps/infrastructure/grafana.yaml
@@ -32,6 +32,9 @@ spec:
     automated:
       prune: true
       selfHeal: true
+    managedNamespaceMetadata:
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true
diff --git a/argocd-apps/infrastructure/vault.yaml b/argocd-apps/infrastructure/vault.yaml
index e413d47..14cc635 100644
--- a/argocd-apps/infrastructure/vault.yaml
+++ b/argocd-apps/infrastructure/vault.yaml
@@ -29,6 +29,9 @@ spec:
     automated:
       prune: true
       selfHeal: true
+    managedNamespaceMetadata:
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true