apiVersion: v1
kind: Namespace
metadata:
  name: openpxe
  labels:
    # Allow privileged pods (host-network) in this namespace only. The pod
    # itself still runs non-root with only NET_BIND_SERVICE — privileged
    # here is about namespace pod-security, not container privileges.
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/warn: privileged
    pod-security.kubernetes.io/audit: privileged