From 9bb29eee5adb8aa22a0508ff50a106bd37f5f230 Mon Sep 17 00:00:00 2001
From: ahmza <hamza@ahmza.com>
Date: Thu, 3 Sep 2026 03:09:39 +0100
Subject: [PATCH] Allow Longhorn's privileged storage Pods via namespace Pod
 Security labels

---
 apps/longhorn.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/apps/longhorn.yaml b/apps/longhorn.yaml
index f3b9e1a..4d16a4c 100644
--- a/apps/longhorn.yaml
+++ b/apps/longhorn.yaml
@@ -32,5 +32,14 @@ spec:
     automated:
       prune: true
       selfHeal: true
+    # Longhorn's manager Pods need hostPath volumes and privileged mode to
+    # manage block devices directly on each node. Kubernetes' baseline Pod
+    # Security profile rejects both, so this namespace is explicitly opted
+    # into the privileged profile—scoped only to longhorn-system.
+    managedNamespaceMetadata:
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
+        pod-security.kubernetes.io/audit: privileged
+        pod-security.kubernetes.io/warn: privileged
     syncOptions:
       - CreateNamespace=true