From 934241a9b1bf1b307e082d18dcdafd2ffc94c3d6 Mon Sep 17 00:00:00 2001
From: ivan <ivan@MacBook-Air-som-tillhor-ivan.local>
Date: Fri, 23 Oct 2026 16:38:08 +0500
Subject: [PATCH] premises/d8-ugmk-prod: privileged pod-policy on the namespace

Deckhouse admission-policy-engine (baseline) rejected the pods because
istio-init needs NET_ADMIN and NET_RAW. Label the namespace
security.deckhouse.io/pod-policy=privileged like the other app namespaces in
ugmk.
---
 apps/premises/d8-ugmk-prod/kustomization.yaml | 4 ++++
 apps/premises/d8-ugmk-prod/namespace.yaml     | 8 ++++++++
 2 files changed, 12 insertions(+)
 create mode 100644 apps/premises/d8-ugmk-prod/namespace.yaml

diff --git a/apps/premises/d8-ugmk-prod/kustomization.yaml b/apps/premises/d8-ugmk-prod/kustomization.yaml
index 9ffa6d0..be3f8da 100644
--- a/apps/premises/d8-ugmk-prod/kustomization.yaml
+++ b/apps/premises/d8-ugmk-prod/kustomization.yaml
@@ -4,6 +4,10 @@ resources:
   - ../base
   - kafka-ca-configmap.yaml
 patches:
+  - path: namespace.yaml
+    target:
+      kind: Namespace
+      name: premises
   - path: backend.yaml
     target:
       kind: HelmRelease
diff --git a/apps/premises/d8-ugmk-prod/namespace.yaml b/apps/premises/d8-ugmk-prod/namespace.yaml
new file mode 100644
index 0000000..3b699f7
--- /dev/null
+++ b/apps/premises/d8-ugmk-prod/namespace.yaml
@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: premises
+  labels:
+    istio-injection: enabled
+    security.deckhouse.io/pod-policy: privileged