From 3d2aea2d1f59ee3ace4a8ef7046c4fa32fbe3b2f Mon Sep 17 00:00:00 2001
From: ahmza <hamza@ahmza.com>
Date: Thu, 3 Sep 2026 02:37:13 +0100
Subject: [PATCH] Allow MetalLB's privileged networking Pods via namespace Pod
 Security labels

---
 apps/metallb.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/apps/metallb.yaml b/apps/metallb.yaml
index b92a8ef..6b1ee53 100644
--- a/apps/metallb.yaml
+++ b/apps/metallb.yaml
@@ -34,5 +34,14 @@ spec:
     automated:
       prune: true
       selfHeal: true
+    # MetalLB's speaker and FRR Pods use host networking and Linux network
+    # capabilities so they can establish BGP sessions. Kubernetes' baseline
+    # Pod Security policy rejects those by design; privilege is scoped to this
+    # dedicated namespace rather than weakened cluster-wide.
+    managedNamespaceMetadata:
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
+        pod-security.kubernetes.io/audit: privileged
+        pod-security.kubernetes.io/warn: privileged
     syncOptions:
       - CreateNamespace=true