---
apiVersion: v1
kind: Namespace
metadata:
  name: xpeditis-prod
  labels:
    app.kubernetes.io/part-of: xpeditis
    environment: production
    # Pod Security Admission en mode "restricted" : refuse tout pod privilegie,
    # tout conteneur root, toute capability. C'est une barriere du cluster,
    # independante de ce que contiennent les manifests applicatifs.
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted
---
apiVersion: v1
kind: Namespace
metadata:
  name: monitoring
  labels:
    app.kubernetes.io/part-of: xpeditis
    environment: production
    # "baseline" et non "restricted" : Promtail doit lire les journaux des
    # conteneurs de l'hote (hostPath), ce que "restricted" interdit.
    # Le compromis est assume et confine a ce seul namespace.
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted