---
id: w7/m2/t001
title: "Enforce PSS baseline on the apps namespace"
worker: worker7
status: done
estimate: 30m
depends_on: [w7/m1/t001]
---

## Objective

The apps namespace enforces Pod Security Standards `baseline` (blocks privileged containers, hostPath, hostNetwork/hostPID, etc.) via namespace labels — `enforce=baseline`, plus `warn`/`audit` at `restricted` to surface how far tenant images are from the stricter tier without breaking them.

## Context

- The w7/m1/t001 ADR fixes the namespace layout first; if it keeps a shared namespace, it must be a dedicated one (not `default`) so these labels don't affect unrelated workloads — this task labels whatever namespace(s) the ADR chose.
- `restricted` is deliberately **not** enforced: tenant images may legitimately run as root (recorded in the ADR).
- Namespace manifests live wherever the ADR put namespace creation: `deploy/gitops/` (static) or the projector (namespace-per-workspace).

## Steps

1. Add `pod-security.kubernetes.io/enforce: baseline` (+ `warn`/`audit: restricted`) to the apps namespace manifest(s) or the projector's namespace creation.
2. If prod's `BEX_CP_APPS_NAMESPACE` currently points at `default`, migrate it to the dedicated namespace per the ADR (coordinate with the prod deployment env).
3. `scripts/gitops-validate.sh` if gitops-side; redeploy the mock cluster and confirm samples still schedule.

## Files

- `deploy/gitops/` namespace manifest **or** `lego/backend/internal/store/reconciler.go` — per the m1 ADR

## Acceptance criteria

- [ ] `kubectl apply` of a privileged pod spec into the apps namespace is rejected with a PSS message
- [ ] `examples/whoami-app.yaml` still reaches Ready
- [ ] Labels present on every namespace tenant workloads land in

## Out of scope

- Operator-side securityContext defaults (t002); `restricted` enforcement (FUTURE — revisit with the microVM item)
