Allow Longhorn's privileged storage Pods via namespace Pod Security labels

2026-09-03 03:09:39 +01:00
parent 49d3f5c092
commit 9bb29eee5a
1 changed files with 9 additions and 0 deletions
@@ -32,5 +32,14 @@ spec:
    automated:
      prune: true
      selfHeal: true
+    # Longhorn's manager Pods need hostPath volumes and privileged mode to
+    # manage block devices directly on each node. Kubernetes' baseline Pod
+    # Security profile rejects both, so this namespace is explicitly opted
+    # into the privileged profile—scoped only to longhorn-system.
+    managedNamespaceMetadata:
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
+        pod-security.kubernetes.io/audit: privileged
+        pod-security.kubernetes.io/warn: privileged
    syncOptions:
      - CreateNamespace=true